Total Pageviews

Monday, 8 February 2016



Python version of redsocks tailored for anti-GFW。

  • improve speed and lower the cost by per-connection proxy selection, only if GFW jammed us we fallback to proxy for just that connection
  • improve reliability by fall back from a pool of proxies
  • improve speed by using a pool of proxies in a load balanced way
So, fqsocks is a transparent socks redirector, just like
  • redirect tcp traffic to fqsocks using iptables, fqsocks will select upstream and proxy for the tcp connection
  • goagent proxy (--proxy goagent,appid=abcd), ripped out from original goagent client
  • http-connect proxy (--proxy http-connect,proxy_ip=,proxy_port=8080)
  • dynamic proxy (--proxy dynamic,type=goagent,, change the proxy via dns

Unique Features

  • detect the traffic protocol (HTTP/HTTPS), not just based on port
  • for http, the first request/response will be tried with proxy, if anything goes wrong fallback to another proxy. so, it is effective against GFW full text filtering. the page防火长城‎ is a typical example of full text filtering (the url does not trigger to RST)
  • for https, socket connect and full ssl handshake will be tried, if anything goes wrong (https certificate filtering for example), fallback to another proxy.
  • built-in support goagent as proxy, without starting an seperate goagent process
  • resolve proxy info from TXT dns record

Basic Usage

  • start fqsocks: ./ --outbound-ip --listen *:1984
  • redirect tcp traffic: iptables -t nat -I OUTPUT -p tcp -j REDIRECT --to-ports 1984
  • key issue: how to avoid fqsocks outbound being redirected by iptables again?
  • answer is outbound from and masquerade from it: iptables -t nat -I POSTROUTING -s -j MASQUERADE
  • is a lo alias: ifconfig lo:1 netmask
Alternatively, you can use --mark or --owner module to distinguish the fqsocks outbound traffic from others. But use outbound ip is the most portable way, especially for android.

Proxy Selection Logic

  • china ip: go directly
  • dport is 80 or protocol is http: direct => http only proxy => http/https proxy
  • dport is 443 or protocol is https: direct => https proxy
  • direct connection failed will blacklist that ip:port for 1 minute
  • blacklisted ip:port will use proxy