how to use/set Obfuscation and ObfuscationMask

[shakibamoshiri]

Anyone has used these two options for OpenVPN (5.X dev version) ?

• Obfuscation
• ObfuscationMask

vpncmd help

Obfuscation                 |Boolean                |False              |This may help an OpenVPN client bypass firewalls that are aware of the protocol and block it. The same XOR mask has to be applied client-side, otherwise it will not be able to connect with certain obfuscation methods!
ObfuscationMask             |String                 |                                 |Mask used to XOR the bytes in the packet (used for certain obfuscation modes).

Server and client file should be configured correctly.
If you used please guide on how to use "obfs" with OpenVPN

Regards

[shakibamoshiri]

@Evengard the question has been asked on vpnusers forum and had no answer, that is why asked here.

please inform why the question is being closed ? and where can I get answer for this question ?
Thanks

[Evengard]

I wonder why you tagged me explicitely, I'm not using OpenVPN tbh. I know kinda more about the PPP stack =)
I can make an educated guess that you'd need this patch: https://tunnelblick.net/cOpenvpn_xorpatch.html - and then use scramble xor_string with the same xor_string value you passed to the ObfuscationMask command.

[chipitsine]

let's keep it open (for better documentation)

[shakibamoshiri]

@Evengard
First according to the vpncmd help I tested and did not work
second I searched and could not find a document, real sample of using these two options
Third asked on the forum and the question had no answer
Fourth I asked here and Github showed me you (usernaem: Evengard) has closed the question

Evengard Closed as resolved 1d

Thus I was wondering why you closed it and I thought it might be an unrelated question or might violated the repo policies so asked:

where can I get answer for this question ?

I did not ask and mean to mention you for answering it, it was just about where should I ask it?

To me it was like "downvote" on stake-overflow, you get a downvote and no comment tells why (mostly when stupid questions are asked)

[Evengard]

Wait, it's marked that I closed it? Sorry, I never even knew! It was probably a missclick.

[shakibamoshiri]

Wait, it's marked that I closed it? Sorry, I never even knew! It was probably a missclick.

github here

and email

it is okay , no problem

[shakibamoshiri]

@chipitsine good day,
I was able to make it work with a non-official OpenVPN client. It bypasses while normal one does not.
But two questions arise (or concerns)

1. Why this feature has not been documented (maybe it is simple and obvious!)

and more importantly
2. Is this quote true from OpenVPN developers claimed Critical Warning

Do not take this advice! The obfuscation provided by this patch appears to be extremely rudimentary. Beware of cryptographic advice from amateur cryptographers!

Large organizations have the ability and power to "unscramble" traffic and detect it as OpenVPN traffic, and the obfuscation provided by this patch is so rudimentary that relatively simple cryptanalysis will probably be able to unscramble the content, too.

[chipitsine]

it is not simple. it even work with autodetection, which is not obvious. we would appreciate documentation update.

as for note from OpenVPN developers, they suggest "tls-crypt-v2" as an arbitrary transport level obfuscation. also, "xor" patch is poorly supported by openvpn clients (some support, other do not)

[shakibamoshiri]

Okay.
it is around few days I have been focusing on SE ovpn and need more time to be able to write documents with "confident".
please do not close the issue and keep it open so I can have a source to refer back to this topic for further questions or updates
Thank you