hashcott / ghostline

# Ghostline
**One-click encrypted DNS and protection against DPI interference for Windows and Linux.**
English · Tiếng Việt
---
Ghostline runs a local DNS server on `127.0.0.1` / `::1`, points the system's DNS at it (every network adapter on Windows; NetworkManager, systemd-resolved or `/etc/resolv.conf` on Linux), and forwards your queries over **DoH, DoT, DoQ or DNSCrypt** to the fastest healthy resolver. When your network interferes with encrypted connections by inspecting packets (DPI), it can also run a DPI bypass engine: **zapret2** (recommended), or **GoodbyeDPI** on Windows. Above all, it is built to **always give your original DNS back**, even if the app crashes or the machine loses power.
> ⚖️ By downloading or using Ghostline you agree to the Disclaimer and the GPL-3.0 license. Ghostline is for privacy, security and research; you are responsible for using it within the law of your country and your network provider's terms.
## Table of contents
- Features
- Video
- Screenshots
- Install
- Usage
- How it works
- Privacy
- Known limitations
- Building from source
- Project layout
- Contributing
- Security
- Disclaimer
- License and credits
- Donate
## Features
- **Encrypted DNS for the whole system:** DoH, DoT, DoQ and DNSCrypt upstreams, powered by AdGuard dnsproxy.
- **Automatic server choice:** scans resolvers in parallel, rejects poisoned answers, and remembers the best servers per network.
- **Never lose the internet:** the original DNS is snapshotted before any change and always comes back. On Windows there are five recovery layers: clean disconnect, a watchdog process, restore on next launch, a logon recovery task, and a network guard that works even if an antivirus quarantines `ghostline.exe`. On Linux a systemd service restores on disconnect, when it stops or crashes, and at boot.
- **Leak verification:** after connecting, Ghostline checks that queries really go through it.
- **DPI bypass:** bundled, hash-pinned zapret2 v1.0.5.2 (fake packets, more split methods, QUIC for YouTube/Google), through WinDivert on Windows and an nftables queue on Linux, plus GoodbyeDPI 0.2.3rc3 on Windows. zapret2 strategies come from a signed list refreshed daily, with auto-tune, a site blacklist, automatic detection of blocked sites, and DoH request fragmentation. On Windows, if antivirus blocks zapret2, Ghostline falls back to GoodbyeDPI and offers to retry.
- **Local proxy (HTTP / HTTPS / SOCKS4/5):** runs with Connect, can become the system proxy (Windows, GNOME, KDE), and can be shared with phones and other devices on your Wi-Fi (QR code included). Names are always resolved through Ghostline's encrypted DNS.
- **Web fragmentation without a driver:** traffic through the proxy gets its TLS ClientHello split automatically when the network cuts a connection by inspecting its SNI, and the fix is remembered per network.
- **Rules and community lists:** block, allow, fake DNS, fragment or route through an upstream proxy by domain, keyword, regexp or CI