OpenVPN/openvpn — pull request #7 by russlank (2013-08-09 22:16:58+00:00)
Title: Bypass DPI

Hi

As some ISP(s) rely on Deep Packet Inspection (DPI) to identify various VPN traffic, and to block them, I have added small feature, called “bypass-dpi”. This new feature mainly gives OpenVPN the ability to masquerade the protocol by sending arbitrary, meaningless, initial packet that confuses the DPI mechanism and allow consequent valid packets to pass through without identifying the protocol.
As the DPI build a context for each newly established connection, depending on examining known protocols’ signatures, at very early stage of connection establishment, sending such a packet makes DPI blind, and makes it classify the protocol as unknown.
Mainly, currently implemented method works with specific OpenVPN configuration:
- UDP protocol is in use.
- TLS-AUTH is in use; this will enable the server to drop the arbitrary packet, which means that the support for the feature is needed on the client side only.
I have modified the code to include the behavior, and activating it using “--bypass-dpi” option.

Russlan