A simple DPI bypassing tool written in go.
_____ _____ _____ _____ _____ _____
/\ \ /\ \ /\ \ /\ \ /\ \ /\ \
/::\ \ /::\ \ /::\ \ /::\ \ /::\ \ /::\ \
/::::\ \ /::::\ \ /::::\ \ /::::\ \ /::::\ \ /::::\ \
/::::::\ \ /::::::\ \ /::::::\ \ /::::::\ \ /::::::\ \ /::::::\ \
/:::/\:::\ \ /:::/\:::\ \ /:::/\:::\ \ /:::/\:::\ \ /:::/\:::\ \ /:::/\:::\ \
/:::/__\:::\ \ /:::/__\:::\ \ /:::/__\:::\ \ /:::/__\:::\ \ /:::/__\:::\ \ /:::/__\:::\ \
/::::\ \:::\ \ /::::\ \:::\ \ /::::\ \:::\ \ /::::\ \:::\ \ \:::\ \:::\ \ \:::\ \:::\ \
/::::::\ \:::\ \ /::::::\ \:::\ \ /::::::\ \:::\ \ /::::::\ \:::\ \ ___\:::\ \:::\ \ ___\:::\ \:::\ \
/:::/\:::\ \:::\ ___\ /:::/\:::\ \:::\ \ /:::/\:::\ \:::\____\ /:::/\:::\ \:::\ \ /\ \:::\ \:::\ \ /\ \:::\ \:::\ \
/:::/__\:::\ \:::| | /:::/__\:::\ \:::\____\ /:::/ \:::\ \:::| | /:::/ \:::\ \:::\____\ /::\ \:::\ \:::\____\ /::\ \:::\ \:::\____\
\:::\ \:::\ /:::|____| \:::\ \:::\ \::/ / \::/ \:::\ /:::|____| \::/ \:::\ /:::/ / \:::\ \:::\ \::/ / \:::\ \:::\ \::/ /
\:::\ \:::\/:::/ / \:::\ \:::\ \/____/ \/_____/\:::\/:::/ / \/____/ \:::\/:::/ / \:::\ \:::\ \/____/ \:::\ \:::\ \/____/
\:::\ \::::::/ / \:::\ \:::\ \ \::::::/ / \::::::/ / \:::\ \:::\ \ \:::\ \:::\ \
\:::\ \::::/ / \:::\ \:::\____\ \::::/ / \::::/ / \:::\ \:::\____\ \:::\ \:::\____\
\:::\ /:::/ / \:::\ \::/ / \::/____/ /:::/ / \:::\ /:::/ / \:::\ /:::/ /
\:::\/:::/ / \:::\ \/____/ ~~ /:::/ / \:::\/:::/ / \:::\/:::/ /
\::::::/ / \:::\ \ /:::/ / \::::::/ / \::::::/ /
\::::/ / \:::\____\ /:::/ / \::::/ / \::::/ /
\::/____/ \::/ / \::/ / \::/ / \::/ /
~~ \/____/ \/____/ \/____/ \/____/
Bepass is an advanced tool designed to bypass Iran's Deep Packet Inspection (DPI) system using a TLS client hello splitting attack. It also enables the deployment of a VLESS-like proxy on Cloudflare Workers. This README provides an overview of the project's features, build instructions, deployment guidelines, and more.
- DPI Bypass: Supports all of Iran's network carriers with customized TLS hello packet length adjustments.
- DNS Over HTTPS (DOH) Support: Facilitates secure and private DNS resolution.
- Server Name Indication DNS (SDNS) Support: Enhances DNS resolution efficiency.
- Cross-Platform Compatibility: Suitable for various operating systems.
You can run the CLI version of Bepass as follows:
- download the latest release from here based on your operating system
- extract the zip file
- create a
config.jsonfile in the same directory as the executable file - run the executable file
Example Configuration(config.json file) for IR-MCI:
{
"TLSHeaderLength": 5,
"TLSPaddingEnabled": false,
"TLSPaddingSize": [
40,
80
],
"RemoteDNSAddr": "https://1.1.1.1/dns-query",
"EnableDNSFragmentation": false,
"DnsCacheTTL": 3000000,
"DnsRequestTimeout": 10,
"BindAddress": "0.0.0.0:8085",
"ChunksLengthBeforeSni": [
2000,
2000
],
"SniChunksLength": [
1,
2
],
"ChunksLengthAfterSni": [
2000,
2000
],
"DelayBetweenChunks": [
10,
20
],
"WorkerAddress": "https://<your_worker>.workers.dev/dns-query",
"WorkerIPPortAddress": "104.16.246.91:8443",
"WorkerEnabled": true,
"WorkerDNSOnly": false,
"EnableLowLevelSockets": false,
"Hosts": [
{
"Domain": "yarp.lefolgoc.net",
"IP": "5.39.88.20"
}
],
"UDPBindAddress": "0.0.0.0",
"UDPReadTimeout": 120,
"UDPWriteTimeout": 120,
"UDPLinkIdleTimeout": 120
}-
"TLSHeaderLength": 5: Specifies the length of the TLS header, which is set to 5 bytes. -
"TLSPaddingEnabled": false: Disables/Enable TLS padding. -
"TLSPaddingSize": [40, 80]: Sets the TLS padding size range to be between 40 and 80 bytes. -
"RemoteDNSAddr": "https://1.1.1.1/dns-query": Specifies the remote DNS address for DNS queries. In this case, it's set to Cloudflare's DNS over HTTPS (DOH) service. -
"EnableDNSFragmentation": false: Disables/Enable DNS fragmentation. -
"DnsCacheTTL": 3000000: Sets the Time To Live (TTL) for DNS cache entries(seconds). -
"DnsRequestTimeout": 10: Sets the timeout for DNS requests to 10 seconds. -
"BindAddress": "0.0.0.0:8085": Sets the bind address for the proxy server to listen on all available network interfaces (0.0.0.0) on port8085. -
"ChunksLengthBeforeSni": [2000, 2000]: Specifies the length of chunks before the Server Name Indication (SNI) in the TLS handshake to be 2000 bytes. -
"SniChunksLength": [5, 10]: Sets the SNI chunk length to be between 5 and 10 bytes. -
"ChunksLengthAfterSni": [2000, 2000]: Specifies the length of chunks after the SNI in the TLS handshake to be 2000 bytes. -
"DelayBetweenChunks": [10, 20]: Sets the delay between sending chunks to be between 10 and 20 milliseconds. -
"WorkerAddress": "https://<your_worker>.workers.dev/dns-query": Specifies the Cloudflare Worker address for proxy services. -
"WorkerIPPortAddress": "104.17.196.93:2096": Sets the IP address and port for the Cloudflare Worker.find clean CF IP and repalce it with this one to get better performance based on your internet quality and isp. -
"WorkerEnabled": true: Disables/Enable the use of the Cloudflare Worker. -
"WorkerDNSOnly": false: Indicates whether the Cloudflare Worker should be used for DNS queries only(If you just want to use the DOH over the worker settrue. But if you want a full-fledged TCP SOCKS5 proxy over the worker setfalse). -
"EnableLowLevelSockets": false: Disables/Enable low-level socket functionality. -
"Hosts": [{ "Domain": "yarp.lefolgoc.net", "IP": "5.39.88.20" }]: Specifies a list of custom hosts to map domain names to IP addresses. In this example, "yarp.lefolgoc.net" is mapped to "5.39.88.20." -
"UDPBindAddress": "0.0.0.0": Sets the UDP bind address to listen on all available network interfaces (0.0.0.0). -
"UDPReadTimeout": 120: Sets the UDP read timeout to 120 seconds. -
"UDPWriteTimeout": 120: Sets the UDP write timeout to 120 seconds. -
"UDPLinkIdleTimeout": 120: Sets the UDP link idle timeout to 120 seconds.
Please note that you should replace <your_worker> in "WorkerAddress"
with your actual Cloudflare Worker address. Additionally, ensure that
you configure other settings as needed for your specific use case.
You can build the CLI version of Bepass as follows:
git clone https://github.com/uoosef/bepass.git
cd bepass/bepass
make # Build CLI debug version
make release # Build CLI release versionYou can build GUI debug and release versions as follows:
git clone https://github.com/uoosef/bepass.git
cd bepass/bepass
make gui # For GUI debug version
make gui-release # For GUI release versionA graphical user interface (GUI) version of Bepass is under development. Stay tuned for updates on its availability.
You can download the latest build from the release or just install Go 1.19+ and run:
git clone https://github.com/uoosef/bepass.git
cd bepass/bepass
go build ./cmd/cli/main.goIt should give you an executable file, or you can simply run it in place.
git clone https://github.com/uoosef/bepass.git
cd bepass/bepass
go run ./cmd/cli/main.go -c config.jsonproject roadmap includes:
- Self-Hosted DOH (Completed)
- TCP Proxy Over Worker (Completed)
- UDP Over Relay (Completed)
- Relay (Completed)
- Nekobox Plugin (Completed)
- MultiPlatform GUI Version (WIP)
- Standelone Server
- Packet Level Mux
- Jesus Protocol
from https://github.com/bepass-org/bepass
-------------------
An easy to deploy worker for bepass proxy。
Overview
This repository contains a new worker.js that aims for better solutions in terms of performance and features regarding common worker issues such as supporting IPv6, the UDP protocol, and more stable communication with Cloudflare IPs (loopback connections).
As you know, Cloudflare workers are currently unable to connect to hosts that have Cloudflare IPs (this is considered a loopback).This worker uses relay nodes to work around that limitation.
The worker also implements an advanced DNS DOH client/proxy for dns routing/serving purposes.
- Supports IPv6
- Supports UDP through relays
- More reliable loopback connection handling and routing
- Embedded DOH DNS Client/Proxy
- Overall improved performance and stability
├── src
│ ├── dns.js // DNS message encoding/parsing
│ └── worker.ts // Main worker code
├── dist
│ └── worker.js // Compiled worker script
To manually deploy the worker:
- Sign up at the Cloudflare signup page
- From the main navbar, choose Workers & Pages
- Click the Create Application button
- Click the Create Worker button
- Copy the worker.js file contents from this repository
- Fill in a name for your worker and click the Deploy button
- Click the Quick Edit button
- Paste your clipboard contents and replace the worker's default code
- Click the Save and Deploy button
- Write down the newly created worker address, it should be something like [name].[username].workers.dev
- Change your Bepass configuration to https://[name].[username].workers.dev/dns-query
You can deploy this worker to your Cloudflare account automatically with one click using the button below.
1. Follow the relay set-up instructions to run your own relay server.
2. Edit the worker.js file and add your server IP or domain to the proxyIPs array.
In the worker.js file, locate the following code:
// src/worker.ts
var proxyIPs = ["relay1.bepass.org", "relay2.bepass.org", "relay3.bepass.org"];
var proxyPort = 6666;
var proxyIP = proxyIPs[Math.floor(Math.random() * proxyIPs.length)];Remove public relay addresses and Add the IP address or domain of your relay server. For example:
// src/worker.ts
var proxyIPs = ["relay.example.com", "123.45.67.89"]; // Add your server IP/domain here
var proxyPort = 6666;
var proxyIP = proxyIPs[Math.floor(Math.random() * proxyIPs.length)];Cloudflare's free workers are limited to 100,000 requests per day. This is sufficient for personal use by one user or a small family.
For most personal usage, the free worker should be adequate. But if you experience rate limiting, you may need to deploy workers on multiple accounts.
- Clone the bepass-worker repository:
git clone https://github.com/uoosef/bepass-worker- Change to the project directory:
cd bepass-worker- Install the dependencies:
npm installnpm run build && node dist/worker.jsnpm test
Task 1: Implement worker's range detectionTask 2: Better loopback supportTask 3: DNS ResolvingTask 4: ...
from https://github.com/bepass-org/bepass-worker
--------
Cloudflare worker js file and its go relay project.
This repository contains a Relay for bepass workers that aims for better solutions in terms of performance and features regarding common worker issues such as supporting IPv6, the UDP protocol, and more stable communication with Cloudflare IPs (loopback connections).
As you know, Cloudflare workers are currently unable to connect to hosts that have Cloudflare IPs (this is considered a loopback).
Attention: Relay deployment is not mandatory to use Bepass!
If you just want to use Bepass as an anti censorship tool and don't want
to be a volunteer maintainer, that works fine for you, we already
prepared about 10 public relays, so you don't have to do anything. This
is just for people who want to help the project by becoming a volunteer
maintainer or make a private relay for themselves.
Relay nodes are servers maintained by volunteer users. These nodes help the worker support features that are not officially supported by Cloudflare workers. so if you want to connect to any host behind cloudflare cdn or use udp protocol for purposes such as online voice/video chat or gaming, the worker automatically detects that and forward your traffic to a relay node that is maintained by a volunteer user(or yourself if you deploy a relay for yourself). then the relay node will forward your traffic to the destination and send the response back to you.
Please follow the instructions at Bepass worker repository and make yourself a worker.
Here is a representation of what happens to your request from the client to the destination:
It's simple! Just buy a VPS from a provider that offers a lot of traffic, then install Golang and run:
tmux
git clone https://github.com/bepass-org/bepass-relay.git
cd bepass-relay
go run *.go -b 0.0.0.0 -p 6666 Then press ctrl+b and then d. Then go to your cloudflare dashboard and open your worker with Quick dit button. Then change the following lines:
const proxyIPs = ['<Your IP goes here>'];
const proxyPort = 6666;
let proxyIP = proxyIPs[Math.floor(Math.random() * proxyIPs.length)];Then test that your worker works as intended.
It's simple! Just follow these 3 easy steps:
-
Buy a VPS from a provider that offers a lot of traffic, like Hetzner GMBH. Then install Golang and run:
sudo su cd /opt git clone https://github.com/bepass-org/bepass-relay.git cd bepass-relay CGO_ENABLED=0 go build -ldflags '-s -w' -trimpath *.go
Make a systemd service for Bepass in /etc/systemd/system/cfb.service:
nano /etc/systemd/system/cfb.serviceAnd paste the following code:
[Unit]
Description=Bepass Relay Service
[Service]
ExecStart=/opt/bepass-relay/relay
[Install]
WantedBy=multi-user.target
Then reload systemd to read this unit file with:
systemctl daemon-reloadStart the service with:
systemctl start cfb.serviceAnd enable it during startup with:
systemctl enable cfb.serviceYou can check the status of the service with:
systemctl status cfb.service-
Submit a new issue with the Volunteer Node Maintainer title and share your server IP address and how long your server will last! (Minimum requirement: at least 3 months)
- Implement Relay
- Implement worker's range detection
- Better loopback support
- Full IPv6 support
- Full UDP support
No comments:
Post a Comment