-
Notifications
You must be signed in to change notification settings - Fork 85
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Cloak Not Working In Iran #24
Comments
Oh dammit i forgot to upgrade the FAQ. |
Also keep in mind that few days ago, Iran changed some of their censorship techniques. For instance, most of the time, the MTProto Fake TLS does not work anymore. Maybe cloak have faced the same issue. Although I can run and connect to both MTProto proxy and Cloak on my own server. |
The
Thank you. I had shdowsocks and mtproto (installed with your script) same time in this server. Since a few days ago mtproto not connect. But shadowsocks connection is OK. Today I decide to remove all proxy services and install only shadowsocks with cloak. |
Is there any errors in the log? And what's your client OS? |
OS is Ubuntu 18.04 (64bit) |
Ok, what is your client os? (android,windows,macos) |
Windows and Android |
Unfortunately, I do not have much ideas left but the simple ones. Like:
|
We had a small chat in Telegram and found out that the Iran firewall is actively blocking the cloak connection. Somehow, the firewall validates the tls packets and drops them if they are invalid. This also blocks the Fake-TLS protocol in MTProto proxy. |
Thanks for the update. This is sad. Just out of curiosity, technically how does the Iran firewall find out it's Cloak not regular HTTPS requests? |
@Abdipour If Iran's firewall is indeed able to differentiate between Cloak and real HTTPS, you can try simple-tls. This encrypts your SS traffic with real TLS1.3, so theoretically there's no way to differentiate, or at least it becomes very difficult. |
Do don't have a single clue. But somehow both fake-tls mode in MTproto proxy and cloak are blocked on-the-fly. (So probably the simple-obfs does not work as well)
Yes, I've also seen it but I haven't tested it. Is the speed and stability good? |
When you use fake TLS, technically the certificate validation would work but ultimately the key exchange would fail since the “fake” server doesn’t have the private key.
Thanks for your advise. For now using another plugin with real TLS and behind CDN. |
Software stability is flawless. |
Cool, thanks! |
I experienced something today that was interesting.
(Note that there was no But I found a really easy way to fix this: I just changed the browser signature from Chrome to Firefox and it started to work.
I checked the history of Cloak's code that mimics the Chrome and it looks like that it have not been updated in a while (more than a year and also the other commits are just refactoring code). If that is the case and the Chrome's client hello signature has been changed, maybe Cloak needs to update the Chrome (and maybe Firefox) signatures. Edit: I found out that my server is whitelisted |
Great find and hope with the new signature update, it will works. TQ. |
Hi.
I run cloak2 script without any error. But can't connect to server.
Base of FAQ I tried to check
shadowsocks-server
is running, got this error:Unit shadowsocks-server.service could not be found.
Packages in
/lib/systemd/system/
, there are several service files related to ss-libev:In ReadMe:
Can you help where is the problem and how to solve this issue?
The text was updated successfully, but these errors were encountered: