{"id":53774,"date":"2019-12-10T00:00:00","date_gmt":"2019-12-09T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/sravnenie-proizvoditelnosti-instrumentov-obhoda-blokirovok-vpn"},"modified":"2020-02-18T14:01:42","modified_gmt":"2020-02-18T11:01:42","slug":"sravnenie-proizvoditelnosti-instrumentov-obhoda-blokirovok-vpn","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/sravnenie-proizvoditelnosti-instrumentov-obhoda-blokirovok-vpn","title":{"rendered":"Srovn\u00e1n\u00ed v\u00fdkonu n\u00e1stroj\u016f pro obch\u00e1zen\u00ed blokac\u00ed VPN","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

S rostouc\u00edm omezen\u00edm p\u0159\u00edstupu k r\u016fzn\u00fdm zdroj\u016fm na internetu se st\u00e1le \u010dast\u011bji d\u00e1v\u00e1 do pop\u0159ed\u00ed ot\u00e1zka, jak obch\u00e1zet blokace, a tedy i ot\u00e1zka \u201eJak rychleji obch\u00e1zet blokace?\u201c<\/p>\n

Opust\u00edme t\u00e9ma efektivity z pohledu obch\u00e1zen\u00ed DPI, whitelist\u016f a blacklist\u016f na p\u0159\u00ed\u0161t\u011b a jednodu\u0161e porovn\u00e1me v\u00fdkon popul\u00e1rn\u00edch n\u00e1stroj\u016f pro obch\u00e1zen\u00ed blokac\u00ed.<\/p>\n

Pozor: V \u010dl\u00e1nku pod spoilerem bude mnoho obr\u00e1zk\u016f.
\n<\/a><\/noindex>
\nDisklaimer: Tento \u010dl\u00e1nek porovn\u00e1v\u00e1 v\u00fdkon popul\u00e1rn\u00edch VPN a proxy \u0159e\u0161en\u00ed za podm\u00ednek bl\u00edzk\u00fdch \u201eide\u00e1ln\u00edm\u201c. V\u00fdsledky uveden\u00e9 a popsan\u00e9 zde nemus\u00ed nutn\u011b odpov\u00eddat va\u0161im v\u00fdsledk\u016fm v praxi. Proto\u017ee \u010d\u00edsla ve speedtestu \u010dasto z\u00e1vis\u00ed nejen na v\u00fdkonu obch\u00e1zej\u00edc\u00edho n\u00e1stroje, ale tak\u00e9 na tom, jak je v\u00e1\u0161 poskytovatel omezuje, QoS nebo blokuje.<\/p>\n

Metodologie<\/h3>\n

\nU cloudov\u00e9ho poskytovatele (DO) byly zakoupeny 3 VPS v r\u016fzn\u00fdch zem\u00edch sv\u011bta. 2 v Nizozemsku a 1 v N\u011bmecku. Byly vybr\u00e1ny nejv\u00fdkonn\u011bj\u0161\u00ed VPS (podle po\u010dtu jader) z dostupn\u00fdch pro \u00fa\u010det v r\u00e1mci nab\u00eddky za kuponov\u00e9 kredity. <\/p>\n

Na prvn\u00edm nizozemsk\u00e9m serveru je nasazen soukrom\u00fd iperf3 server. <\/p>\n

Na druh\u00e9m nizozemsk\u00e9m serveru se postupn\u011b nasazuj\u00ed r\u016fzn\u00e9 servery n\u00e1stroj\u016f pro obch\u00e1zen\u00ed blokac\u00ed. <\/p>\n

Na n\u011bmeck\u00e9m VPS byl nasazen obraz desktopov\u00e9ho Linuxu (Xubuntu) s VNC a virtu\u00e1ln\u00edm pracovn\u00edm stolem. Tento VPS je podm\u00edn\u011bn\u00fdm klientem a na n\u011bj se postupn\u011b instaluj\u00ed a spou\u0161t\u011bj\u00ed r\u016fzn\u00e9 proxy a VPN klienti. <\/p>\n

M\u011b\u0159en\u00ed rychlosti se prov\u00e1d\u00ed t\u0159ikr\u00e1t, zam\u011b\u0159ujeme se na pr\u016fm\u011br a pou\u017e\u00edv\u00e1me 3 n\u00e1stroje: v Chromiu prost\u0159ednictv\u00edm webov\u00e9ho speedtestu; v Chromiu prost\u0159ednictv\u00edm fast.com; z konzole p\u0159es iperf3 skrze proxy chains4 (tam, kde je pot\u0159eba nasm\u011brovat provoz iperf3 do proxy). <\/p>\n

P\u0159\u00edm\u00e9 p\u0159ipojen\u00ed \u201eklient\u201c-server iperf3 d\u00e1v\u00e1 rychlost 2 Gb\/s v iperf3 a trochu m\u00e9n\u011b ve fast speedtestu.<\/p>\n

Zv\u00eddav\u00fd \u010dten\u00e1\u0159 se m\u016f\u017ee zeptat: \u201ePro\u010d jsi nevybral speedtest-cli?\u201c a m\u00e1 pravdu. <\/p>\n

Speedtest se uk\u00e1zal jako nespolehliv\u00fd a neadekv\u00e1tn\u00ed zp\u016fsob m\u011b\u0159en\u00ed \u0161\u00ed\u0159ky p\u00e1sma z nezn\u00e1m\u00fdch d\u016fvod\u016f. T\u0159i po sob\u011b jdouc\u00ed m\u011b\u0159en\u00ed mohla p\u0159in\u00e9st t\u0159i \u00fapln\u011b odli\u0161n\u00e9 v\u00fdsledky, nebo nap\u0159\u00edklad uk\u00e1zat \u0161\u00ed\u0159ku p\u00e1sma mnohem vy\u0161\u0161\u00ed, ne\u017e jak\u00e1 odpov\u00edd\u00e1 rychlostem port\u016f m\u00fdch VPS. Mo\u017en\u00e1 je probl\u00e9m v m\u00e9 ne\u0161ikovnosti, ale zd\u00e1lo se mi nemo\u017en\u00e9 prov\u00e1d\u011bt v\u00fdzkum s t\u00edmto n\u00e1strojem.<\/p>\n

Co se t\u00fd\u010de v\u00fdsledk\u016f t\u0159\u00ed metod m\u011b\u0159en\u00ed (speedtest, fast, iperf), pova\u017euji hodnoty z iperf za nejp\u0159esn\u011bj\u0161\u00ed, nejspolehliv\u011bj\u0161\u00ed a nejautenti\u010dt\u011bj\u0161\u00ed, zat\u00edmco fast speedtest \u2014 za orienta\u010dn\u00ed. N\u011bkter\u00e9 n\u00e1stroje obchodu v\u0161ak neumo\u017enily dokon\u010dit 3 m\u011b\u0159en\u00ed pomoc\u00ed iperf3, a v takov\u00fdch p\u0159\u00edpadech se d\u00e1 orientovat na speedtest a fast.<\/p>\n

Speedtest d\u00e1v\u00e1 r\u016fzn\u00e9 v\u00fdsledky<\/b>\"Srovn\u00e1n\u00ed
\n<\/p>\n

N\u00e1stroje<\/h3>\n

\nBylo otestov\u00e1no celkem 24 r\u016fzn\u00fdch n\u00e1stroj\u016f obchodu a\/nebo jejich kombinac\u00ed, k nim\u017e poskytnu mal\u00e9 vysv\u011btlen\u00ed a sv\u00e9 dojmy z jejich pou\u017eit\u00ed. Podstatou bylo porovnat rychlosti shadowsocks (a mno\u017estv\u00ed r\u016fzn\u00fdch obfuska\u010dn\u00edch n\u00e1stroj\u016f k tomu) s openVPN a wireguard.<\/p>\n

V tomto materi\u00e1lu se nebudu detailn\u011b v\u011bnovat ot\u00e1zce \u201ejak l\u00e9pe skr\u00fdt provoz, aby m\u011b neodpojili\u201c, proto\u017ee obch\u00e1zen\u00ed blokac\u00ed je reak\u010dn\u00ed opat\u0159en\u00ed \u2014 p\u0159izp\u016fsobujeme se tomu, co vyu\u017e\u00edv\u00e1 cenzor, a jedn\u00e1me podle toho.<\/p>\n

V\u00fdsledky<\/h3>\n

<\/p>\n

Strongswanipsec<\/h4>\n

\nPodle m\u00fdch dojm\u016f \u2014 velmi snadn\u00e9 na nastaven\u00ed, pracuje dostate\u010dn\u011b stabiln\u011b. Mezi v\u00fdhody pat\u0159\u00ed, \u017ee je skute\u010dn\u011b multiplatformn\u00ed, ani\u017e bych musel hledat klienty pro ka\u017edou platformu.<\/p>\n

stahov\u00e1n\u00ed \u2014 993 mbits; nahr\u00e1v\u00e1n\u00ed \u2014 770 mbits<\/b>\"Srovn\u00e1n\u00ed
\n<\/p>\n

SSH-tunel<\/h4>\n

\nO pou\u017e\u00edv\u00e1n\u00ed SSH jako n\u00e1stroje pro tunelov\u00e1n\u00ed u\u017e pravd\u011bpodobn\u011b psal jen l\u00edn\u00fd. Mezi nev\u00fdhody pat\u0159\u00ed \u201ek\u0159ehkost\u201c \u0159e\u0161en\u00ed, tzn. nen\u00ed mo\u017en\u00e9 ho zprovoznit z pohodln\u00e9ho kr\u00e1sn\u00e9ho klienta na ka\u017ed\u00e9 platform\u011b. V\u00fdhody: dobr\u00fd v\u00fdkon, nen\u00ed t\u0159eba na serveru v\u016fbec nic instalovat.<\/p>\n

stahov\u00e1n\u00ed \u2014 1270 mbits; nahr\u00e1v\u00e1n\u00ed \u2014 1140 mbits<\/b>\"Srovn\u00e1n\u00ed<\/p>\n

OpenVPN<\/h4>\n

\nOpenVPN byl testov\u00e1n ve 4 re\u017eimech: tcp, tcp+sslh, tcp+stunnel, udp.<\/p>\n

Servery OpenVPN byly automaticky nastaveny pomoc\u00ed instalace streisand.<\/p>\n

Jak lze usoudit, v sou\u010dasn\u00e9 dob\u011b je odoln\u00fd pouze re\u017eim pr\u00e1ce p\u0159es Stunnel v\u016f\u010di pokro\u010dil\u00fdm DPI. D\u016fvod neobvykl\u00e9ho zv\u00fd\u0161en\u00ed propustnosti p\u0159i zabalov\u00e1n\u00ed OpenVPN-TCP do Stunnelu mi nen\u00ed jasn\u00fd, testy prob\u00edhaly v n\u011bkolika etap\u00e1ch, v r\u016fzn\u00fdch \u010dasech a dnech, v\u00fdsledek byl stejn\u00fd. Mo\u017en\u00e1 to souvis\u00ed s nastaven\u00edm s\u00ed\u0165ov\u00e9ho z\u00e1sobn\u00edku, kter\u00e9 se nastavuj\u00ed p\u0159i nasazov\u00e1n\u00ed Streisand, dejte v\u011bd\u011bt, pokud m\u00e1te n\u00e1pady, pro\u010d to tak je.<\/p>\n

openvpntcp: stahov\u00e1n\u00ed \u2014 760 mbits; nahr\u00e1v\u00e1n\u00ed \u2014 659 mbits<\/b>\"Srovn\u00e1n\u00ed
\n
\nopenvpntcp+sslh: stahov\u00e1n\u00ed \u2014 794 mbits; nahr\u00e1v\u00e1n\u00ed \u2014 693 mbits<\/b>\"Srovn\u00e1n\u00ed
\n
\nopenvpntcp+stunnel: stahov\u00e1n\u00ed \u2014 619 mbits; nahr\u00e1v\u00e1n\u00ed \u2014 943 mbits<\/b>\"Srovn\u00e1n\u00ed
\n
\nopenvpnudp: stahov\u00e1n\u00ed \u2014 756 mbits; nahr\u00e1v\u00e1n\u00ed \u2014 580 mbits<\/b>\"Srovn\u00e1n\u00ed
\n<\/p>\n

Openconnect<\/h4>\n

\nNejpopul\u00e1rn\u011bj\u0161\u00ed n\u00e1stroj pro obch\u00e1zen\u00ed blokac\u00ed, sou\u010d\u00e1st bal\u00ed\u010dku Streisand, tak\u017ee bylo rozhodnuto jej tak\u00e9 otestovat.<\/p>\n

stahov\u00e1n\u00ed \u2014 895 mbits; nahr\u00e1v\u00e1n\u00ed 715 mbits<\/b>\"Srovn\u00e1n\u00ed
\n<\/p>\n

Wireguard<\/h4>\n

\nHype n\u00e1stroj, velmi popul\u00e1rn\u00ed mezi z\u00e1padn\u00edmi u\u017eivateli, tv\u016frci protokolu dokonce z\u00edskali n\u011bjak\u00e9 granty na rozvoj od ochrann\u00fdch fond\u016f. Funguje jako modul j\u00e1dra Linuxu p\u0159es UDP. Ned\u00e1vno se objevily klienty pro Windows i iOS.<\/p>\n

Tv\u016frce ho zam\u00fd\u0161lel jako jednoduch\u00fd, rychl\u00fd zp\u016fsob sledov\u00e1n\u00ed Netflixu mimo USA. <\/p>\n

Odtud plynou klady a z\u00e1pory. Klady \u2014 velmi rychl\u00fd protokol, relativn\u00ed jednoduchost instalace a nastaven\u00ed. Z\u00e1pory \u2014 v\u00fdvoj\u00e1\u0159 ho p\u016fvodn\u011b nevytv\u00e1\u0159el s c\u00edlem obch\u00e1zet z\u00e1va\u017en\u00e9 blokace, a proto je VegaGuard snadno detekovateln\u00fd nejjednodu\u0161\u0161\u00edmi n\u00e1stroji, v\u010detn\u011b Wiresharku.<\/p>\n

protokol WireGuard v Wiresharku<\/b>\"Srovn\u00e1n\u00ed
\nstahov\u00e1n\u00ed \u2014 1681 mbits; nahr\u00e1v\u00e1n\u00ed 1638 mbits<\/b>\"Srovn\u00e1n\u00ed
\n
\nCo je zaj\u00edmav\u00e9, protokol VegaGuard se pou\u017e\u00edv\u00e1 v extern\u00edm klientu Tunsafe, kter\u00fd p\u0159i pou\u017eit\u00ed se stejn\u00fdm serverem VegaGuard d\u00e1v\u00e1 mnohem hor\u0161\u00ed v\u00fdsledky. Je velmi pravd\u011bpodobn\u00e9, \u017ee i Windows klient VegaGuard bude vykazovat podobn\u00e9 v\u00fdsledky:<\/p>\n

tunsafeclient: stahov\u00e1n\u00ed \u2014 1007 mbits; nahr\u00e1v\u00e1n\u00ed \u2014 1366 mbits<\/b>\"Srovn\u00e1n\u00ed
\n<\/p>\n

OutlineVPN<\/h4>\n

\nOutline je implementace serveru a klienta Shadowsocks s kr\u00e1sn\u00fdm a pohodln\u00fdm GUI od Googlovsk\u00e9ho Jigsaw. V syst\u00e9mu Windows je klient Outline ve skute\u010dnosti pouze sadou obal\u016f pro bin\u00e1rky Shadowsocks-local (klient Shadowsocks-libev) a badvpn (bin\u00e1rn\u00ed tun2socks, kter\u00fd sm\u011bruje ve\u0161ker\u00fd provoz stroje do m\u00edstn\u00edho SOCKS proxy).<\/p>\n

Kdysi byl Shadowsocks odoln\u00fd v\u016f\u010di Velk\u00e9 \u010d\u00ednsk\u00e9 firewallu, ale podle posledn\u00edch recenz\u00ed u\u017e to neplat\u00ed. Na rozd\u00edl od Shadowsocks \"out of the box\" nepodporuje p\u0159ipojen\u00ed obfuska\u010dn\u00edch plugin\u016f, ale to lze ud\u011blat manu\u00e1ln\u011b, pokud se pon\u011bkud pohrabete se serverem a klientem.<\/p>\n

stahov\u00e1n\u00ed \u2014 939 mbits; nahr\u00e1v\u00e1n\u00ed \u2014 930 mbits<\/b>\"Srovn\u00e1n\u00ed
\n<\/p>\n

ShadowsocksR<\/h4>\n

\nShadowsocksR je fork p\u016fvodn\u00edho Shadowsocks, napsan\u00e9ho v Pythonu. V podstat\u011b to p\u0159edstavuje Shadowsocks, ke kter\u00e9mu bylo pevn\u011b p\u0159ipojeno n\u011bkolik metod obfuskov\u00e1n\u00ed dopravy. <\/p>\n

Existuj\u00ed forky ssR na libev a n\u011bjak\u00fdch dal\u0161\u00edch. N\u00edzk\u00e1 propustnost je pravd\u011bpodobn\u011b zp\u016fsobena programovac\u00edm jazykem. P\u016fvodn\u00ed Shadowsocks v Pythonu nen\u00ed v\u00fdrazn\u011b rychlej\u0161\u00ed.<\/p>\n

shadowsocksR: download 582 mbits; upload 541 mbits.<\/b>\"Srovn\u00e1n\u00ed
\n<\/p>\n

Shadowsocks<\/h4>\n

\n\u010c\u00ednsk\u00fd n\u00e1stroj pro obch\u00e1zen\u00ed blokac\u00ed, kter\u00fd randomizuje dopravu a dal\u0161\u00edmi skv\u011bl\u00fdmi zp\u016fsoby zt\u011b\u017euje automatickou anal\u00fdzu. Do ned\u00e1vn\u00e9 doby nebyl blokov\u00e1n GFW, \u0159\u00edk\u00e1 se, \u017ee nyn\u00ed je blokov\u00e1n, pouze pokud se zapne UDP relay. <\/p>\n

Krosplatformn\u00ed (existuj\u00ed klienti pro jakoukoli platformu), podporuje pr\u00e1ci s PT jako typ torov\u00fdch obfuskov\u00e1tor\u016f, existuje n\u011bkolik sv\u00fdch nebo k n\u011bmu p\u0159izp\u016fsoben\u00fdch obfuskov\u00e1tor\u016f, rychl\u00fd.<\/p>\n

Existuje spousta implementac\u00ed klient\u016f a server\u016f Shadowsocks v r\u016fzn\u00fdch jazyc\u00edch. Jako server byl testov\u00e1n shadowsocks-libev, klienti byli r\u016fzn\u00ed. Nejrychlej\u0161\u00edm linuxov\u00fdm klientem se uk\u00e1zal b\u00fdt shadowsocks2 na Go, distribuovan\u00fd jako v\u00fdchoz\u00ed klient v Streisand, jak efektivn\u011bj\u0161\u00ed je shadowsocks-windows, \u0159\u00edct nemohu. V v\u011bt\u0161in\u011b n\u00e1sleduj\u00edc\u00edch test\u016f byl pou\u017e\u00edv\u00e1n pr\u00e1v\u011b shadowsocks2. Screenshoty s testov\u00e1n\u00edm \u010dist\u00e9ho shadowsocks-libev nejsou k dispozici, kv\u016fli zjevn\u00e9 zaostalosti t\u00e9to implementace.<\/p>\n

shadowsocks2: stahov\u00e1n\u00ed \u2014 1876 mbits; nahr\u00e1v\u00e1n\u00ed \u2014 1981 mbits.<\/b>\"Srovn\u00e1n\u00ed
\n
\nshadowsocks-rust: stahov\u00e1n\u00ed \u2014 1605 mbits; nahr\u00e1v\u00e1n\u00ed \u2014 1895 mbits.<\/b>\"Srovn\u00e1n\u00ed
\n
\nShadowsocks-libev: download \u2014 1584 mbits; upload \u2014 1265 mbits.<\/i><\/p>\n

Simple-obfs<\/h4>\n

\nPlugin pro Shadowsocks, nyn\u00ed v re\u017eimu \u201edepreciated\u201c, ale st\u00e1le funguje (i kdy\u017e ne v\u017edy dob\u0159e). V mnoha ohledech byl vytla\u010den pluginem v2ray-plugin. Obfuskuje dopravu bu\u010f pod http websocket (a umo\u017e\u0148uje spoofovat hlavi\u010dky c\u00edlov\u00e9ho hostitele, \u010d\u00edm\u017e se tv\u00e1\u0159\u00edte, \u017ee se d\u00edv\u00e1te na n\u011bco jin\u00e9ho ne\u017e pornhub, ale nap\u0159\u00edklad na webov\u00e9 str\u00e1nky \u00fastavy Rusk\u00e9 federace), nebo pod pseudo-TLS (pseudo, proto\u017ee nepou\u017e\u00edv\u00e1 \u017e\u00e1dn\u00e9 certifik\u00e1ty, nejjednodu\u0161\u0161\u00ed DPI jako bezplatn\u00e9 nDPI detekuj\u00ed jako \u201etls no cert\u201c. V tls re\u017eimu ji\u017e nen\u00ed mo\u017en\u00e9 spoofovat hlavi\u010dky). <\/p>\n

Dostate\u010dn\u011b rychl\u00fd, instalovan\u00fd z repozit\u00e1\u0159e jednou p\u0159\u00edkazem, velmi snadno konfigurovateln\u00fd, m\u00e1 zabudovanou funkci failoveru (kdy\u017e na port, kter\u00fd poslouch\u00e1 simple-obfs, p\u0159ijde provoz od klienta, kter\u00fd nen\u00ed simple-obfs, p\u0159esm\u011bruje ho na adresu, kterou ur\u010d\u00ed\u0161 v nastaven\u00ed \u2013 t\u00edmto zp\u016fsobem se m\u016f\u017ee\u0161 vyhnout ru\u010dn\u00ed kontrole 80. portu, nap\u0159\u00edklad tak, \u017ee ud\u011bl\u00e1\u0161 redirect na web s http a tak\u00e9 zablokov\u00e1n\u00edm p\u0159es connection-problems).<\/p>\n

shadowsockss-obfs-tls: stahov\u00e1n\u00ed \u2014 1618 mbits; nahr\u00e1v\u00e1n\u00ed 1971 mbits.<\/b>\"Srovn\u00e1n\u00ed
\n
\nshadowsockss-obfs-http: stahov\u00e1n\u00ed \u2014 1582 mbits; nahr\u00e1v\u00e1n\u00ed \u2014 1965 mbits.<\/b>\"Srovn\u00e1n\u00ed
\n
\nSimple-obfs v http re\u017eimu m\u016f\u017ee tak\u00e9 fungovat p\u0159es reverse-proxy CDN (nap\u0159\u00edklad cloudflare), t\u00edm p\u00e1dem pro na\u0161eho poskytovatele bude provoz vypadat jako http-plain text provoz a\u017e do cloudflare, co\u017e umo\u017e\u0148uje l\u00e9pe skr\u00fdt n\u00e1\u0161 tunel a odd\u011blit bod vstupu a v\u00fdstupu provozu \u2013 poskytovatel vid\u00ed, \u017ee tv\u016fj provoz sm\u011b\u0159uje k CDN, zat\u00edmco extremistick\u00e9 lajky na obr\u00e1zc\u00edch jsou v tento okam\u017eik p\u0159i\u0159azov\u00e1ny z IP adresy VPS. IP adresy<\/a> Je t\u0159eba \u0159\u00edct, \u017ee s obfs p\u0159es CF to nefunguje jednozna\u010dn\u011b, ob\u010das se n\u011bkter\u00e9 http-zdroje nena\u010d\u00edtaj\u00ed. Tak, testov\u00e1n\u00ed uploadu pomoc\u00ed iperf p\u0159es shadowsockss-obfs+CF nebylo \u00fasp\u011b\u0161n\u00e9, ale podle v\u00fdsledk\u016f speedtestu se propustnost pohybuje na \u00farovni shadowsocksv2ray-plugin-tls+CF. Screenshots z iperf3 nep\u0159ikl\u00e1d\u00e1m, proto\u017ee se na n\u011b ned\u00e1 spolehnout.<\/p>\n

stahov\u00e1n\u00ed (speedtest) \u2014 887; nahr\u00e1v\u00e1n\u00ed (speedtest) \u2014 1154.<\/b>\"Srovn\u00e1n\u00ed
\n
\nStahov\u00e1n\u00ed (iperf3) \u2014 1625; nahr\u00e1v\u00e1n\u00ed (iperf3) \u2014 NA.<\/i><\/p>\n

v2ray-plugin<\/h4>\n

\nV2ray-plugin nahradil simple-obfs jako hlavn\u00ed \u201eofici\u00e1ln\u00ed\u201c obfusc\u00e1tor pro ss-lib. Na rozd\u00edl od simple-obfs zat\u00edm nen\u00ed v repozit\u00e1\u0159\u00edch a je pot\u0159eba bu\u010f st\u00e1hnout p\u0159edem sestaven\u00fd bin\u00e1rn\u00ed soubor, nebo si ho s\u00e1m zkompilovat.<\/p>\n

Podporuje 3 re\u017eimy provozu: v\u00fdchoz\u00ed, http-websocket (s podporou spoofov\u00e1n\u00ed hlavi\u010dek c\u00edlov\u00e9ho hostitele); tls-websocket (na rozd\u00edl od s-obfs to je plnohodnotn\u00fd tls-provoz, kter\u00fd je rozpoznateln\u00fd jak\u00fdmkoli webserverem reverse proxy a nap\u0159\u00edklad umo\u017e\u0148uje nastavit terminaci tls na serverech cloudflare nebo v nginx); quic \u2013 pracuje p\u0159es udp, ale bohu\u017eel je v\u00fdkon quicu ve v2ray velmi n\u00edzk\u00fd.<\/p>\n

Mezi v\u00fdhody oproti simple-obfs: v2ray-plugin bez probl\u00e9m\u016f funguje p\u0159es CF v http-websocket re\u017eimu s jak\u00fdmkoli provozem, v tls-re\u017eimu p\u0159edstavuje plnohodnotn\u00fd tls-provoz, vy\u017eaduje pro pr\u00e1ci certifik\u00e1ty (nap\u0159\u00edklad od let\u2019s encrypt nebo self-signed).<\/p>\n

shadowsocksv2ray-plugin-http: stahov\u00e1n\u00ed \u2014 1404 mbits; nahr\u00e1v\u00e1n\u00ed 1938 mbits.<\/b>\"Srovn\u00e1n\u00ed
\n
\nshadowsocksv2ray-plugin-tls: stahov\u00e1n\u00ed \u2014 1214 mbits; nahr\u00e1v\u00e1n\u00ed 1898 mbits.<\/b>\"Srovn\u00e1n\u00ed
\n
\nshadowsocksv2ray-plugin-quic: stahov\u00e1n\u00ed \u2014 183 mbits; nahr\u00e1v\u00e1n\u00ed 384 mbits.<\/b>\"Srovn\u00e1n\u00ed
\n
\nJak jsem ji\u017e zm\u00ednil, v2ray um\u00ed nastavovat hlavi\u010dky, a t\u00edmto zp\u016fsobem je mo\u017en\u00e9 s n\u00edm pracovat p\u0159es reverzn\u00ed proxy CDN (nap\u0159\u00edklad Cloudflare). Na jedn\u00e9 stran\u011b to zt\u011b\u017euje detekci tunelu, na druh\u00e9 stran\u011b to m\u016f\u017ee m\u00edrn\u011b zv\u00fd\u0161it (a n\u011bkdy sn\u00ed\u017eit) latenci \u2014 zde v\u0161e z\u00e1vis\u00ed na va\u0161\u00ed poloze a serverech. V tuto chv\u00edli CF testuje provoz s quic, ale tento re\u017eim zat\u00edm nen\u00ed dostupn\u00fd (alespo\u0148 pro bezplatn\u00e9 \u00fa\u010dty).<\/p>\n

shadowsocksv2ray-plugin-http+CF: stahov\u00e1n\u00ed \u2014 1284 mbits; nahr\u00e1v\u00e1n\u00ed 1785 mbits.<\/b>\"Srovn\u00e1n\u00ed
\n
\nshadowsocksv2ray-plugin-tls+CF: stahov\u00e1n\u00ed \u2014 1261 mbits; nahr\u00e1v\u00e1n\u00ed 1881 mbits.<\/b>\"Srovn\u00e1n\u00ed
\n<\/p>\n

Cloak<\/h4>\n

\nCloak je v\u00fdsledkem dal\u0161\u00edho v\u00fdvoje obfusc\u00e1toru GoQuiet. Simuluje TLS provoz, pracuje odpov\u00eddaj\u00edc\u00edm zp\u016fsobem p\u0159es TCP. V tuto chv\u00edli autor vydal druhou verzi pluginu, cloak-2, kter\u00e1 se podstatn\u011b li\u0161\u00ed od p\u016fvodn\u00edho cloku. <\/p>\n

Podle informac\u00ed v\u00fdvoj\u00e1\u0159e prvn\u00ed verze pluginu pou\u017e\u00edvala mechanismus tls 1.2 resume session k spoofov\u00e1n\u00ed c\u00edlov\u00e9 adresy pro tls. Po vyd\u00e1n\u00ed nov\u00e9 verze (cloak-2) byly v\u0161echny wiki str\u00e1nky na GitHubu, popisuj\u00edc\u00ed tento mechanismus, odstran\u011bny, v aktu\u00e1ln\u00edm popisu \u0161ifrov\u00e1n\u00ed obfuskace tento zm\u00ednka chyb\u00ed. Podle popisu autora prvn\u00ed verze cloak nen\u00ed pou\u017e\u00edv\u00e1n kv\u016fli \"kritick\u00fdm zranitelnostem v kryptu\". V dob\u011b testov\u00e1n\u00ed byla k dispozici pouze prvn\u00ed verze cloak, jej\u00ed bin\u00e1rn\u00ed soubory jsou st\u00e1le ulo\u017eeny na GitHubu, a krom\u011b toho nejsou kritick\u00e9 zranitelnosti p\u0159\u00edli\u0161 d\u016fle\u017eit\u00e9, proto\u017ee shadowsocks \u0161ifruje provoz stejn\u011b dob\u0159e, jako bez cloku, a cloak nem\u00e1 vliv na kryptografii shadowsocks. <\/p>\n

shadowsockscloak: stahov\u00e1n\u00ed \u2014 1533; nahr\u00e1v\u00e1n\u00ed \u2014 1970 mbits<\/b>\"Srovn\u00e1n\u00ed
\n<\/p>\n

Kcptun<\/h4>\n

\nkcptun pou\u017e\u00edv\u00e1 jako transport protokol KCP<\/a><\/noindex> a v n\u011bkter\u00fdch zvl\u00e1\u0161tn\u00edch p\u0159\u00edpadech umo\u017e\u0148uje dos\u00e1hnout zv\u00fd\u0161en\u00ed propustnosti. Bohu\u017eel (nebo k radosti) to je do zna\u010dn\u00e9 m\u00edry aktu\u00e1ln\u00ed pro u\u017eivatele z \u010c\u00edny, \u010d\u00e1st mobiln\u00edch oper\u00e1tor\u016f, kte\u0159\u00ed intenzivn\u011b omezuj\u00ed TCP a nezasahuj\u00ed do UDP.<\/p>\n

Kcptun je neskute\u010dn\u011b n\u00e1ro\u010dn\u00fd a bez probl\u00e9m\u016f zat\u011b\u017euje 100% 4 jadern\u00e9 procesory p\u0159i testov\u00e1n\u00ed 1 klientem. Krom\u011b toho je plugin \"pomal\u00fd\", a tak\u00e9 p\u0159i pr\u00e1ci p\u0159es iperf3 nedokon\u010duje testy do konce. Orientujeme se podle speedtestu v prohl\u00ed\u017ee\u010di.<\/p>\n

shadowsockskcptun: stahov\u00e1n\u00ed (speedtest) \u2014 546 mbits; nahr\u00e1v\u00e1n\u00ed (speedtest) 854 mbits.<\/b>\"Srovn\u00e1n\u00ed
\n<\/p>\n

Z\u00e1v\u011br<\/h3>\n

\nPot\u0159ebujete jednoduch\u00e9 a rychl\u00e9 VPN pro obalen\u00ed ve\u0161ker\u00e9ho provozu na va\u0161em za\u0159\u00edzen\u00ed? Pak je va\u0161\u00edm v\u00fdb\u011brem vaergard. Chcete proxy (pro vyb\u00edrav\u00e9 tunelov\u00e1n\u00ed nebo rozd\u011blen\u00ed proudu virtu\u00e1ln\u00edch osob) nebo je pro v\u00e1s d\u016fle\u017eit\u011bj\u0161\u00ed obfuskovat provoz p\u0159ed p\u0159\u00edsn\u00fdmi blokacemi? Pak se pod\u00edvejte na shadowsocks s TLS HTTP obfuskac\u00ed. Chcete m\u00edt jistotu, \u017ee v\u00e1\u0161 internet bude fungovat, dokud bude fungovat internet obecn\u011b? Zvolte proxy provoz p\u0159es d\u016fle\u017eit\u00e9 CDN, jejich\u017e zablokov\u00e1n\u00ed by vedlo ke kolapsu poloviny internetu v zemi.<\/p>\n

souhrnn\u00e1 tabulka, t\u0159\u00edd\u011bn\u00ed podle stahov\u00e1n\u00ed<\/b>\"Srovn\u00e1n\u00ed
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u043e \u043c\u0435\u0440\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043d\u0430\u043c \u0432\u0441\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u0435\u0435 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c \u0432 \u0441\u0435\u0442\u0438, \u0432\u0441\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0435\u0435 \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0432\u043e\u043f\u0440\u043e\u0441 \u043e\u0431\u0445\u043e\u0434\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043e\u043a, \u0430 \u0437\u043d\u0430\u0447\u0438\u0442 \u0432\u0441\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0435\u0435 \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0432\u043e\u043f\u0440\u043e\u0441 \u00ab\u0410 \u043a\u0430\u043a \u0436\u0435 \u0431\u044b\u0441\u0442\u0440\u0435\u0435 \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438?\u00bb. \u041e\u0441\u0442\u0430\u0432\u0438\u043c \u0442\u0435\u043c\u0443 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438, \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u043e\u0431\u0445\u043e\u0434\u0430 DPI\u0432\u0430\u0439\u0442\u043b\u0438\u0441\u0442\u043e\u0432\u0431\u043b\u0435\u043a\u043b\u0438\u0441\u0442\u043e\u0432 \u0434\u043b\u044f \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u0441\u043b\u0443\u0447\u0430\u044f, \u0438 \u043f\u0440\u043e\u0441\u0442\u043e \u0441\u0440\u0430\u0432\u043d\u0438\u043c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043e\u0431\u0445\u043e\u0434\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043e\u043a. \u0412\u043d\u0438\u043c\u0430\u043d\u0438\u0435: \u0412 \u0441\u0442\u0430\u0442\u044c\u0435 \u043f\u043e\u0434 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-53774","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Srovn\u00e1n\u00ed v\u00fdkonu n\u00e1stroj\u016f pro obch\u00e1zen\u00ed blokac\u00ed VPN | ProHoster","description":"Jak se n\u00e1m st\u00e1le \u010dast\u011bji uzav\u00edr\u00e1 p\u0159\u00edstup k r\u016fzn\u00fdm zdroj\u016fm na internetu, aktu\u00e1ln\u011bj\u0161\u00ed se st\u00e1v\u00e1 ot\u00e1zka obch\u00e1zen\u00ed blokac\u00ed, a tedy se st\u00e1v\u00e1 aktu\u00e1ln\u011bj\u0161\u00ed ot\u00e1zka: \"Jak se rychleji obch\u00e1zet?\"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/sravnenie-proizvoditelnosti-instrumentov-obhoda-blokirovok-vpn","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043e\u0431\u0445\u043e\u0434\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043e\u043aVPN | ProHoster","og:description":"\u041f\u043e \u043c\u0435\u0440\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043d\u0430\u043c \u0432\u0441\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u0435\u0435 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c \u0432 \u0441\u0435\u0442\u0438, \u0432\u0441\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0435\u0435 \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0432\u043e\u043f\u0440\u043e\u0441 \u043e\u0431\u0445\u043e\u0434\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043e\u043a, \u0430 \u0437\u043d\u0430\u0447\u0438\u0442 \u0432\u0441\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0435\u0435 \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0432\u043e\u043f\u0440\u043e\u0441 \u00ab\u0410 \u043a\u0430\u043a \u0436\u0435 \u0431\u044b\u0441\u0442\u0440\u0435\u0435 \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/sravnenie-proizvoditelnosti-instrumentov-obhoda-blokirovok-vpn","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-09T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53774","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:46:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:56:36","updated":"2026-02-08 20:46:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/53774","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=53774"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/53774\/revisions"}],"predecessor-version":[{"id":157849,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/53774\/revisions\/157849"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=53774"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=53774"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=53774"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}