GoodbyeDPI

This software designed to bypass Deep Packet Inspection systems found in many Internet Service Providers which block access to certain websites. It handles DPI connected using optical splitter or port mirroring ( Passive DPI ) which do not block any data but just replying faster than requested destination, and Active DPI connected in sequence. For Russia : Download latest version from Releases page, unpack the file and run 1 russia blacklist dnsredir.cmd script. For other countries: Download latest version from Releases page, unpack the file and run 2 any country dnsredir.cmd . Supported arguments To get relevant information about your version of the program, use the -h (--help) argument at startup. Then run the goodbyedpi.exe executable without any options. If it works — congratulations! You can use it as-is or configure further, for example by using --blacklist option if the list of blocked websites is known and available for your country. If your provider intercepts DNS requests, you may want to use --dns-addr option to a public DNS resolver running on non-standard port (such as Yandex DNS 77.88.8.8:1253 ) or configure DNS over HTTPS/TLS using third-party applications. Check the .cmd scripts and modify it according to your preference and network conditions. Most Passive DPI send HTTP 302 Redirect if you try to access blocked website over HTTP and TCP Reset in case of HTTPS, faster than destination website. Packets sent by DPI usually have IP Identification field equal to 0x0000 or 0x0001 , as seen with Russian providers. These packets, if they redirect you to another website (censorship page), are blocked by GoodbyeDPI. Active DPI is more tricky to fool. Currently the software uses 7 methods to circumvent Active DPI: These methods should not break any website as they're fully compatible with TCP and HTTP standards, yet it's sufficient to prevent DPI data classification and to circumvent censorship. Additional space may break some websites, although it's acceptable by HTTP/1.1 specification (see 19.3 Tolerant Applications). The program loads WinDivert driver which uses Windows Filtering Platform to set filters and redirect packets to the userspace. It's running as long as console window is visible and terminates when you close the window. This project can be built using GNU Make and mingw . The only dependency is WinDivert. Check examples in service install russia blacklist.cmd , service install russia blacklist dnsredir.cmd and service remove.cmd scripts. Horribly outdated Windows 7 installations are not able to load WinDivert driver due to missing support for SHA256 digital signatures. Install KB3033929 x86/x64, or better, update the whole system using Windows Update. Intel/Qualcomm Killer network cards: Advanced Stream Detect in Killer Control Center is incompatible with GoodbyeDPI, disable it. QUIK trading software may interfere with GoodbyeDPI. First start QUIK, then GoodbyeDPI. ~~Some SSL/TLS stacks unable to process fragmented ClientHello packets, and HTTPS websites won't open. Bug: 4, 64.~~ Fragmentation issues are fixed in v0.1.7. ~~ESET Antivirus is incompatible with WinDivert driver 91. This is most probably antivirus bug, not WinDivert.~~ Thanks for every BlockCheck contributor. It would be impossible to understand DPI behaviour without this utility.