Setup Example Needed for Tunneling Between Servers with DPIMyAss

[slavashvets]

First off, thanks for this fantastic tool. I'm trying to establish a reliable UDP tunnel between two of my servers located in different geographic regions (Russia and Finland), which are part of my Tailscale network. The traffic from the server in Russia is subjected to DPI, causing a noticeable degradation in speed. I want to use DPIMyAss to bypass these restrictions by tunneling the traffic.

I'm a bit stuck on setting this up correctly and would really appreciate if someone could provide a detailed example, including:

• Configuration File for Server 1 (Russia): What settings would be optimal considering the DPI?
• IPTables Rules for Server 1: Necessary rules to route traffic through the proxy.
• Configuration File for Server 2 (Finland): Recommended configuration to receive and forward traffic effectively.
• IPTables Rules for Server 2: Ensuring the traffic from Server 1 is accepted and routed correctly.

Thank you in advance for your time and help!

[mrsobakin]

Hello! Unfortunately I don't have much experience with Tailscale, but as far as I understand, you can't use DPIMyAss with it. DPIMyAss is a userland tool, and thus it can't intercept and inspect packets. It relies on you statically setting endpoint server ip and manually changing your wireguard config. Tailscale, on the other hand, assigns endpoints dynamically via its control server.

But it doesn't mean that you have to be stuck with slow speeds and DPI. Assuming that your tailscale nodes are running on linux, and that you have access to iptables on them, you can use kernel-space iptables extensions to obfuscate wireguard traffic (actually they will also be faster than DPIMyAss).

I recommend you looking into these two solutions:

• faicker/ipt_xor (or my fork of it, which is compatible with DPIMyAss): Simple iptables extension that XORs packets just like DPIMyAss.
• infinet/xt_wgobfs (or my fork of it, which has some additional settings): An iptables extension made specifically for obfuscating wireguard packets. It is faster and can bypass more complex DPIs than XOR.

I'm not sure that you can differentiate which packets are sent to which node, so you may to need to obfuscate connections between all nodes in your tailscale network. The ports used by tailscale are listed here. I assume that you can setup iptables to unobfuscate packets incoming to wireguard ports, and obfuscate packets outcoming from wireguard ports. You can check out ports that wireguard uses with wg command, after the tunnels are established.

Good luck!