^( host (including desktop Linux, Android phone/tablet, OpenWRT router, or Raspberry PI) with root access.
- Encrypt your traffic with AES-128-CBC.
- Protect data integrity by MD5 or CRC32.
- Defense replay attack with an anti-replay window, similar to IPSec and OpenVPN.
- Authenticate mutually, no MITM attacks.
- Multiplexing One client can handle multiple UDP connections, all of which share the same raw connection.
- Multiple Clients One server can have multiple clients.
- NAT Support All of the 3 modes work in NAT environments.
- OpenVZ Support Tested on BandwagonHost.
- OpenWRT Support No dependencies, easy to build. Binary for ar71xx are included in release.
UDP QoS Bypass
UDP Blocking Bypass
OpenVPN TCP over TCP problem
OpenVPN over ICMP
UDP to ICMP tunnel
UDP to TCP tunnel
UDP over ICMP
UDP over TCP
Download binary release from ^(
Assume your UDP is blocked or being QOS-ed or just poorly supported. Assume your server ip is 220.127.116.11, you have a service listening on udp port 7777.
# Run at server side:
./udp2raw_amd64 -s -l0.0.0.0:4096 -r 127.0.0.1:7777 -a -k "passwd" --raw-mode faketcp
# Run at client side
./udp2raw_amd64 -c -l0.0.0.0:3333 -r18.104.22.168:4096 -a -k "passwd" --raw-mode faketcp
Now, an encrypted raw tunnel has been established between client and server through TCP port 4096. Connecting to UDP port 3333 at the client side is equivalent to connecting to port 7777 at the server side. No UDP traffic will be exposed.
to run on Android, see ^(
version: Aug 18 2018 00:29:11
run as client : ./this_program -c -l local_listen_ip:local_port -r server_ip:server_port [options]
run as server : ./this_program -s -l server_listen_ip:server_port -r remote_ip:remote_port [options]
common options, these options must be same on both side:
avaliable values:faketcp(default), udp, icmp
password to gen symetric key, default:"secret key"
avaliable values:aes128cbc(default), xor, none
avaliable values:md5(default), crc32, simple, none
-a, --auto-rule auto add (and delete) iptables rule
-g, --gen-rule generate iptables rule then exit
--disable-anti-replay disable anti-replay, not suggested
force source-ip for raw socket
force source-port for raw socket, tcp/udp only
this option disables port changing while re-connecting
0:never 1:fatal 2:error 3:warn
4:info (default) 5:debug 6:trace
--log-position enable file name, function name, line number in log
--disable-color disable log color
--disable-bpf disable the kernel space filter, most time its not necessary
unless you suspect there is a bug
buf size for socket, >=10 and <=10240, unit:kbyte, default:1024
seq increase mode for faketcp:
1:increase every packet
2:increase randomly, about every 3 packets (default)
send packet at OSI level 2, format:'if_name#dest_mac_adress'
-h, --help print this help message
This program sends packets via raw socket. In FakeTCP mode, ^( kernel TCP packet processing has to be blocked by a iptables rule on both sides, otherwise the kernel will automatically send RST for an unrecongized TCP packet and you will sustain from stability / peformance problems. You can use
-a option to let the program automatically add / delete iptables rule on start / exit. You can also use the
-g option to generate iptables rule and add it manually.
It is suggested to use
md5 to obtain maximum security. If you want to run the program on a router, you can try
simple, which can fool packet inspection by ^( the most of time, but it cannot protect you from serious attacks. Mode none is only for ^( purpose. It is not recommended to set the cipher-mode or auth-mode to none.
The FakeTCP mode does not behave 100% like a real tcp connection. ISPs may be able to distinguish the simulated tcp traffic from the real TCP traffic (though it’s costly). seq-mode can help you change the seq increase behavior slightly. If you experience connection problems, try to change the value.
iperf3 TCP via OpenVPN + udp2raw (iperf3 UDP mode is not used because of a bug mentioned in this issue: ^( . Instead, we package the TCP traffic into UDP by OpenVPN to test the performance. Read ^( for details.
iperf3 -c 10.222.2.1 -P40
iperf3 -c 10.222.2.1 -P40 -R
- Client Vultr $2.5/monthly plan (single core 2.4GHz cpu, 512MB RAM, Tokyo, Japan)
- Server BandwagonHost $3.99/annually plan (single core 2.0GHz cpu, 128MB RAM, Los Angeles, USA)
raw_mode: faketcp cipher_mode: xor auth_mode: simple
(reverse speed was simliar and not uploaded)
raw_mode: faketcp cipher_mode: aes128cbc auth_mode: md5
(reverse speed was simliar and not uploaded)
tunneling any traffic via raw traffic by using udp2raw +openvpn
- bypasses UDP block/UDP QOS
- no TCP ovr tcp problem (tcp over tcp problem ^( , ^( )
- openvpn over icmp also becomes a choice
more details at^(
speed-up tcp connection via raw traffic by using udp2raw+kcptun
kcptun is a tcp connection speed-up program, it speeds-up tcp connection by using kcp protocol on-top of udp.by using udp2raw, you can use kcptun while udp is QoSed or blocked. (kcptun, ^( )
speed-up tcp connection via raw traffic by using udp2raw+finalspeed
finalspeed is a tcp connection speed-up program similiar to kcptun, it speeds-up tcp connection by using kcp protocol on-top of udp or tcp.but its tcp mode doesnt support openvz, you can bypass this problem if you use udp2raw+finalspeed together, and icmp mode also becomes avaliable.
Easier installation on ArchLinux
yaourt -S udp2raw-tunnel # or
pacaur -S udp2raw-tunnel