Iran's regime seems to have fully blocked WireGuard

[poorp]

Hi,
WireGuard seems to be completely banned in Iran. No handshake is happening with servers outside the country.
I've heard about swgp-go but I don't know how to set it up. Can someone help us with this? Can clients on different OSs run swgp-go? If not, We have to run Wireguard with swgp-go from a VPS outside the country to a VPS inside it on Linux and use the second VPS (the one inside the country) to give clients access:
Clients ---normal WG---> Server1 (inside Iran) ---swgp-go WG---> server2 (outside Iran)
How could one configure such a setup?
I'm a beginner and therefore I'm not very educated about networking, proxies, routing, ... so please give me simple instructions and clear help on the configs needed if possible.
Thanks in advance.

[alirezaac]

all ssh type can be detected easily with the old DPI. use something that can be hard to monitor like naive proxy

it's a protocol that screams "I'm a VPN", with no stealth or obfuscation.

[poorp]

all ssh type can be detected easily with the old DPI. use something that can be hard to monitor like naive proxy

I don't think the mullahs are advanced enough yet to use DPI, I think they are just blocking protocols and my only goal is to somehow circumvent the blockage. Even if they find and ban my connection IDC because I use cheap burner VPSs on a monthly or even daily subscription.
Proxies with high obfuscation usually have 2 problems:

1. low performance
2. low versatility

[poorp]

it's a protocol that screams "I'm a VPN", with no stealth or obfuscation.

That's exactly the point of swgp-go. It hides the parts of the packets that are obvious and leaves other parts as they are and in this way produces minimal overhead from what I've read on their GitHub page.
The only problem is I'm a beginner and don't know how to set it up and there seems to be no tutorial anywhere for it.

[HirbodBehnam]

Someone told me 2 days ago that Iran started blocking nearly all udp connections. I tested this hypothesis by simply using nc -u to connect to my server and I couldn't even send a single message.
Can anyone check if UDP packets can reach to their servers from Iran?

[wkrp]

Can anyone check if UDP packets can reach to their servers from Iran?

I just now (2022-10-18 07:20:38 UTC) redid the DNS resolver scan from #125 (comment). (Scanning DNS resolvers in Iran from outside Iran.) I got responses from some resolvers in Iran, so UDP packets to at least those networks are not blocked.

$ while IFS=, read -r resolver_ip _ resolver_asn _; do echo -n "$resolver_asn $resolver_ip "; dig +short +time=1 +tries=1 @$resolver_ip unique-$RANDOM.example.com && echo NXDOMAIN; done < <(cat ir.csv | sort -g) | sort -g
6736 194.225.73.141 NXDOMAIN
12880 217.218.127.127 NXDOMAIN
15611 213.176.123.5 NXDOMAIN
43754 37.156.145.21 ;; connection timed out; no servers could be reached
43754 37.156.145.229 ;; connection timed out; no servers could be reached
43965 194.225.62.80 ;; connection timed out; no servers could be reached
48715 185.51.200.10 ;; connection timed out; no servers could be reached
48715 185.51.200.50 ;; connection timed out; no servers could be reached
49666 2.189.44.44 NXDOMAIN
50057 185.161.112.33 NXDOMAIN
50057 185.161.112.34 ;; connection timed out; no servers could be reached
56402 46.224.1.42 NXDOMAIN
56402 46.224.1.43 NXDOMAIN
56547 31.24.234.37 NXDOMAIN
58224 80.191.40.41 ;; connection timed out; no servers could be reached
58303 81.163.3.1 ;; connection timed out; no servers could be reached
60627 185.113.59.253 ;; connection timed out; no servers could be reached
60976 82.99.242.155 NXDOMAIN
60976 91.99.101.12 ;; connection timed out; no servers could be reached
202468 185.231.182.126 ;; connection timed out; no servers could be reached
202468 185.97.117.187 ;; connection timed out; no servers could be reached
209596 91.245.229.1 ;; connection timed out; no servers could be reached
212907 185.187.84.15 ;; connection timed out; no servers could be reached

ir.csv

194.225.73.141,,6736,
217.218.127.127,,12880,
213.176.123.5,,15611,
37.156.145.21,,43754,
37.156.145.229,,43754,
194.225.62.80,,43965,
185.51.200.10,,48715,
185.51.200.50,,48715,
2.189.44.44,,49666,
185.161.112.33,,50057,
185.161.112.34,,50057,
46.224.1.42,,56402,
46.224.1.43,,56402,
31.24.234.37,,56547,
80.191.40.41,,58224,
81.163.3.1,,58303,
185.113.59.253,,60627,
82.99.242.155,,60976,
91.99.101.12,,60976,
185.231.182.126,,202468,
185.97.117.187,,202468,
91.245.229.1,,209596,
185.187.84.15,,212907,

The Snowflake bridge is still getting traffic from Iran, which is WebRTC and therefore UDP.

I was able to use the DNS tunnel from #125 (comment) from a vantage point in Iran using 194.225.73.141 as an intermediate resolver.

[database64128]

Hi, author of swgp-go here. You can run swgp-go in client mode on server 1 and in server mode on server 2. The client accepts plain WireGuard packets and forwards the obfuscated/encrypted packets to the server, where they are deobfuscated/decrypted and sent to the WireGuard service.

Server 1 (swgp-go client) config:

{
    "peers": [
        {
            "name": "domestic",
            "wgListen": "[::]:20222"
            "proxyEndpoint": "server2-ip:port",
            "proxyMode": "zero-overhead",
            "proxyPSK": "<same-format-as-wg-psk>"
            "mtu": 1500
        }
    ]
}

Your WireGuard clients can connect to server 1's port 20222.

Server 2 (swgp-go server) config:

{
    "interfaces": [
        {
            "name": "wg0",
            "proxyListen": "[::]:20220",
            "proxyMode": "zero-overhead",
            "proxyPSK": "<same-format-as-wg-psk>",
            "wgEndpoint": "[::1]:wg-port",
            "mtu": 1500
        }
    ]
}

If you have more questions, feel free to ask here or open discussions at my repo.

[poorp]

If you have more questions, feel free to ask here or open discussions at my repo.

Thanks for your help. I'm afraid I don't even know where to begin with this as I'm very uneducated about all this.
One challenge is that because there is potential blockage, there is no room for trial and error (my main method of dealing with software and life really ...) because I wouldn't know if I'm making a mistake or the FW is blocking the attempts.
This is my typical WG configuration for chains:
https://www.reddit.com/r/WireGuard/comments/xr5nnr/comment/iqhqbqc/?utm_source=share&utm_medium=web2x&context=3
Do I need to change any of these 3 confs? (client, server1, server2)
How do I install swgp-go and even run it? Which parts of the above confs you kindly shared should I change to my specific credentials or addresses?
I fully understand if this is not what you normally answer and/or don't have time for but like I said, I'm just a newbie that has nothing to do with networking or IT for that matter and I'm just trying to provide myself, my family and my friends with free access to the Internet.
Thanks again for your help and your software.

@poorp while you are waiting for @database64128's reply:

If you have access to both a domestic server and a foreign server, you might try a domestic relay to a foreign Shadowsocks server.

It would be easier to configure, and Shadowsocks can be configured to use TCP only. That avoids the potential problem of a complete block on UDP.

Also, there are complete, end-to-end, step-by-step Shadowsocks turorials all over the web.

clowwindy's outline of the Shadowsocks relay process is at https://github.com/shadowsocks/shadowsocks/wiki/Setup-a-Shadowsocks-relay

If you need a full VPN, as opposed to a proxy server, you might consider something like OpenVPN + Cloak.

[poorp]

@freejohn123 The relay thing, although it works, it really doesn't. What I mean is: I can connect to SS and ping my server and even open Instagram or Telegram and enjoy a bit of freedom until I realise I can't upload any media on Telegram and Firefox or Chrome don't work at all for some reason (?). Also, even without the domestic relay the exact same results apply and the domestic relay doesn't seem to make any difference.
Very strange.
BTW, for my ShadowSocks server I used x-ui to set it up easily via a web-ui on my server which comes with a package of x-ray core amongst other things.

[hdid]

WireGuard with obfuscation support #88

[alirezaac]

Well no matter what obfs and protocol you use, u can read chinese stuff here and learn the gfw, cause they are using it now and your traffic must look normal, so its better get less detected and make more vps available for others too. use hystera, naiveproxy or at least vless but don't use simple projects all of them have easy entropy to detect. and yes they are using GFW.

[poorp]

and yes they are using GFW.

NO THEY ARE NOT.
It is very similar but it's not the GFWoC.