Protocols working in Iran

[poorp]

Hi,
Can Iranians who have servers and are using VPNs, tunnels, proxies or any other tools to circumvent the current state of censorship please comment below their setups and briefly explain the config they are using? You can also add a list of pros and cons if you want so others can use this info.
I.E. :
vless+ws and without tls or xtls is working on most if not all servers and performance is not bad but some websites and apps struggle a lot or wont work at all. (correct me if you have a different experience)
pros:
easy to setup and use, very popular and relatively cheap
cons:
not really stable, some websites and apps don't work, ubuntu web-ui client is confusing, mostly in Chinese

[alirezaac]

That x-ui i just translated it weeks ago,but its no good for sake of keepin it up.for performance there is hysteria and naiveproxy quic protocol. and ffs people fucked so many vps and when i buy single vps from anywhere and boom its already black listed; so plz set it up correct and good and keep it up atleast 2 weeks, if you cant ask someone and idk pay that shit but dont blow up ips.

[poorp]

@alirezaac
Don't hysteria and naiveproxy require TLS? If so, what CDN should we use considering Cloudflare being banned?
Do you have any tutorials, install scripts or web-UIs for any of them or should we just install and config them manually?
If you are buying servers from Iranian providers, DO NOT!
If you want I can give you about a dozen foreign provider names you can buy cheap servers from. You can PM me if you want because I don't want my provider getting blasted.

[alirezaac]

There is oneclicks and there is manuals, most thing is to not falling in active probes and tls fingerprintings first, then comes cdn for insurance, if you had a websocket and it got closed well they are doing tricky things, there is delay and real delay(you can test with v2rayn) so they add another delay to find timedout error in your WS packet, and you will get blacklisted easily. so configuring manually is a priority. github don't have a PM or dm so on you leave a contact way if you mind, i really have problem with finding vps after a month things F ed up.

[poorp]

@alirezaac You can hit me up via reddit if you want: u/ThanksOk4942

[OnceUponATimeInAmerica]

TLS does not really require a CDN setup. A domain name is all that's necessary to enable TLS.

CDN setup (e.g. CF as both DNS server and proxy for your VPS-hosted proxy) is optional and is meant for additional protection of the IP of your VPS. Although most CloudFlare IPs are currently blocked from working as CDNs.

[Pink3lephant]

Well done on the fork of X-UI @alirezaac 👌

We are also building tool in our organisation to make it easier setup new servers and protocols (that actually work)
Have a look and we can collaborate on a few of them.

[poorp]

@OnceUponATimeInAmerica I knew it was that way with v2ray and I never bothered because my servers don't have much traffic. I thought it was mandatory for Hysteria and naiveproxy.

[navid1100]

Shadowsocks v2ray plugin works same as vless but your problem with specific websites is inn your client side dns route here is a solution for android users

shadowsocks/shadowsocks-android#2670
For IOS i can only help you with shadowrocket app which is not a free app because i didn’t find a free app on iOS that supports v2ray plugin so u wether need to put your global routing on proxy instead of config or manually fix your routing config
But for some apps I still experiencing some difficulties to be more specific games because they working via cellular but wont work with wifi for instance mobile legends and i still working to figure it out which i would appreciate it if anybody can help me with

[poorp]

@navid1100 that's exactly my experience too.
Thanks for the info.
For ios there is an app called "fair".

[navid1100]

Yea vless works on fair but it doesn’t support shadowsocks over v2ray plugin and another problem with fair is that there is no settings option available on it its too simple to work with and you can’t change anything on it rather than shadowsocks on android or shadowrocket on ios that come with a lot of options and logs
But back to the problem these two protocols are working well and opening all sites and common apps except for mobile legends and maybe some other games that literally works fine on cellular data but wont work on wifi that is odd and confusing

[iRhonin]

Shadowsocks v2ray plugin works same as vless but your problem with specific websites is inn your client side dns route here is a solution for android users

shadowsocks/shadowsocks-android#2670 For IOS i can only help you with shadowrocket app which is not a free app because i didn’t find a free app on iOS that supports v2ray plugin so u wether need to put your global routing on proxy instead of config or manually fix your routing config But for some apps I still experiencing some difficulties to be more specific games because they working via cellular but wont work with wifi for instance mobile legends and i still working to figure it out which i would appreciate it if anybody can help me with

For iOS try napsternetv.

[poorp]

@navid1100 well I'm using vless and I can't figure out for the life of me how to proxy all traffic including DNS. I can play CS-GO but not apex legends and blocked sites like bbc.com just don't open up.
I forwarded a port on a local server as a two-hop system and it works pretty well but it's kinda slow and sites still don't open and also the latency got worse.

[navid1100]

So are you using android or ios? And also what client are you using ?

Shadowsocks v2ray plugin works same as vless but your problem with specific websites is inn your client side dns route here is a solution for android users
shadowsocks/shadowsocks-android#2670 For IOS i can only help you with shadowrocket app which is not a free app because i didn’t find a free app on iOS that supports v2ray plugin so u wether need to put your global routing on proxy instead of config or manually fix your routing config But for some apps I still experiencing some difficulties to be more specific games because they working via cellular but wont work with wifi for instance mobile legends and i still working to figure it out which i would appreciate it if anybody can help me with

For iOS try napsternetv.

Already have it but wont work for me i guess ether it wont work with shadowsocks v2ray plugin or there is some internal config that I couldn’t find it does have v2ray import but its doesn’t mention shadowsocks in it

[poorp]

So are you using android or ios? And also what client are you using ?

v2rayNG for android, V2rayA for ubuntu and Netch for windows.

[navid1100]

Why don’t you try shadowsocks for android if it supports vless and the problem is that your client trying to route through local dns the mentioned sites are blocked on local dns so you need to put bypass all instead of bypass lan idk about those clients but if you cant find these settings on your clients its possible that your client doesn’t have this option or you can’t find it the client you mentioned for ios fair doesn’t have this issue and routes all through the proxy by default so if it exists on android that a good idea to try it

[poorp]

... idk about those clients but if you cant find these settings on your clients its possible that your client doesn’t have this option ...

My ubuntu client has a mode for forwarding dns and also a mode for fakedns and upon using them most things seem right except for speedtest.net which open but can't test the speed and sometimes it takes a long time for sites to load or I have to reload them in order for them to open. This is all related to the client tho and I will open a new issue on said client and ask them.
Also, I'm sorry but I couldn't connect with the shadowsocks android app and the v2ray plugin to my vless server and at this point I just give up and will proceed to stay in bed and be depressed and cry for now (jk (or am I?)).

[alirezaac]

Yea vless works on fair but it doesn’t support shadowsocks over v2ray plugin and another problem with fair is that there is no settings option available on it its too simple to work with and you can’t change anything on it rather than shadowsocks on android or shadowrocket on ios that come with a lot of options and logs But back to the problem these two protocols are working well and opening all sites and common apps except for mobile legends and maybe some other games that literally works fine on cellular data but wont work on wifi that is odd and confusing

Well your correct mate; they keep dns poisoning the DSL networks so vless or vmess works only on your supposed websites. for ios i guess ADGAURD DNS have such option. for windows im now using yoga dns.
this is something at gateway lvl, the more they keep it the more devices become unusable. its not the cost benefit they can keep up with😁

[alirezaac]

Shadowsocks v2ray plugin works same as vless but your problem with specific websites is inn your client side dns route here is a solution for android users
shadowsocks/shadowsocks-android#2670 For IOS i can only help you with shadowrocket app which is not a free app because i didn’t find a free app on iOS that supports v2ray plugin so u wether need to put your global routing on proxy instead of config or manually fix your routing config But for some apps I still experiencing some difficulties to be more specific games because they working via cellular but wont work with wifi for instance mobile legends and i still working to figure it out which i would appreciate it if anybody can help me with

For iOS try napsternetv.
for wifi i am investigating, and things i can confirm that they are forcing tls version to lower, dns poisoning

... idk about those clients but if you cant find these settings on your clients its possible that your client doesn’t have this option ...

My ubuntu client has a mode for forwarding dns and also a mode for fakedns and upon using them most things seem right except for speedtest.net which open but can't test the speed and sometimes it takes a long time for sites to load or I have to reload them in order for them to open. This is all related to the client tho and I will open a new issue on said client and ask them. Also, I'm sorry but I couldn't connect with the shadowsocks android app and the v2ray plugin to my vless server and at this point I just give up and will proceed to stay in bed and be depressed and cry for now (jk (or am I?)).

If you can keep working with adgaurd dns and your fair vless so let me know the result.

[navid1100]

Thanks for reply
But so you know there are 2 separate issues here which i gonna list:

1. dns leak on client side which i took care of but our guy poorp cant since his/her client is different and he don’t know how to do it or it’s client doesn’t have the option in his position he can try you method too
2. After fixing dns leak by routing all through your proxy server there is a problem with some games any maybe some other app who knows for now my only problem is games which are hard to look up to since i have fewer logs to look up to the only thing i can tell is its not about the dns leak and routing since i already using shadowrocket and fixed that and it works fine on mobile data but if i connect to a wifi router it won’t work (both DSL and 4/5G outdoor technology called zitel) but irancell 4G works through mobile data

[alirezaac]

Thanks for reply But so you know there are 2 separate issues here which i gonna list:

1. dns leak on client side which i took care of but our guy poorp cant since his/her client is different and he don’t know how to do it or it’s client doesn’t have the option in his position he can try you method too
2. After fixing dns leak by routing all through your proxy server there is a problem with some games any maybe some other app who knows for now my only problem is games which are hard to look up to since i have fewer logs to look up to the only thing i can tell is its not about the dns leak and routing since i already using shadowrocket and fixed that and it works fine on mobile data but if i connect to a wifi router it won’t work (both DSL and 4/5G outdoor technology called zitel) but irancell 4G works through mobile data

Excatly, and no one noticed it cause the ASIS settings are set for chinese dns. so we need to find good DOH and dnscrypt for this region first, the problem with games is NAT TYPE and additional delay they are puting in packets in search of WS connections. for the Nat type use nat type testers, likely its 4 and games dont like that. You can go for Hysteria and quic things, hystera have better ip mapping and better performance for gaming. but carefull using udp on some vps services. they have weird rules. the delay problem still exist and make long polling and WS poor performance(maybe self host some dns and test).

[navid1100]

Thanks for reply and link it was quite useful and i wished i had it since the beginning but what i don’t understand is that why on earth irancell mobile data works fine and wifi doesn’t also when i first realized that i need to configure shadowsucks on my vps as soon as i got it done and tested it was ok and i could join the game at the beginning i mean the ping was high but since it connected successfully and it was a canada server everything was fine I mean it worked so what did change?

[alirezaac]

I don't use irancell full time but i noticed they are adding delay, in terms of nat type its ip mapping and they might change it, and whenever you add a layer on it it change, the projects like hysteria helps you map it correct so it seems you didn't change anything.(i suspect nat because fifa had same problem in iran) so on the other side it is good to have other new protocols too so we can have more adoptions on the total bandwidth. so first easy thing is now is to check your NAT(netchx client has one it shows on bottom left). so its better have quic protocol project running for gaming(running dota 2 on Hysteria better ping than normal connection)
its more like blood type
1.Open NAT: If you have Open NAT, it means you’re able to communicate with other people, easily join and host multiplayer games with anyone regardless of their NAT type.
2. Moderate NAT: A Moderate NAT type means you’re able to communicate and join multiplayer games with a few people. However, you won’t be able to hear or play with some players.
3. Strict NAT: A Strict NAT type means you’re only able to communicate and play multiplayer games with those online players who have an Open NAT type.
some might say this is not important but it is Video calls can be affected too.

[navid1100]

Yea i can see but still can’t figure why old fashion vpns didn’t need that and also is whatsapp call problem also caused by nat problem??

[navid1100]

I don't use irancell full time but i noticed they are adding delay, in terms of nat type its ip mapping and they might change it, and whenever you add a layer on it it change, the projects like hysteria helps you map it correct so it seems you didn't change anything.(i suspect nat because fifa had same problem in iran) so on the other side it is good to have other new protocols too so we can have more adoptions on the total bandwidth. so first easy thing is now is to check your NAT(netchx client has one it shows on bottom left). so its better have quic protocol project running for gaming(running dota 2 on Hysteria better ping than normal connection)
its more like blood type
1.Open NAT: If you have Open NAT, it means you’re able to communicate with other people, easily join and host multiplayer games with anyone regardless of their NAT type.
2. Moderate NAT: A Moderate NAT type means you’re able to communicate and join multiplayer games with a few people. However, you won’t be able to hear or play with some players.
3. Strict NAT: A Strict NAT type means you’re only able to communicate and play multiplayer games with those online players who have an Open NAT type.
some might say this is not important but it is Video calls can be affected too.

I mean i just remembered that none of my vpn connections couldn’t establish a call on whatsapp neither voice call nor video call ..it does go on ringing but as soon as other side answering the call it goes on connecting and fail

[alirezaac]

I don't use irancell full time but i noticed they are adding delay, in terms of nat type its ip mapping and they might change it, and whenever you add a layer on it it change, the projects like hysteria helps you map it correct so it seems you didn't change anything.(i suspect nat because fifa had same problem in iran) so on the other side it is good to have other new protocols too so we can have more adoptions on the total bandwidth. so first easy thing is now is to check your NAT(netchx client has one it shows on bottom left). so its better have quic protocol project running for gaming(running dota 2 on Hysteria better ping than normal connection)
its more like blood type
1.Open NAT: If you have Open NAT, it means you’re able to communicate with other people, easily join and host multiplayer games with anyone regardless of their NAT type.
2. Moderate NAT: A Moderate NAT type means you’re able to communicate and join multiplayer games with a few people. However, you won’t be able to hear or play with some players.
3. Strict NAT: A Strict NAT type means you’re only able to communicate and play multiplayer games with those online players who have an Open NAT type.
some might say this is not important but it is Video calls can be affected too.

I mean i just remembered that none of my vpn connections couldn’t establish a call on whatsapp neither voice call nor video call ..it does go on ringing but as soon as other side answering the call it goes on connecting and fail

Because i'm acting like a website that stores my backups(the lie to fuck DPI) and the website tries to call my friend through whatsapp(the truth😁) that's the logic behind it, and it can be done if the application's design works in this circumstance.

[alirezaac]

and remember no matter what server you run(xray v2fly what ever) run the fake website because its gonna be checked for traffic.
its better to have it than not, you supposed to be website not the sneaky traffic.

[navid1100]

About that i was considering to run a actual website instead of a fake one if it gonna help (a useless one ofc) but back to the last question I didn’t get it really what was the answer is it a nat problem or not i mean can i fix it by fixing nat ?? I mean i got tge logic but not the answer

[navid1100]

Imo connecting fine so as insta call and telegram but whatsapp doesn’t like the easy way..😅

[Hodelian]

@Hodelian try using netch in bypass lan mode or nekoray or clash for windows. @cross-hello many apps don't have a proxy settings like most games.

Hi. nekoray and clash didn't support this protocol https://github.com/seakfind/examples/tree/main/VLESS-TCP-XTLS-Vision

[poorp]

@Hodelian I used vless with nekoray on ubuntu. You can also use vmess which I think is pretty similar to vless.

[Robolandio]

So VLESS+WS is working on LTE and barely on irancel but hamrah aval doesn't work at all, mokhaberat is also really struggling to work, anyone has any workaround? I also see people using shadowsocks SSR and openvpn. anyone has a working config for theses?

[poorp]

@Robolandio I don't think openVPN works with any config on it's own and you probably have to use stunnel and even that could be lossy.
I don't have any info on SSR.
If you get any of these working please let us know or contact me.

[seakfind]

@Robolandio OpenVPN can work with any SOCKS proxy just by adding a line to the client .ovpn file:

socks-proxy 127.0.0.1 1080

But I understand that the Shadowsocks protocol itself may be blocked in Iran, so this solution may not work as is.

Has anyone tried the modified Shadowsocks described by @gfw-report in #136?

[poorp]

Has anyone tried the modified Shadowsocks described by @gfw-report in #136?

I just tried that right now and it didn't work.

[mehdifirefox]

دوستان شایعاتی رو انانیموس مطرح کرده که اینترنت طبقاتی قراره این هفته اجرا بشه

کلا از بیخ قطع میشه اینترنت بعضی ها vpn بهشون داده میشه برای اتصال به اینترنت

نظرتون چیه

---

Friends have raised rumors that the class internet is going to be implemented this week

It is completely cut off from the Internet.

What do you think

[poorp]

@mehdifirefox
احتمال واقعیت داشتنش بالاست چون طرحش از قبل آماده بوده و منتظر اجرا و اخیرا هم خیلی بهش پرداختن. اونجوری خیلی مشکلات جدیدی میتونه به وجود بیاد و خیلی چیزایی که الآن کار میکنه از کار بیفته.

---

The probability of having a reality is high because his plan is already ready and waited for the performance and recently heavily addressed. So there are so many new problems and many things that are working now.

[mehdifirefox]

@mehdifirefoxاحتمال واقعیت داشتنش بالاست چون طرحش از قبل آماده بوده و منتظر اجرا و اخیرا هم خیلی بهش پرداختن. اونجوری خیلی مشکلات جدیدی میتونه به وجود بیاد و خیلی چیزایی که الآن کار میکنه از کار بیفته.

مبناشون اون ویدیو و مقاله ایه که لو رفت از دیتابیس مصادیق مجرمانه
حالا سوال اینجاس اختلال ایجاد نمیشه تو کسبو کار ها و سایت ها
مثلا امروز گوگل دیسکاور رفع فیلتر شد
من فک نمیکنم ایران یه همچین حرکت جدیدی بزنه . حداقل اول باید چین این کارو میکرد

---

They are based on that video and article that went from the criminal database
Now the question is not a disruption to business and sites
For example, today Google Discovery Filter Fixed
I don't think Iran is making such a new move. At least first China should do it

[poorp]

@mehdifirefox
اختلال که صد درصد ایجاد میکنه ولی اینا براشون مهمه به نظرت؟
این که دارن یه سری محدودیتارو بر میدارن هم خودش اثباتیه برای همین موضوع طبقاتی به نظرم.
درباره شباهت بین ایران و چین هم به نظر من خیلی اغراق شده و تکنولوژی هاشون شباهت زیادی ندارن‌. سیستم چین خیلی حرفه ای تر و علمی تره ولی اینا فقط بلدن از بیخ و بن قطع کنن.
اینم به بحث ربطی نداره ولی به نظر من راهکار اساسی فقط پس گرفتن حق و حقوقمون از راه و روش اصلیشه که جاش جای دیگست.

---

The disorder that causes 100 %, but is it important for them?
That they have some restrictions on my own, so I think of this class.
As for the similarity between Iran and China, I think they are very exaggerated and their technologies are not very similar. The Chinese system is much more professional and scientific, but they just have to cut off.
It has nothing to do with the discussion, but in my opinion, the basic solution is just to recover our rights through the way of the original way.

[EDK-Rise]

@mehdifirefox احتمال واقعیت داشتنش بالاست چون طرحش از قبل آماده بوده و منتظر اجرا و اخیرا هم خیلی بهش پرداختن. اونجوری خیلی مشکلات جدیدی میتونه به وجود بیاد و خیلی چیزایی که الآن کار میکنه از کار بیفته.

مبناشون اون ویدیو و مقاله ایه که لو رفت از دیتابیس مصادیق مجرمانه
حالا سوال اینجاس اختلال ایجاد نمیشه تو کسبو کار ها و سایت ها
مثلا امروز گوگل دیسکاور رفع فیلتر شد
من فک نمیکنم ایران یه همچین حرکت جدیدی بزنه . حداقل اول باید چین این کارو میکرد

تو چین دقیقا اینترنت طبقاتی هستش.

---

It is exactly the class internet in China.

[wkrp]

Has anyone tried the modified Shadowsocks described by @gfw-report in #136?

I just tried that right now and it didn't work.

There is also the new, experimental prefix parameter in the Outline client to try:

• feat: salt prefix support Jigsaw-Code/outline-apps#1454
• https://github.com/Jigsaw-Code/outline-client/raw/c4775ecc92999edc5841f02ce4ba35f7c8f61f1a/app-debug.apk

To use this feature with ss:// Access Keys, add a URL parameter like &prefix=... to the ss:// URL's query parameters, so that the URL looks like .../?outline=1&prefix=OUTLINE#Name-of-the-server. You must use the encodeURIComponent() function to convert your prefix into escaped form suitable for inclusion in a URL.

Reportedly, prefixes of "POST " and "HTTP/1.1" are effective in some ISPs in Iran.

[Hadi-1624]

I'm sure most of you have noticed, in some areas the UDP protocol has begun functioning again. this makes wireguard connection possible.
Has anyone got any ideas on what is happening?

[mehdifirefox]

با توجه به اینکه دقیقا تو شروع اعتراضات این کارو کردن من میگم دارن تست انجام میدن Machine translation added by @wkrp: Given that exactly you start the protests I say they are doing tests

[poorp]

@Hadi-1624 I hadn't noticed this before and I just now checked it and it works on home connections but not on mobile.
It can be due to their own needs or some testing for further restriction like @mehdifirefox says and it can also be temporary but I hope it's not.
Also openvpn is working.

[poorp]

@Hadi-1624 they could also be lifting restriction to let VPNs work in order to spread some important news that they want to go viral like something horrible that they are going to do or some other news.
It could also be the result of a person or a group of engineers working in the government deciding enough is enough and letting people have a half-free internet.
It could also very well be due to the sanctions imposed on some of their tech companies.
The possibilities and speculations are endless.

[Hadi-1624]

I'm connecting with vless and trojan protocols, on v2rayNG and Clash.meta clients on windows.
There are massive ping fluctuations every 3 or 4 minutes or so.
If i'm on discord, my ping reaches up to 6000 MS for example.
Are there any workarounds to solve this?
This makes proxy over openvpn impossible; As soon as the ping fluctuation happens, openvpn drops the connection completely

[poorp]

@Hadi-1624 if you have a server in Iran, maybe try to forward it's ports corresponding to your trojan/vless ports via iptables and see if that helps.

[Hadi-1624]

I have done the followingthings, and still when i join a discord voice chat, every 3 to 5 minutes, thevoice channel ping goes up to 5000 ms. I am able to hear everyone, but noone is able to hear me.

1. I am forwarding my connection through an iranian server
2. I have enabled tcp bbr congestion

does anyone have any ideas how i can fix this?
If i use a vpn, i don't have this problem with discord, but with xray proxy, i do.

[alirezaac]

V stuff starting to go dark on port 443(irancell, mokhaberat, MCI) today, naive is fine on, if it's working on that port for you, i will be happy to hear it.

[mehdifirefox]

دوستان چه خبر

این v2rayng رو بعضی سرورها کلا از کار افتاده . با sagernet کار میکنم

Any updates, friends?

This v2rayng is completely disabled on some servers. I work with sagernet

[hiddify-com]

Please checkout our repository.
We have prepared a one click setup multi protocol proxy in port 443.
https://github.com/hiddify/hiddify-config

It will help you to easily setup a new server

[mehdifirefox]

از دیشب خیلی اوضاع خرابه
داستان چیه هی قطع وصل میشه
خب یا باید وصل باشه یا قطع دیگه

هی باید utls رو تغییر بدیم

The situation is terrible since last night
What's happening? it keeps getting disconnect and reconnected
well, it should be either connected or disconnected

We should change utls constantly

[randomhf398pdhg3]

@mehdifirefox trueee, did u find a stable solution? Can we talk in tg/discord?

[pooriya5]

سلام من برنامه نویس نیستم و فقط احتیاج دارم که تو محیط گیت هاپ کسی باشه که کمک کنه برای معرفی کانفیگ های رایگان وکلیدهای رایگان اوت لاین چوب تو ری ولز این قبیل ....متشکرم از کسانی که میتونن وکمک میکنن

Hi, I'm not a programmer and I only need someone on Github to help introduce free Outline configs and keys چوب تو ری ولز etc... I thank those who can and help.

Translator note: I couldn't understand what they mean by چوب تو ری ولز