{"id":135,"date":"2013-06-22T21:54:33","date_gmt":"2013-06-22T18:54:33","guid":{"rendered":"https:\/\/dlshad.net\/?p=135"},"modified":"2013-12-03T16:27:51","modified_gmt":"2013-12-03T14:27:51","slug":"bypassing-censorship-by-using-obfsproxy-and-openvpn-ssh-tunnel","status":"publish","type":"post","link":"https:\/\/dlshad.net\/bypassing-censorship-by-using-obfsproxy-and-openvpn-ssh-tunnel\/","title":{"rendered":"Bypassing censorship by using obfsproxy and openVPN , SSH Tunnel"},"content":{"rendered":"<style type=\"text\/css\"><!--\nP { margin-bottom: 0.08in; }A:link {  }\n--><\/style>\n<p><span style=\"font-size: large;\"><i>Dlshad Othman <\/i><\/span><\/p>\n<p><a href=\"https:\/\/www.pluggabletransports.info\/implement\/openvpn\/\"><span style=\"font-size: large;\"><i>You are about to read an outdated document, please click here to get the most updated guide on how to implement pluggable transport with OpenVPN or visit this link: https:\/\/www.pluggabletransports.info\/implement\/openvpn\/<\/i><\/span><\/a><\/p>\n<p><a href=\"http:\/\/twitter.com\/dlshadothman\"><span style=\"font-size: large;\"><i>@dlshadothman<\/i><\/span><\/a><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-size: large;\">Syrian ISPs are using sophisticated technologies to monitor and filter traffic. These boxes are <a href=\"https:\/\/en.wikipedia.org\/wiki\/Deep_packet_inspection\">DPI (Deep Packet Inspection)<\/a> and what they do is sniff out every little packet flowing through them to find specific patterns and then they provide their administrator with the option to block traffic that matches these patterns. These boxes are very sophisticated and they don\u2019t just filter traffic by src, dst or port, they filter traffic by the content the packets carry.<\/span><\/p>\n<p><span style=\"font-size: large;\">Since August 2011 Syrin regime applied the DPI and they start blocking <a href=\"http:\/\/openvpn.net\/\">OpenVPN<\/a> \u2013 <a href=\"http:\/\/en.wikipedia.org\/wiki\/Layer_2_Tunneling_Protocol\">L2TP\/IPSec<\/a> and sometimes <a href=\"http:\/\/torproject.org\">TOR<\/a>\u00a0 connection , in order to not allow any user has a secure connections.<\/span><\/p>\n<p><!--more--><\/p>\n<p><span style=\"font-size: large;\"><i><b>Tor Action :<\/b><\/i><\/span><\/p>\n<p><span style=\"font-size: large;\">Tor as one of the main anonymity providers , DPI was able to block its traffic over the \u201cDigital fingerprint of it&#8217;s traffic \u201c<\/span><\/p>\n<p><span style=\"font-size: large;\"><i>Tor said \u201c <\/i><\/span><i>An increasing number of censoring countries are using Deep Packet Inspection (DPI) to classify Internet traffic flows by protocol. While Tor uses <a href=\"https:\/\/www.torproject.org\/docs\/bridges.html.en\">bridge relays<\/a> to get around a censor that blocks by IP address, the censor can use DPI to recognize and filter Tor traffic flows even when they connect to unexpected IP addresses.<\/i> <span style=\"font-size: large;\">\u201c<\/span><\/p>\n<p><span style=\"font-size: large;\">In response to that, Tor deployed a technology called <a href=\"https:\/\/www.torproject.org\/docs\/pluggable-transports.html.en\">Pluggable Transports<\/a> which it can obfuscate the traffic to looks like \u201cnothing!\u201d that will drive the DPI evil boxes to go Crazy! The traffic is not easy recognizable! \ud83d\ude00<\/span><\/p>\n<div style=\"width: 654px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" src=\"https:\/\/dlshad.net\/wp-content\/uploads\/2013\/06\/dpiSyria.png \" width=\"644\" height=\"231\" \/><p class=\"wp-caption-text\">Digram 1 ( DBI Box allows http traffic to pass , and blocks openvpn )<\/p><\/div>\n<style type=\"text\/css\"><!--\nP { margin-bottom: 0.08in; }A:link {  }\n--><\/style>\n<style type=\"text\/css\"><!--\nP { margin-bottom: 0.08in; }A:link {  }\n--><\/style>\n<p><i><b><span style=\"font-size: large;\">How can <\/span><span style=\"font-size: large;\">we <\/span><span style=\"font-size: large;\">use it?<\/span><\/b><\/i><\/p>\n<p><span style=\"font-size: large;\">In Syria for the last 2 years , people were able to use <\/span><span style=\"font-size: large;\">(<\/span><span style=\"font-size: large;\"> openvpn <\/span><span style=\"font-size: large;\">and SSH <\/span><span style=\"font-size: large;\">)<\/span><span style=\"font-size: large;\"> connections in order to encrypt their traffic , and now only SSH connection is working ,<\/span><span style=\"font-size: large;\">and other encrypted connections<\/span><span style=\"font-size: large;\"> \u201c<\/span><span style=\"font-size: large;\">through obfsproxy\u201d<\/span><span style=\"font-size: large;\"> I don&#8217;t think they will block <\/span><span style=\"font-size: large;\">ssh<\/span><span style=\"font-size: large;\"> , because (<a href=\"http:\/\/www.informationweek.com\/security\/attacks\/who-is-syrian-electronic-army-9-facts\/240155028\">SEA<\/a>) need it to do their operations <\/span><span style=\"font-size: large;\">-_- <\/span><span style=\"font-size: large;\"> also the government has servers around! need to be managed!<\/span><\/p>\n<p><span style=\"font-size: large;\">The best way to use it is to have obfsproxy with open vpn or with SSH<\/span><\/p>\n<div style=\"width: 679px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"  \" alt=\"\" src=\"https:\/\/dlshad.net\/wp-content\/uploads\/2013\/06\/dpipassobfsproySyria.png \" width=\"669\" height=\"297\" \/><p class=\"wp-caption-text\">Digram 2 This example is a secure connection &#8211; OpenVPN covers by obfsproxy were able to pass the DPI filtering system.<\/p><\/div>\n<style type=\"text\/css\"><!--\nP { margin-bottom: 0.08in; }A:link {  }\n--><\/style>\n<p><span style=\"font-size: large;\"><i><b>The Scenario<\/b><\/i><\/span><span style=\"font-size: large;\">:<\/span><\/p>\n<p><span style=\"font-size: large;\"><i><b>End user<\/b><\/i><\/span><span style=\"font-size: large;\"> : A regular user before the Syrian Firewall has ( Obfsproxy + OpenVPN client)<\/span><\/p>\n<p><span style=\"font-size: large;\"><i><b>ISP DPI Box<\/b><\/i><\/span><span style=\"font-size: large;\">: The DPI filtering system <\/span><\/p>\n<p><span style=\"font-size: large;\"><b>OpenVPN<\/b><\/span><span style=\"font-size: large;\"> Server: OpenVPN Server configured to receive OpenVPN requests from the obfsproxy Server.<\/span><\/p>\n<p><b><span style=\"font-size: large;\"><i>Obfsproxy Server<\/i><\/span><span style=\"font-size: large;\">: <\/span><\/b><span style=\"font-size: large;\">obfsproxy server configured to receive obfsproxy connection from outside world and uncover it then send <\/span><span style=\"font-size: large;\">regular<\/span><span style=\"font-size: large;\"> openvpn requests to openvpn Server.<\/span><\/p>\n<p><span style=\"font-size: large;\">OpenVPN<\/span><span style=\"font-size: large;\"> client <\/span><span style=\"font-size: large;\">(Local)<\/span><span style=\"font-size: large;\">&#8212;&gt;<\/span><span style=\"font-size: large;\"> obfsproxy client (<\/span><span style=\"font-size: large;\">Local) &#8212;-&gt;<\/span><span style=\"font-size: large;\"> obfsproxy server <\/span><span style=\"font-size: large;\">&#8212;&gt; openVPN Server<\/span><\/p>\n<p><i><b><span style=\"font-size: large;\">Note: you can use one server running obfsproxy and openvpn Server<\/span><\/b><\/i><\/p>\n<p>&nbsp;<\/p>\n<p><i><b><span style=\"font-size: large;\">Install <\/span><span style=\"font-size: large;\">openvpn<\/span><span style=\"font-size: large;\">Server Ubuntu \u2013 Debian server<\/span><span style=\"font-size: large;\">:<\/span><\/b><\/i><\/p>\n<p><span style=\"font-size: large;\">Personally , I would prefer to use Ubuntu or Debian server ,they have great documentation online.<\/span><\/p>\n<p><b><span style=\"font-size: large;\">Step 1<\/span><\/b><\/p>\n<p><span style=\"font-size: large;\">you need root access to your server SSH it and let&#8217;s rock &amp; roll \ud83d\ude42<\/span><\/p>\n<p><span style=\"font-size: large;\">Install openVPN<\/span><\/p>\n<p><span style=\"font-size: large;\">run the following command in the terminal<\/span><\/p>\n<blockquote><p><b><span style=\"font-size: large;\">sudo apt-get install openvpn<\/span><\/b><\/p><\/blockquote>\n<p><span style=\"font-size: large;\"><b>Then<\/b>, you have to answer by yes then press enter<\/span><\/p>\n<p><span style=\"font-size: large;\"><b>&#8211; G<\/b><b>enerate the certificates<\/b><\/span><\/p>\n<p><span style=\"font-size: large;\"><b>Step 2<\/b><\/span><\/p>\n<p><span style=\"font-size: large;\">You need to generate Server Certificates:<\/span><\/p>\n<p><span style=\"font-size: large;\">run the following command to copy the standards cert , configuration ..etc samples and tools.<\/span><\/p>\n<blockquote><p><span style=\"font-size: large;\"><b>sudo cp -r \/usr\/share\/doc\/openvpn\/examples\/easy-rsa\/2.0 \/etc\/openvpn\/easy-rsa2<\/b> <\/span><\/p><\/blockquote>\n<p><span style=\"font-size: large;\">Then access to the openvpn Easy RSA folder (run this command ) <\/span><\/p>\n<blockquote><p><span style=\"font-size: large;\"><b>cd \/etc\/openvpn\/easy-rsa2<\/b><\/span><\/p><\/blockquote>\n<p><span style=\"font-size: large;\">First you need to edit variables from the standards to your own , like your email , name ..etc<\/span><\/p>\n<p><span style=\"font-size: large;\">Run the following command :<\/span><\/p>\n<blockquote><p><span style=\"font-size: large;\"><b>sudo nano vars<\/b> <\/span><\/p><\/blockquote>\n<p><span style=\"color: #dc2300;\">\u201c <span style=\"font-size: small;\"><i>Maybe you don&#8217;t have nano editor , you can install it by running the following command <b>sudo apt-get install nano \u201c<\/b><\/i><\/span><\/span><\/p>\n<p><span style=\"font-size: large;\">export KEY_COUNTRY=&#8221;XX&#8221; <\/span><\/p>\n<p><span style=\"font-size: large;\">export KEY_PROVINCE=&#8221;YY&#8221; <\/span><\/p>\n<p><span style=\"font-size: large;\">export KEY_CITY=&#8221;City&#8221; <\/span><\/p>\n<p><span style=\"font-size: large;\">export KEY_ORG=&#8221;My VPN Service&#8221; <\/span><\/p>\n<p><span style=\"font-size: large;\">export KEY_EMAIL=&#8221;mail@example.com&#8221;<\/span><\/p>\n<p><span style=\"font-size: large;\">Run the following commands , one by one :<\/span><\/p>\n<blockquote><p><b><span style=\"font-size: large;\">sudo mkdir keys <\/span><\/b><\/p>\n<p><b><span style=\"font-size: large;\">source .\/vars <\/span><\/b><\/p>\n<p><b><span style=\"font-size: large;\">sudo -E .\/clean-all <\/span><\/b><\/p>\n<p><b><span style=\"font-size: large;\">sudo -E .\/build-ca <\/span><\/b><\/p>\n<p><b><span style=\"font-size: large;\">sudo -E .\/build-key-server server <\/span><\/b><\/p>\n<p><b><span style=\"font-size: large;\">sudo -E .\/build-dh <\/span><\/b><\/p>\n<p><b><span style=\"font-size: large;\">sudo cp \/etc\/openvpn\/easy-rsa\/2.0\/keys\/ca.crt \/etc\/openvpn <\/span><\/b><\/p>\n<p><b><span style=\"font-size: large;\">sudo cp \/etc\/openvpn\/easy-rsa\/2.0\/keys\/ca.key \/etc\/openvpn <\/span><\/b><\/p>\n<p><b><span style=\"font-size: large;\">sudo cp \/etc\/openvpn\/easy-rsa\/2.0\/keys\/dh1024.pem \/etc\/openvpn <\/span><\/b><\/p>\n<p><b><span style=\"font-size: large;\">sudo cp \/etc\/openvpn\/easy-rsa\/2.0\/keys\/server.crt \/etc\/openvpn <\/span><\/b><\/p>\n<p><b><span style=\"font-size: large;\">sudo cp \/etc\/openvpn\/easy-rsa\/2.0\/keys\/server.key \/etc\/openvpn<\/span><\/b><\/p><\/blockquote>\n<p><span style=\"font-size: large;\">After that you need to restart the OpenVPN Server:<\/span><\/p>\n<p><span style=\"font-size: large;\">run the following command:<\/span><\/p>\n<blockquote><p><b><span style=\"font-size: large;\">sudo service openvpn restart<\/span><\/b><\/p><\/blockquote>\n<p><b><span style=\"font-size: large;\">&#8211; Generate Client Certificates<\/span><\/b><\/p>\n<blockquote><p><b><span style=\"font-size: large;\">cd \/etc\/openvpn\/easy-rsa2 <\/span><\/b><\/p>\n<p><b><span style=\"font-size: large;\">source .\/vars <\/span><\/b><\/p>\n<p><b><span style=\"font-size: large;\">sudo -E .\/build-key user1<\/span><\/b><\/p><\/blockquote>\n<p><i><span style=\"font-size: large;\">user1 ( is the user nick name you can change it to whatever)<\/span><\/i><\/p>\n<p><span style=\"font-size: large;\">Then copy the following files (user certificates) <\/span><\/p>\n<blockquote><p><span style=\"font-size: large;\">ca.crt <\/span><\/p>\n<p><span style=\"font-size: large;\">user1.crt <\/span><\/p>\n<p><span style=\"font-size: large;\">user1.key<\/span><\/p><\/blockquote>\n<p><span style=\"font-size: large;\">from the server side to the client side over secure connection like ssh of SFTP<\/span><\/p>\n<p><span style=\"font-size: large;\"><b>&#8211; Configure OpenVPN Server<br \/>\n<\/b><\/span><\/p>\n<p><span style=\"font-size: large;\">Run the following commands , first we need to add user to the system called openVPN with no privileges to SSH the server<\/span><\/p>\n<blockquote><p><b><span style=\"font-size: large;\">sudo adduser &#8211;system &#8211;no-create-home &#8211;disabled-login openvpn <\/span><\/b><\/p>\n<p><span style=\"font-size: large;\"><b>sudo addgroup &#8211;system &#8211;no-create-home &#8211;disabled-login openvpn<\/b><\/span><\/p><\/blockquote>\n<p>&nbsp;<\/p>\n<p><span style=\"font-size: large;\">then we need to copy the standards openVPN configuration files by running the following commands<\/span><\/p>\n<blockquote><p><b><span style=\"font-size: large;\">sudo cp \/usr\/share\/doc\/openvpn\/examples\/sample-config-files\/server.conf.gz \/etc\/openvpn\/ <\/span><\/b><\/p><\/blockquote>\n<p><span style=\"font-size: large;\">then<\/span><\/p>\n<blockquote><p><b><span style=\"font-size: large;\">sudo gunzip \/etc\/openvpn\/server.conf.gz <\/span><\/b><\/p><\/blockquote>\n<p><span style=\"font-size: large;\">then<\/span><\/p>\n<blockquote><p><b><span style=\"font-size: large;\">cd \/etc\/openvpn<\/span><\/b><\/p><\/blockquote>\n<p><span style=\"font-size: large;\">Edit the Server configuration file by running the following command<\/span><\/p>\n<blockquote><p><b><span style=\"font-size: large;\">sudo nano server.conf<\/span><\/b><\/p><\/blockquote>\n<p><span style=\"font-size: large;\">change user and group:<\/span><\/p>\n<blockquote><p><b><span style=\"font-size: large;\">user openvpn <\/span><\/b><\/p>\n<p><b><span style=\"font-size: large;\">group openvpn<\/span><\/b><\/p><\/blockquote>\n<p><span style=\"font-size: large;\">Then restart openVPN by running the following command :<\/span><\/p>\n<blockquote><p><b><span style=\"font-size: large;\">sudo service openvpn restart<\/span><\/b><\/p><\/blockquote>\n<p><span style=\"font-size: large;\">To make sure that it&#8217;s working , run the following command <\/span><\/p>\n<blockquote><p><b><span style=\"font-size: large;\">ifconfig<\/span><\/b><\/p><\/blockquote>\n<p><span style=\"font-size: large;\">You should have <\/span><span style=\"font-size: large;\"><b>tun0<\/b><\/span><span style=\"font-size: large;\"> interface in the network interfaces list<\/span><\/p>\n<p><i><span style=\"font-size: large;\">Note : Installing and configuring openVPN Server will not allow you to routing the web traffic to the client , you should enable that <\/span><\/i><\/p>\n<p><b><span style=\"font-size: large;\">to do it :<\/span><\/b><\/p>\n<p><span style=\"font-size: large;\">Run the following commands:<\/span><\/p>\n<blockquote><p><b><span style=\"font-size: large;\">cd \/etc\/openvpn<\/span><\/b><\/p>\n<p><b><span style=\"font-size: large;\">sudo nano server.conf<\/span><\/b><\/p><\/blockquote>\n<p><span style=\"font-size: large;\">uncomment this line:<\/span><\/p>\n<p>\u201c<span style=\"font-size: large;\">uncomment means removing the # from the beginning of the line \u201c<\/span><\/p>\n<blockquote><p><b><span style=\"font-size: large;\">push &#8220;redirect-gateway def1 bypass-dhcp&#8221;<\/span><\/b><\/p><\/blockquote>\n<p><span style=\"font-size: large;\">The<\/span><span style=\"font-size: large;\">n restart the openVPN Server by running the following command <\/span><\/p>\n<blockquote><p><b><span style=\"font-size: large;\">sudo service openvpn restart<\/span><\/b><\/p><\/blockquote>\n<p><span style=\"font-size: large;\">We also need to enable IP forward on the Server , to do that run the following command:<\/span><\/p>\n<blockquote><p><b><span style=\"font-size: large;\">echo 1 &gt; \/proc\/sys\/net\/ipv4\/ip_forward<\/span><\/b><\/p><\/blockquote>\n<p>Run the following bash codes to allow the IPTABLES secure Internet tunnel<\/p>\n<p>&nbsp;<\/p>\n<blockquote>\n<ul>\n<li>If your server is a Dedicated server or XEN VPS server then:\n<div>\n<div><b>Code:<\/b><\/div>\n<div><\/div>\n<div>#!\/bin\/sh<br \/>\n#<br \/>\n# iptables example configuration script<br \/>\n#<br \/>\n# Flush all current rules from iptables<br \/>\n#<br \/>\niptables -F<br \/>\niptables -t nat -F<br \/>\niptables -t mangle -F<\/p>\n<p>#<br \/>\n# Allow SSH connections on tcp port 22 (or whatever port you want to use)<br \/>\n#<br \/>\niptables -A INPUT -p tcp &#8211;dport 22 -j ACCEPT<\/p>\n<p>#<br \/>\n# Set default policies for INPUT, FORWARD and OUTPUT chains<br \/>\n#<br \/>\niptables -P INPUT DROP\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 #using DROP for INPUT is not always recommended. Change to ACCEPT if you prefer.<br \/>\niptables -P FORWARD ACCEPT<br \/>\niptables -P OUTPUT ACCEPT<\/p>\n<p>#<br \/>\n# Set access for localhost<br \/>\n#<br \/>\niptables -A INPUT -i lo -j ACCEPT<\/p>\n<p>#<br \/>\n# Accept packets belonging to established and related connections<br \/>\n#<br \/>\niptables -A INPUT -m state &#8211;state ESTABLISHED,RELATED -j ACCEPT<\/p>\n<p>#<br \/>\n#Accept connections on 1194 for vpn access from clients<br \/>\n#Take note that the rule says &#8220;UDP&#8221;, and ensure that your OpenVPN server.conf says UDP too<br \/>\n#<br \/>\niptables -A INPUT -p udp &#8211;dport 1194 -j ACCEPT<\/p>\n<p>#<br \/>\n#Apply forwarding for OpenVPN Tunneling<br \/>\n#<br \/>\niptables -A FORWARD -m state &#8211;state RELATED,ESTABLISHED -j ACCEPT<br \/>\niptables -A FORWARD -s 10.8.0.0\/24 -j ACCEPT\u00a0 \u00a0 \u00a0#10.8.0.0 ? Check your OpenVPN server.conf to be sure<br \/>\niptables -A FORWARD -j REJECT<br \/>\niptables -t nat -A POSTROUTING -s 10.8.0.0\/24 -o eth0 -j MASQUERADE<\/p>\n<p>#<br \/>\n#Enable forwarding<br \/>\n#<br \/>\necho 1 &gt; \/proc\/sys\/net\/ipv4\/ip_forward<\/p>\n<p>#<br \/>\n# Some generally optional rules. Enable and disable these as per your requirements<br \/>\n#<\/p>\n<p># Accept traffic with the ACK flag set<br \/>\niptables -A INPUT -p tcp -m tcp &#8211;tcp-flags ACK ACK -j ACCEPT<br \/>\n# Accept responses to DNS queries<br \/>\niptables -A INPUT -p udp -m udp &#8211;dport 1024:65535 &#8211;sport 53 -j ACCEPT<br \/>\n# Accept responses to our pings<br \/>\niptables -A INPUT -p icmp -m icmp &#8211;icmp-type echo-reply -j ACCEPT<br \/>\n# Accept notifications of unreachable hosts<br \/>\niptables -A INPUT -p icmp -m icmp &#8211;icmp-type destination-unreachable -j ACCEPT<br \/>\n# Accept notifications to reduce sending speed<br \/>\niptables -A INPUT -p icmp -m icmp &#8211;icmp-type source-quench -j ACCEPT<br \/>\n# Accept notifications of lost packets<br \/>\niptables -A INPUT -p icmp -m icmp &#8211;icmp-type time-exceeded -j ACCEPT<br \/>\n# Accept notifications of protocol problems<br \/>\niptables -A INPUT -p icmp -m icmp &#8211;icmp-type parameter-problem -j ACCEPT<br \/>\n# Respond to pings<br \/>\niptables -A INPUT -p icmp -m icmp &#8211;icmp-type echo-request -j ACCEPT<br \/>\n# Accept traceroutes<br \/>\niptables -A INPUT -p udp -m udp &#8211;dport 33434:33523 -j ACCEPT<\/p>\n<p>#<br \/>\n# List rules<br \/>\n#<br \/>\niptables -L -v<\/p><\/div>\n<div><\/div>\n<\/div>\n<\/li>\n<li><strong>If your server is an openVZ VPS then:<\/strong>\n<div>\n<div><b>Code:<\/b><\/div>\n<div><\/div>\n<div>#!\/bin\/sh<br \/>\n#<br \/>\n# iptables example configuration script<br \/>\n#<br \/>\n# Flush all current rules from iptables<br \/>\n#<br \/>\niptables -F<br \/>\niptables -t nat -F<br \/>\niptables -t mangle -F<\/p>\n<p>#<br \/>\n# Allow SSH connections on tcp port 22 (or whatever port you want to use)<br \/>\n#<br \/>\niptables -A INPUT -p tcp &#8211;dport 22 -j ACCEPT<\/p>\n<p>#<br \/>\n# Set default policies for INPUT, FORWARD and OUTPUT chains<br \/>\n#<br \/>\niptables -P INPUT DROP\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 #using DROP for INPUT is not always recommended. Change to ACCEPT if you prefer.<br \/>\niptables -P FORWARD ACCEPT<br \/>\niptables -P OUTPUT ACCEPT<\/p>\n<p>#<br \/>\n# Set access for localhost<br \/>\n#<br \/>\niptables -A INPUT -i lo -j ACCEPT<\/p>\n<p>#<br \/>\n# Accept packets belonging to established and related connections<br \/>\n#<br \/>\niptables -A INPUT -m state &#8211;state ESTABLISHED,RELATED -j ACCEPT<\/p>\n<p>#<br \/>\n#Accept connections on 1194 for vpn access from clients<br \/>\n#Take note that the rule says &#8220;UDP&#8221;, and ensure that your OpenVPN server.conf says UDP too<br \/>\n#<br \/>\niptables -A INPUT -p udp &#8211;dport 1194 -j ACCEPT<\/p>\n<p>#<br \/>\n#Apply forwarding for OpenVPN Tunneling<br \/>\n#<br \/>\niptables -A FORWARD -m state &#8211;state RELATED,ESTABLISHED -j ACCEPT<br \/>\niptables -A FORWARD -s 10.8.0.0\/24 -j ACCEPT\u00a0 \u00a0 \u00a0#10.8.0.0 ? Check your OpenVPN server.conf to be sure<br \/>\niptables -A FORWARD -j REJECT<br \/>\niptables -t nat -A POSTROUTING -o venet0 -j SNAT &#8211;to-source 100.200.255.256\u00a0 \u00a0#Use your OpenVPN server&#8217;s real external IP here<\/p>\n<p>#<br \/>\n#Enable forwarding<br \/>\n#<br \/>\necho 1 &gt; \/proc\/sys\/net\/ipv4\/ip_forward<\/p>\n<p>#<br \/>\n# Some generally optional rules. Enable and disable these as per your requirements<br \/>\n#<\/p>\n<p># Accept traffic with the ACK flag set<br \/>\niptables -A INPUT -p tcp -m tcp &#8211;tcp-flags ACK ACK -j ACCEPT<br \/>\n# Accept responses to DNS queries<br \/>\niptables -A INPUT -p udp -m udp &#8211;dport 1024:65535 &#8211;sport 53 -j ACCEPT<br \/>\n# Accept responses to our pings<br \/>\niptables -A INPUT -p icmp -m icmp &#8211;icmp-type echo-reply -j ACCEPT<br \/>\n# Accept notifications of unreachable hosts<br \/>\niptables -A INPUT -p icmp -m icmp &#8211;icmp-type destination-unreachable -j ACCEPT<br \/>\n# Accept notifications to reduce sending speed<br \/>\niptables -A INPUT -p icmp -m icmp &#8211;icmp-type source-quench -j ACCEPT<br \/>\n# Accept notifications of lost packets<br \/>\niptables -A INPUT -p icmp -m icmp &#8211;icmp-type time-exceeded -j ACCEPT<br \/>\n# Accept notifications of protocol problems<br \/>\niptables -A INPUT -p icmp -m icmp &#8211;icmp-type parameter-problem -j ACCEPT<br \/>\n# Respond to pings<br \/>\niptables -A INPUT -p icmp -m icmp &#8211;icmp-type echo-request -j ACCEPT<br \/>\n# Accept traceroutes<br \/>\niptables -A INPUT -p udp -m udp &#8211;dport 33434:33523 -j ACCEPT<\/p>\n<p>#<br \/>\n# List rules<br \/>\n#<br \/>\niptables -L -v<\/p><\/div>\n<\/div>\n<\/li>\n<\/ul>\n<p>with the only difference between the two codes being that the masquerade command was replaced with a SNAT in the openVZ example, and eth0 was replaced with venet0.<\/p><\/blockquote>\n<p>&nbsp;<\/p>\n<p><span style=\"font-size: large;\"><i>Now please note:<\/i><\/span><\/p>\n<p><span style=\"font-size: large;\"><i>your openVPN Server is ready to use anywhere but not in Syria \ud83d\ude42 that&#8217;s why we need to install opbfsoroxy.<\/i><\/span><\/p>\n<p><i><span style=\"font-size: large;\">Let&#8217;s name all the elements and put (Virtual IP address)<\/span><\/i><\/p>\n<div style=\"width: 499px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" src=\"https:\/\/dlshad.net\/wp-content\/uploads\/2013\/06\/VPNmapnotrunnint.png \" width=\"489\" height=\"393\" \/><p class=\"wp-caption-text\">Digram 3 , I&#8217;m using the same (Virtual) name &#8211; ip address , use yours<\/p><\/div>\n<style type=\"text\/css\"><!--\nP { margin-bottom: 0.08in; }A:link {  }\n--><\/style>\n<p><span style=\"font-size: large;\"><b>Client<\/b><\/span><span style=\"font-size: large;\"> : <\/span><span style=\"font-size: large;\">U<\/span><span style=\"font-size: large;\">ser before the Syrian Firewall has ( Obfsproxy + OpenVPN client) <\/span><\/p>\n<p><b><span style=\"font-size: large;\"><i>O_HOST<\/i><\/span><span style=\"font-size: large;\">: <\/span><\/b><span style=\"font-size: large;\">obfsproxy server configured to receive obfsproxy connection from outside world then send openvpn requests to openvpn Server <\/span><span style=\"font-size: large;\">with eth0 IP address : 192.168.1.1<\/span><\/p>\n<p><span style=\"font-size: large;\"><b>VPN_host<\/b><\/span><span style=\"font-size: large;\"> Server: OpenVPN Server configured to receive OpenVPN requests from the obfsproxy Server connection <\/span><span style=\"font-size: large;\">with eth0 IP address 192.168.1.2 , and Tun0 IP address 10.8.0.1<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><b><span style=\"font-size: large;\">How to do it?<\/span><\/b><\/p>\n<p><b><span style=\"font-size: large;\">&#8211; Install Obfsproxy Server:<\/span><\/b><\/p>\n<p><b><span style=\"font-size: large;\">Step 1 <\/span><\/b><\/p>\n<p><span style=\"font-size: large;\">by running this command in the Terminal to install the <\/span>needed lib autoconf + pkg-config + git<\/p>\n<blockquote><p>&nbsp;<\/p>\n<p>apt-get install autoconf<br \/>\napt-get install pkg-config<br \/>\napt-get install git<\/p><\/blockquote>\n<p><span style=\"font-size: large;\">then, it will ask you for your <b>root password<\/b><\/span><\/p>\n<p><span style=\"font-size: large;\">Then, you have to answer by yes then press <b>enter<\/b><\/span><\/p>\n<p><span style=\"font-size: large;\">after finishing <\/span><\/p>\n<p><span style=\"font-size: large;\">you have to run this command in the terminal <\/span><\/p>\n<blockquote><p>sudo git clone <a href=\"https:\/\/git.torproject.org\/pluggable-transports\/obfsproxy-legacy.git\">https:\/\/git.torproject.org\/pluggable-transports\/obfsproxy-legacy.git<\/a><\/p>\n<p>cd obfsproxy-legacy\/<\/p>\n<p>sudo .\/autogen.sh &amp;&amp; .\/configure &amp;&amp; make<\/p>\n<p>sudo make install<\/p><\/blockquote>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>- Tunnaling obfsproxy from outside to OpenVPN:<\/b><\/span><\/span><\/tt><\/p>\n<p><tt> <span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">obfsproxy server <\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">---&gt; openVPN Server<\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>Step 1<\/b><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>Let's make the O_HOST obfsproxy server to listen for connection and redirect to VPN_HOST:<\/b><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">Run the following command on the O_HOST:<\/span><\/span><\/tt><\/p>\n<blockquote><p><strong><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">screen obfsproxy --log-min-severity=info obfs2 <tt>--<\/tt>dest=192.168.1.2:1194 server 0.0.0.0:80<\/span><\/span><\/tt><\/strong><\/p><\/blockquote>\n<p><i>Note : maybe you need to install screen app, by running the following command <b>Sudo apt-get install screen <\/b><\/i><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i>The \u201cdest\u201d : is the server where you want to redirect to connection to , \u201cServer\u201d is where you want to accept the connection from , \u201c0.0.0.0:80\u201d means, accept the connections from any IP address over the port 80 \ud83d\ude42<\/i><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>Now: <\/b><\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i>Your servers are ready to work \ud83d\ude42 let's go to the client side<\/i><\/span><\/span><\/tt><\/p>\n<p><i><b><span style=\"font-size: large;\">&#8211; <\/span><span style=\"font-size: large;\">Install Obfsproxy <\/span><span style=\"font-size: large;\">and OpenVPN <\/span><span style=\"font-size: large;\">on the <\/span><span style=\"font-size: large;\">client <\/span><span style=\"font-size: large;\">side<\/span><span style=\"font-size: large;\">:<\/span><\/b><\/i><\/p>\n<p><i><b><span style=\"font-size: large;\">For Linux Ubuntu, Debian, client <\/span><\/b><\/i><\/p>\n<p><i><span style=\"font-size: large;\">Note: <a href=\"http:\/\/uvirtus.org\/\">Virtus Linux<\/a> already has obfsproxy (you don&#8217;t have to install it )<\/span><\/i><\/p>\n<p><span style=\"font-size: large;\"><b>Step 1<\/b><\/span><\/p>\n<p><span style=\"font-size: large;\">Install OpenVPN<\/span><\/p>\n<p><span style=\"font-size: large;\">by running this command in the Terminal<\/span><\/p>\n<blockquote><p><span style=\"font-size: large;\"><b>sudo apt-get install openvpn<\/b><\/span><\/p><\/blockquote>\n<p><span style=\"font-size: large;\">then, it will ask you for your <b>root password<\/b><\/span><\/p>\n<p><span style=\"font-size: large;\"><b>Then<\/b>, you have to answer by yes then press enter<\/span><\/p>\n<p>&nbsp;<\/p>\n<style type=\"text\/css\"><!--\nP { margin-bottom: 0.08in; }A:link {  }\n--><\/style>\n<p><span style=\"font-size: large;\"><b>Step 2<\/b><\/span><\/p>\n<p><span style=\"font-size: large;\"><b>&#8211; install obfsproxy<\/b><\/span><\/p>\n<p><span style=\"font-size: large;\">by running this command in the Terminal <\/span><\/p>\n<blockquote><p><span style=\"font-size: large;\"><b>sudo apt-get install autoconf autotools-dev gcc git pkg-config libtool libevent-2.0-5 libevent-dev libevent-openssl-2.0-5 libssl-dev<\/b><\/span><\/p><\/blockquote>\n<p><span style=\"font-size: large;\">then, it will ask you for your <b>root password<\/b><\/span><\/p>\n<p><span style=\"font-size: large;\">Then, you have to answer by yes then press <b>enter<\/b><\/span><\/p>\n<p><span style=\"font-size: large;\">after finishing you have to run<\/span> this command in the Terminal to install the needed lib autoconf + pkg-config + git<\/p>\n<blockquote><p>&nbsp;<\/p>\n<p>apt-get install autoconf<br \/>\napt-get install pkg-config<br \/>\napt-get install git<\/p>\n<p>&nbsp;<\/p><\/blockquote>\n<p>then, it will ask you for your <b>root password<\/b><\/p>\n<p>Then, you have to answer by yes then press <b>enter<\/b><\/p>\n<p>after finishing<\/p>\n<p>you have to run this command in the terminal<\/p>\n<blockquote><p>sudo git clone <a href=\"https:\/\/git.torproject.org\/pluggable-transports\/obfsproxy-legacy.git\">https:\/\/git.torproject.org\/pluggable-transports\/obfsproxy-legacy.git<\/a><\/p>\n<p>cd obfsproxy-legacy\/<\/p>\n<p>sudo .\/autogen.sh &amp;&amp; .\/configure &amp;&amp; make<\/p>\n<p>sudo make install<\/p><\/blockquote>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>- Configuration of openVPN client side :<\/b><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>Step1<\/b><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>We need to make a client configuration files , run the following command :<\/b><\/span><\/span><\/tt><\/p>\n<blockquote><p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>cd \/etc\/openvpn\/<\/b><\/span><\/span><\/tt><\/p><\/blockquote>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">then<\/span><\/span><\/tt><\/p>\n<blockquote><p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>sudo nano client.ovpn<\/b><\/span><\/span><\/tt><\/p><\/blockquote>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>paste the following text:<\/b><\/span><\/span><\/tt><\/p>\n<p>&nbsp;<\/p>\n<style type=\"text\/css\"><!--\nP { margin-bottom: 0.08in; }A:link {  }\n--><\/style>\n<blockquote>\n<pre><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">### Client configuration file for OpenVPN<\/span><\/span><\/tt>\r\n<a name=\"line-2-10\"><\/a>\r\n<a name=\"line-3-9\"><\/a># Specify that this is a client\r\n<a name=\"line-4-9\"><\/a>client\r\n<a name=\"line-5-8\"><\/a>\r\n<a name=\"line-6-6\"><\/a># Bridge device setting\r\n<a name=\"line-7-6\"><\/a>dev tun\r\n<a name=\"line-8-4\"><\/a>\r\n<a name=\"line-9-4\"><\/a># Host name and port for the server (default port is 1194)\r\n<a name=\"line-10-4\"><\/a># note: replace with the correct values your server set up \r\n# Note: the remote ip address that we should use in the openvpn over obfsproxy should be the \r\n#--obfsproxy , in our example is the following :\r\n\r\n<a name=\"line-11-4\"><\/a>remote 192.168.1.1 80\r\n\r\n# Socks-proxy means , the connection will be forwarded to the obfsproxy application through socket over \r\n#--the port 9090\r\n\r\nsocks-proxy 127.0.0.1 9090\r\n\r\n<a name=\"line-12-4\"><\/a>\r\n<a name=\"line-13-4\"><\/a># Client does not need to bind to a specific local port\r\n<a name=\"line-14-3\"><\/a>nobind\r\n<a name=\"line-15-3\"><\/a>\r\n<a name=\"line-16-3\"><\/a># Keep trying to resolve the host name of OpenVPN server.\r\n<a name=\"line-17-1\"><\/a>## The windows GUI seems to dislike the following rule. \r\n<a name=\"line-18-1\"><\/a>##You may need to comment it out.\r\n<a name=\"line-19-1\"><\/a>resolv-retry infinite\r\n<a name=\"line-20-1\"><\/a>\r\n<a name=\"line-21-1\"><\/a># Preserve state across restarts\r\n<a name=\"line-22-1\"><\/a>persist-key\r\n<a name=\"line-23-1\"><\/a>persist-tun\r\n<a name=\"line-24-1\"><\/a>\r\n<a name=\"line-25-1\"><\/a># SSL\/TLS parameters - files created previously when we did the configuration for the \r\n#openvpn server side and I asked you to move it over secure connection, all the files should be placed \r\n#at \/etc\/openvpn\/ folder\r\n<a name=\"line-26-1\"><\/a>ca ca.crt\r\n<a name=\"line-27-1\"><\/a>cert user1.crt\r\n<a name=\"line-28-1\"><\/a>key user1.key\r\n<a name=\"line-29-1\"><\/a>\r\n<a name=\"line-30-1\"><\/a># Since we specified the tls-auth for server, we need it for the client\r\n<a name=\"line-31-1\"><\/a># note: 0 = server, 1 = client\r\n<a name=\"line-32-1\"><\/a>tls-auth ta.key 1\r\n<a name=\"line-33-1\"><\/a>\r\n<a name=\"line-34-1\"><\/a># Specify same cipher as server\r\n<a name=\"line-35-1\"><\/a>cipher BF-CBC\r\n<a name=\"line-36-1\"><\/a>\r\n<a name=\"line-37-1\"><\/a># Use compression\r\n<a name=\"line-38-1\"><\/a>comp-lzo\r\n<a name=\"line-39\"><\/a>\r\n<a name=\"line-40\"><\/a># Log verbosity (to help if there are problems)\r\nverb 3<\/pre>\n<\/blockquote>\n<p>&nbsp;<\/p>\n<style type=\"text\/css\"><!--\nP { margin-bottom: 0.08in; }A:link {  }\n--><\/style>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>Save the file ( Ctrl + o ) then Yes and Enter <\/b><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>step<\/b><\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>2<\/b><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>Running obfsproxy on the client side<\/b><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">obfsproxy will receive connections from openvpn application locally , and <\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">send it to obfsproxy server , to do that you need to run the following command<\/span><\/span><\/tt><\/p>\n<blockquote><p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>sudo screen obfsproxy --log-min-severity=info obfs2 socks 127.0.0.1:9090<\/b><\/span><\/span><\/tt><\/p><\/blockquote>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i>now your setup is ready to work , you need to run the openvpn connection<\/i><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>- Running the openvpn connection:<\/b><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">Run the following command on the client side:<\/span><\/span><\/tt><\/p>\n<blockquote><p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>sudo openvpn --config \/etc\/openvpn\/client.ovpn<\/b><\/span><\/span><\/tt><\/p><\/blockquote>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">To test that <\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">go to <a href=\"http:\/\/www.whatismyipaddress.com\/\">www.whatismyipaddress.com<\/a> you should have new IP address = 192.168.1.2<\/span><\/span><\/tt><\/p>\n<p>&nbsp;<\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>- Using SSH Tunnel over obfsproxy:<\/b><\/span><\/span><\/tt><\/p>\n<p><span style=\"font-size: large;\"><i><b>The Scenario<\/b><\/i><\/span><span style=\"font-size: large;\">:<\/span><\/p>\n<p><i><span style=\"font-size: large;\">Note: the IP address are virtual , use your real once.<\/span><\/i><\/p>\n<p><span style=\"font-size: large;\"><i><b>SSH Client<\/b><\/i><\/span><span style=\"font-size: large;\"> : A regular user before the Syrian Firewall has ( Obfsproxy + <\/span><span style=\"font-size: large;\">ssh tunnel<\/span><span style=\"font-size: large;\"> client) <\/span><\/p>\n<p><span style=\"font-size: large;\"><b>SSH_HOST<\/b><\/span><span style=\"font-size: large;\"> : <\/span><span style=\"font-size: large;\">Regular SSH<\/span><span style=\"font-size: large;\"> Server configured to receive <\/span><span style=\"font-size: large;\">SSH<\/span><span style=\"font-size: large;\"> requests from the obfsproxy Server .<\/span><\/p>\n<p><b><span style=\"font-size: large;\"><i>O_HOST<\/i><\/span><span style=\"font-size: large;\">: <\/span><\/b><span style=\"font-size: large;\">obfsproxy server configured to receive obfsproxy connection from outside world and uncover it then send <\/span><span style=\"font-size: large;\">SSH<\/span><span style=\"font-size: large;\"> requests to openvpn Server.<\/span><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">SS<\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">H<\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"> client <\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">(Local) <\/span><\/span><\/tt><tt><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">---&gt;<\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"> obfsproxy client (<\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">Local) ----&gt;<\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"> obfsproxy server <\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">---&gt; <\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">SSH<\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"> Server<\/span><\/span><\/tt><\/p>\n<div style=\"width: 499px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" src=\"https:\/\/dlshad.net\/wp-content\/uploads\/2013\/06\/SSHmapnotrunnint.png \" width=\"489\" height=\"394\" \/><p class=\"wp-caption-text\">Digram 4 &#8211; SSH over obfsproxy<\/p><\/div>\n<style type=\"text\/css\"><!--\nP { margin-bottom: 0.08in; }A:link {  }\n--><\/style>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>Step 1<\/b><\/span><\/span><\/tt><\/p>\n<p>&nbsp;<\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i>Note: You need to i<\/i><\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i>nstall Obfsproxy Server, <\/i><\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i>back to the same instructions that I used in the setup openVPN over pbfsproxy<\/i><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>Tunneling obfsproxy server to SSH server<\/b><\/span><\/span><\/tt><\/p>\n<p><tt> <span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">obfsproxy server <\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">---&gt; <\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">SSH<\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"> Server<\/span><\/span><\/tt><\/p>\n<p>&nbsp;<\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>Let's make the O_HOST obfsproxy server to listen for connection and redirect to <\/b><\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>SSH<\/b><\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>_HOST:<\/b><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">Run the following command on the O_HOST:<\/span><\/span><\/tt><\/p>\n<blockquote><p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">screen obfsproxy --log-min-severity=info obfs2 <tt>--<\/tt>dest=192.168.1.2:<\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">22<\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"> server 0.0.0.<\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">0:80<\/span><\/span><\/tt><\/p><\/blockquote>\n<p><i>Note : maybe you need to install screen app, by running the following command <b>Sudo apt-get install screen <\/b><\/i><\/p>\n<blockquote><p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i>The \u201cdest\u201d : is the server where you want to redirect to connection to , \u201cServer\u201d is where you want to accept the connection from , \u201c0.0.0.0:80\u201d means, accept the connections from any IP address over the port 80<\/i><\/span><\/span><\/tt><\/p>\n<p>&nbsp;<\/p><\/blockquote>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i><b>- Add SSH users to the server :<\/b><\/i><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i>in the SSH_Host <\/i><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i>run the following commands<\/i><\/span><\/span><\/tt><\/p>\n<blockquote><p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i><b>useradd username<\/b><\/i><\/span><\/span><\/tt><\/p><\/blockquote>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i>then enter<\/i><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i>It will ask you to add the password and retype it <\/i><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i>some servers doesn't ask to add password for users , so you should run the following command <\/i><\/span><\/span><\/tt><\/p>\n<blockquote><p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i><b>passwd username<\/b><\/i><\/span><\/span><\/tt><\/p><\/blockquote>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i>then enter<\/i><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i>It will ask you to add the password and retype it<\/i><\/span><\/span><\/tt><\/p>\n<p>&nbsp;<\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i><b>- Running SSH client over obfsproxy<\/b><\/i><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i>You need to reconfigure the client SSH application to allow it make connection to the O_HOST over Port 80 , and redirect the connection to the SSH_HOST<\/i><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">On the client machine <\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">edit <strong>~\/.ssh\/config<\/strong> , run the following command<\/span><\/span><\/tt><\/p>\n<blockquote><p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>sudo nano <\/b><\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>~\/.ssh\/config<\/b><\/span><\/span><\/tt><\/p><\/blockquote>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">add the following lines<\/span><\/span><\/tt><\/p>\n<blockquote><p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>Host 192.168.1.1 <\/b><\/span><\/span><\/tt><\/p>\n<p><tt> <span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>ProxyCommand \/bin\/nc.openbsd -x 127.0.0.1:9090 %h %p<\/b><\/span><\/span><\/tt><\/p><\/blockquote>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i>This will force all SSH connections to <\/i><\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i>O_HOST<\/i><\/span><\/span><\/tt><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i> to pass through the local (obfsproxy) socks server listening on 127.0.0.1:9090<\/i><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i><b>Now run the following command on the client side to make the SSH connection<\/b><\/i><\/span><\/span><\/tt><\/p>\n<blockquote><p><tt><span style=\"color: #000000;\"><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><b>ssh -p 80 username@192.168.1.1 -D 9090<\/b><\/span><\/span><\/span><\/tt><\/p><\/blockquote>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\">That\u2019s it. The connection will now pass get obfuscated locally, pass through obfsproxy server at O_HOST and then finally reach it\u2019s destination at SSH_HOST.<\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i><b>Note: now on the client side you need to connect all your browsers , internet access application to the following address:<\/b><\/i><\/span><\/span><\/tt><\/p>\n<blockquote><p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i><b>SOCKS PROXY 5<\/b><\/i><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i><b>IP Address : 127.0.0.1<\/b><\/i><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i><b>Port: 9090<\/b><\/i><\/span><\/span><\/tt><\/p><\/blockquote>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i><b>to test it go to <a href=\"http:\/\/www.whatismyipaddress.com\/\">www.whatismyipaddress.com<\/a> the ip address should be = 192.168.1.2<\/b><\/i><\/span><\/span><\/tt><\/p>\n<p>&nbsp;<\/p>\n<p><a href=\"https:\/\/www.pluggabletransports.info\/implement\/openvpn\/\"><span style=\"font-size: large;\"><i>You are reading an outdated document, please click here to get the most updated guide on how to implement pluggable transport with OpenVPN or visit this link: https:\/\/www.pluggabletransports.info\/implement\/openvpn\/<\/i><\/span><\/a><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: large;\"><i>Note: I tested all what's in the paper , for more information please <a href=\"mailto:dlshad@dlshad.net\">dlshad@dlshad.net<\/a><\/i><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: small;\"><i>Recurse :<\/i><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: small;\"><i>1- OpenVPN <a href=\"https:\/\/help.ubuntu.com\/community\/OpenVPN\">https:\/\/help.ubuntu.com\/community\/OpenVPN<\/a><\/i><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: small;\"><i>2- Tor: Pluggable Transports <a href=\"https:\/\/www.torproject.org\/docs\/pluggable-transports.html.en\">https:\/\/www.torproject.org\/docs\/pluggable-transports.html.en<\/a><\/i><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: small;\"><i>3- Tor Project <\/i><\/span><\/span><\/tt><em><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: small;\">obfsproxy<\/span><\/span><\/em><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: small;\"><i> <a href=\"https:\/\/www.torproject.org\/projects\/obfsproxy.html.en\">https:\/\/www.torproject.org\/projects\/obfsproxy.html.en<\/a><\/i><\/span><\/span><\/tt><\/p>\n<p><tt><span style=\"font-family: Liberation Serif,Times New Roman,serif;\"><span style=\"font-size: small;\"><i>4- KheOps personal blogs at <a href=\"http:\/\/syria.telecomix.org\/\">http:\/\/syria.telecomix.org\/<\/a><\/i><\/span><\/span><\/tt><\/p>\n<p><tt><i><tt>5<\/tt>-\u00a0IPTABLES secure Internet tunnel at <a href=\"https:\/\/forums.openvpn.net\/topic7722.html\">https:\/\/forums.openvpn.net\/topic7722.html<\/a><\/i><\/tt><\/p>\n<div style=\"padding-bottom:20px; padding-top:10px;\" class=\"hupso-share-buttons\"><!-- Hupso Share Buttons - https:\/\/www.hupso.com\/share\/ --><a class=\"hupso_pop\" href=\"https:\/\/www.hupso.com\/share\/\"><img decoding=\"async\" src=\"https:\/\/static.hupso.com\/share\/buttons\/button100x23.png\" style=\"border:0px; width:100; height: 23; \" alt=\"Share Button\" \/><\/a><script type=\"text\/javascript\">var hupso_services=new Array(\"Twitter\",\"Facebook\",\"Linkedin\",\"StumbleUpon\",\"Reddit\",\"Print\");var hupso_icon_type = \"labels\";var hupso_background=\"#EAF4FF\";var hupso_border=\"#66CCFF\";var hupso_image_folder_url = \"\";var hupso_url=\"\";var hupso_title=\"Bypassing%20censorship%20by%20using%20obfsproxy%20and%20openVPN%20%2C%20SSH%20Tunnel\";<\/script><script type=\"text\/javascript\" src=\"https:\/\/static.hupso.com\/share\/js\/share.js\"><\/script><!-- Hupso Share Buttons --><\/div>","protected":false},"excerpt":{"rendered":"<p>Dlshad Othman You are about to read an outdated document, please click here to get the most updated guide on how to implement pluggable transport with OpenVPN or visit this link: https:\/\/www.pluggabletransports.info\/implement\/openvpn\/ @dlshadothman &nbsp; Syrian ISPs are using sophisticated technologies to monitor and filter traffic. These boxes are DPI (Deep Packet Inspection) and what they [&hellip;]<\/p>\n<div style=\"padding-bottom:20px; padding-top:10px;\" class=\"hupso-share-buttons\"><!-- Hupso Share Buttons - https:\/\/www.hupso.com\/share\/ --><a class=\"hupso_pop\" href=\"https:\/\/www.hupso.com\/share\/\"><img src=\"https:\/\/static.hupso.com\/share\/buttons\/button100x23.png\" style=\"border:0px; width:100; height: 23; \" alt=\"Share Button\" \/><\/a><script type=\"text\/javascript\">var hupso_services=new Array(\"Twitter\",\"Facebook\",\"Linkedin\",\"StumbleUpon\",\"Reddit\",\"Print\");var hupso_icon_type = \"labels\";var hupso_background=\"#EAF4FF\";var hupso_border=\"#66CCFF\";var hupso_image_folder_url = \"\";var hupso_url=\"\";var hupso_title=\"Bypassing%20censorship%20by%20using%20obfsproxy%20and%20openVPN%20%2C%20SSH%20Tunnel\";<\/script><script type=\"text\/javascript\" src=\"https:\/\/static.hupso.com\/share\/js\/share.js\"><\/script><!-- Hupso Share Buttons --><\/div>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,3],"tags":[],"_links":{"self":[{"href":"https:\/\/dlshad.net\/wp-json\/wp\/v2\/posts\/135"}],"collection":[{"href":"https:\/\/dlshad.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dlshad.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dlshad.net\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dlshad.net\/wp-json\/wp\/v2\/comments?post=135"}],"version-history":[{"count":5,"href":"https:\/\/dlshad.net\/wp-json\/wp\/v2\/posts\/135\/revisions"}],"predecessor-version":[{"id":156,"href":"https:\/\/dlshad.net\/wp-json\/wp\/v2\/posts\/135\/revisions\/156"}],"wp:attachment":[{"href":"https:\/\/dlshad.net\/wp-json\/wp\/v2\/media?parent=135"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dlshad.net\/wp-json\/wp\/v2\/categories?post=135"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dlshad.net\/wp-json\/wp\/v2\/tags?post=135"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}