diff --git a/opsec/v2ray_tutorial/index.html b/opsec/v2ray_tutorial/index.html index 449a88b..e8249c9 100644 --- a/opsec/v2ray_tutorial/index.html +++ b/opsec/v2ray_tutorial/index.html @@ -116,12 +116,38 @@
  • why v2ray?

    -

    wireguard as well as openvpn does not provide any obfuscation feature and will be easily detected by header match or DPI - thats why v2rays customized protocols work , traffic to/from these will look like normal traffic to an extend. +

    If your country marks TOR traffic as illegal and you want to access onions what would you do? +

    + just hop onto some VPN's to mask TOR traffic? +
    + (mostly based off wireguard and openvpn) +

    + but what if they're also blocked and made illegal to use? +
    + +

    + Thats where V2RAY becomes a necessity! +

    + V2rays ability to obfuscate and make packets appear to be genuine webtraffic makes it kindof UNDECTECTABLE. + + Wireguard as well as openvpn does not provide any obfuscation feature and will be detected easily by header match or DPI. + +
    + (they have this in their codebase which clearly shows how to detect Wireguard traffic) + ref

    -

    TODO:CAN SHOWCASE SOME WG PACKETS AND V2RAY packets in MITM prespective>

    +

    But How does a V2ray traffic look like?

    + Here's a Wireshark dump of curl archlinux.org with and without v2ray. +
    + +

    + As you could see requests to archlinux.org ( with v2ray ) goes to a popular website giphy but is actually communicating to our V2ray server behind the CDN through Websocket protocol. +
    + (Domain Fronting method is being used here) +

    +
    - As mentioned earlier, we could use v2ray to make our own versions of primitive protocols to "fool the wall". + we could use v2ray to make our own versions of primitive protocols to "fool the wall".


  • @@ -178,7 +204,7 @@
    -

    Getting Started



    +

    Serverside Setup



    an overview of v2ray server config looks like this

    
    @@ -298,7 +324,7 @@ x-ui v1.8.7 installation finished, it is up and running now...
                                         ###############################################
                                     
                                     

    Example - http://127.0.0.1:9566/EwAJmwAHwMk7FLK/ + http://198.41.128.88:9566/EwAJmwAHwMk7FLK/
    Once you access the web portal,use the username and password as above.

    @@ -356,14 +382,22 @@ $ ./v2rayN
    + After executing the above command a GUI will popup.
    - change route settings (optional) + change route settings (optional) within Settings(on top) > Regional Presets Settings > Russia



    - Thats it ! +
    + Routing is used when you want to avoid proxy for regional websites. +
    + (A direct connection without proxy will be made by the clientside app based-off IP or Domain name) +
    +

    + Ex. if we access 1tv.ru, with this setting turned on it will be resolved using our actual IP than our Proxy IP +

    @@ -376,7 +410,7 @@ $ ./v2rayN
    -

    Configuration

    +

    Censorship Evasion technique #1 - Domain Fronting



    Setting up a v2ray server alone doesnt bypass any censors(it would be obvious if we push a large amount of traffic),rather we use some methods to make the traffic look geniune. @@ -416,8 +450,16 @@ $ ./v2rayN We can do inbounds to port 443(TLS port) and adjust inbound settings to have Fallback but that requires one to have an inbound config with TCP transport within the panel. - TODO: Explain fallback above somewhere or here +

    + A Fallback is when you want to expose only one standard HTTP/HTTPS port(80,443) to receive inbounds but want to use different protocols like VMESS,Shadowsock... with the same port. +
    + Fallback Can only be used with TCP/XTLS transport modes. +
    + + +



    + Now from Settings >>
    @@ -429,9 +471,9 @@ $ ./v2rayN
    Now lets add VCL for HTTP Connection Upgrade(Since we want to switch to Websocket) - +
    - +
    
     if (req.http.Upgrade) {
     return (upgrade);
    @@ -448,7 +490,7 @@ return (upgrade);
             
    -

    Testing Config

    +

    Clientside Setup

    In this section we'll discuss how to connect to the prementioned setup using domain fronting technique.
    • @@ -477,9 +519,6 @@ return (upgrade);

    • -
    • -

      Android

      -

    Testing Tor

    @@ -491,7 +530,7 @@ return (upgrade); (Proxy port shown in v2ray. So that connection made by tor will go through v2ray server) - +

    If we were to save it and try to connect it will fail. @@ -510,6 +549,8 @@ return (upgrade);

    As you could see, traffic goes to fastly server rather than tor nodes.
    (Youre seeing Websocket traffic to and from 192.168.1.2(LAN IP) to a Fastly CDN(Anycast IP)) +
    br +

    diff --git a/opsec/v2ray_tutorial/is-vpn-legal-in-your-country.jpeg b/opsec/v2ray_tutorial/is-vpn-legal-in-your-country.jpeg new file mode 100644 index 0000000..36bcfc5 Binary files /dev/null and b/opsec/v2ray_tutorial/is-vpn-legal-in-your-country.jpeg differ diff --git a/opsec/v2ray_tutorial/test_tor.png b/opsec/v2ray_tutorial/test_tor.png new file mode 100644 index 0000000..ebb9361 Binary files /dev/null and b/opsec/v2ray_tutorial/test_tor.png differ diff --git a/opsec/v2ray_tutorial/v2ray_domain_Fronted_traffic.png b/opsec/v2ray_tutorial/v2ray_domain_Fronted_traffic.png new file mode 100644 index 0000000..454666a Binary files /dev/null and b/opsec/v2ray_tutorial/v2ray_domain_Fronted_traffic.png differ diff --git a/opsec/v2ray_tutorial/wg_limitation.png b/opsec/v2ray_tutorial/wg_limitation.png new file mode 100644 index 0000000..ff11e20 Binary files /dev/null and b/opsec/v2ray_tutorial/wg_limitation.png differ diff --git a/opsec/v2ray_tutorial/wg_official2.png b/opsec/v2ray_tutorial/wg_official2.png new file mode 100644 index 0000000..1625f29 Binary files /dev/null and b/opsec/v2ray_tutorial/wg_official2.png differ