What is traffic obfuscation (Stealth VPN) and what methods are used to disguise tunnels as regular HTTPS traffic?

Question

Accepted Answer

Traffic obfuscation, or Stealth VPN technology, is a set of methods for transforming network packets to conceal the very fact that bypass tools are being used from Deep Packet Inspection (DPI) systems.

Modern providers and state regulators actively use DPI systems to search for signatures of popular VPN protocols like OpenVPN or WireGuard. These protocols have characteristic headers and data structures at the connection establishment stage, which allows them to be instantly detected and blocked at the network level.

To combat such blocks, developers use obfuscation, which scrambles or disguises traffic as legitimate HTTPS traffic using the standard encrypted TLS protocol. As a result, DPI systems see a regular secure web connection to a bank or social networks and cannot recognize the VPN tunnel inside it.

1. Using the Shadowsocks protocol, which was originally created to disguise traffic as a random noise stream or encrypted web data.
2. Using bridges and plugins like v2ray-plugin or Cloak for OpenVPN, which add valid TLS headers to packets and simulate real browser sessions.
3. Encapsulating traffic into the WebSocket protocol, which allows data to be transmitted on top of a standard web server through the same ports used by regular websites.

The implementation of obfuscation inevitably entails a slight increase in latency and CPU load due to the additional data packaging and un-packaging steps. Nevertheless, it is a critically important tool for ensuring stable network access in regions with strict internet censorship.

What is traffic obfuscation (Stealth VPN) and what methods are used to disguise tunnels as regular HTTPS traffic?

More questions in this topic

Related questions from other topics