Python version of redsocks tailored for anti-GFW
Motivation
- improve speed and lower the cost by per-connection proxy selection,
only if GFW jammed us we fallback to proxy for just that connection
- improve reliability by fall back from a pool of proxies
- improve speed by using a pool of proxies in a load balanced way
So, fqsocks is a transparent socks redirector, just like
http://darkk.net.ru/redsocks/
- redirect tcp traffic to fqsocks using iptables, fqsocks will select upstream and proxy for the tcp connection
- goagent proxy (--proxy goagent,appid=abcd), ripped out from original goagent client
- http-connect proxy (--proxy http-connect,proxy_ip=1.2.3.4,proxy_port=8080)
- dynamic proxy (--proxy dynamic,type=goagent,dns_record=goagent1.fqrouter.com), change the proxy via dns
Unique Features
- detect the traffic protocol (HTTP/HTTPS), not just based on port
- for http, the first request/response will be tried with proxy, if anything goes wrong fallback to another proxy.
so, it is effective against GFW full text filtering.
the page http://zh.wikipedia.org/zh/防火长城 is a typical example of full text filtering (the url does not trigger to RST)
- for https, socket connect and full ssl handshake will be tried, if
anything goes wrong (https certificate filtering for example), fallback
to another proxy.
- built-in support goagent as proxy, without starting an seperate goagent process
- resolve proxy info from TXT dns record
Basic Usage
- start fqsocks: ./fqsocks.py --outbound-ip 10.1.2.3 --listen *:1984
- redirect tcp traffic: iptables -t nat -I OUTPUT -p tcp -j REDIRECT --to-ports 1984
- key issue: how to avoid fqsocks outbound being redirected by iptables again?
- answer is outbound from 10.1.2.3 and masquerade from it: iptables -t nat -I POSTROUTING -s 10.1.2.3 -j MASQUERADE
- 10.1.2.3 is a lo alias: ifconfig lo:1 10.1.2.3 netmask 255.255.255.255
Alternatively, you can use --mark or --owner module to distinguish the fqsocks outbound traffic from others.
But use outbound ip is the most portable way, especially for android.
Proxy Selection Logic
- china ip: go directly
- dport is 80 or protocol is http: direct => http only proxy => http/https proxy
- dport is 443 or protocol is https: direct => https proxy
- direct connection failed will blacklist that ip:port for 1 minute
- blacklisted ip:port will use proxy.
from https://github.com/fqrouter/fqsocks
