ValdikSS / GoodbyeDPI

GoodbyeDPI — Deep Packet Inspection circumvention utility
=========================
This software designed to bypass Deep Packet Inspection systems found in many Internet Service Providers which block access to certain websites.
It handles DPI connected using optical splitter or port mirroring (**Passive DPI**) which do not block any data but just replying faster than requested destination, and **Active DPI** connected in sequence.
**Windows 7, 8, 8.1, 10 or 11** with administrator privileges required.
# Quick start
* **For Russia**: Download latest version from Releases page, unpack the file and run **1_russia_blacklist_dnsredir.cmd** script.
* For other countries: Download latest version from Releases page, unpack the file and run **2_any_country_dnsredir.cmd**.
These scripts launch GoodbyeDPI in recommended mode with DNS resolver redirection to Yandex DNS on non-standard port (to prevent DNS poisoning). 
If it works — congratulations! You can use it as-is or configure further.
# How to use
Download latest version from Releases page and run.
## Supported arguments
To get relevant information about your version of the program, use the -h (--help) argument at startup.
 [code] 
## How to check
To check if your ISP's DPI could be circumvented, first make sure that your provider does not poison DNS answers by enabling "Secure DNS (DNS over HTTPS)" option in your browser.
* **Chrome**: Settings → Privacy and security → Use secure DNS → With: NextDNS
* **Firefox**: Settings → Network Settings → Enable DNS over HTTPS → Use provider: NextDNS
Then run the `goodbyedpi.exe` executable without any options. If it works — congratulations! You can use it as-is or configure further, for example by using `--blacklist` option if the list of blocked websites is known and available for your country.
If your provider intercepts DNS requests, you may want to use `--dns-addr` option to a public DNS resolver running on non-standard port (such as Yandex DNS `77.88.8.8:1253`) or configure DNS over HTTPS/TLS using third-party applications.
Check the .cmd scripts and modify it according to your preference and network conditions.
# How does it work
### Passive DPI
Most Passive DPI send HTTP 302 Redirect if you try to access blocked website over HTTP and TCP Reset in case of HTTPS, faster than destination website. Packets sent by DPI usually have IP Identification field equal to `0x0000` or `0x0001`, as seen with Russian providers. These packets, if they redirect you to another website (censorship page), are blocked by GoodbyeDPI.
### Active DPI
Active DPI is more tricky to fool. Currently the software uses 7 methods to circumvent Active DPI:
* TCP-level fragmentation for first data packet
* TCP-level fragmentation for persistent (keep-alive) HTTP sessions
* Replacing `Host` header with `hoSt`
* Removing space between header name and value in `Host` header
* Adding additional space between HTTP Method (GET, POST etc) and URI
* Mixing case of Host header value
* Sending fake