Tl;Dr: Do Suricata/snort/Security onion have mechanisms to perform DPI if one provides them with a valid certificate? Any other open source software I should be looking at that can do DPI?
Background:
I have been trying to find ways to masquerade Wireguard traffic as normal HTTPS traffic to circumvent blocks by networks which do not like such traffic. It is quite easy to identify Wireguard traffic with a default setup because their method of implementing SSL is different from normal HTTPS, and most packet analysers can pick up that Wireguard traffic is passing through.
With that said, I have come across 3 methods to alleviate this problem:
(before you implement these, make sure to convert Wireguard traffic into TCP using udp2raw or updtunnel and force operations on port 443)
Use stunnel - seems to be a project that has been around for a while. Encrypts data using SSL, makes it look like HTTPS.
Use obfsproxy - created by the TOR project, can be used alongside OpenVPN.
The alternatives are mainly: use OpenVPN (which can use stunnel or obfsproxy) or Softether (which uses SSL for its VPN).
Question:
I would like to test said software in a comparison of their efficacy against firewalls employing DPI. Which is why I’m looking at FOSS which can do DPI. Does anyone do this for their network at home? This will be for private use only, I won’t be allowing any external access on my network.
Thanks!
Edit: I realise that this might not be much of a problem for a lot of people, but regardless of whether one is facing this problem or not, I believe it is important to keep abreast of such technology and engage with it to improve one’s digital privacy. There is no doubt that such networks exist, and whether one actively engages with them or not is up to the user. In fact, the question is about DPIs, so I’d like to know if anyone has any experience working with FOSS DPIs in their homelab/at work. Thanks!
I think you might get part of the way but may still find you get detected.
Foss DPI projects will not be able to implement the methods used by say fortinet,sonicwall, f5, juniper, Cisco, a10, and others.
This is because they all use proprietary DPI created in house.
They’re not going to use Foss DPI for obvious reasons, you’ll be able to create workarounds for detection and implement that in a bad payload.
Thanks. Someone mentioned using a cloud service to rent such DPIs by the hour for some processing, which might be a good idea to start with. I could get a traffic capture of some inconsequential traffic using these protocols and then upload to said services maybe. Thanks again
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
I think you might get part of the way but may still find you get detected. Foss DPI projects will not be able to implement the methods used by say fortinet,sonicwall, f5, juniper, Cisco, a10, and others. This is because they all use proprietary DPI created in house. They’re not going to use Foss DPI for obvious reasons, you’ll be able to create workarounds for detection and implement that in a bad payload.
Thanks. Someone mentioned using a cloud service to rent such DPIs by the hour for some processing, which might be a good idea to start with. I could get a traffic capture of some inconsequential traffic using these protocols and then upload to said services maybe. Thanks again