System-wide DPI bypass tool for Linux — a GoodbyeDPI alternative
CachyDPI intercepts outgoing network traffic via nftables + NFQUEUE and applies packet manipulation techniques to bypass Deep Packet Inspection (DPI) systems used by ISPs for censorship. Written in Rust, it runs as a systemd daemon with minimal resource usage.
Honest note: CachyDPI works well against passive DPI (forged RST/redirect injection) and simple SNI-based blocking. It cannot bypass advanced inline DPI systems that perform full TCP stream reassembly and server-side blocking. If your ISP uses such a system, you may need a VPN or ECH-capable browser. See Limitations for details.
- Passive DPI defense — Detects and drops forged RST, HTTP 302 redirect, and TLS alert packets injected by DPI
- HTTP Host fragmentation — Splits HTTP requests across TCP segments at the Host header
- TLS SNI fragmentation — Fragments the ClientHello across TCP segments (record-layer and out-of-order delivery)
- Fake packet injection — Sends decoy packets with wrong TTL/checksum/sequence interleaved with real fragments
- QUIC desynchronization — Fragments QUIC Initial packets on UDP 443 (IPv4)
- TCP window size manipulation — Forces the server to send smaller TCP segments
- Per-destination auto TTL — Automatically detects optimal fake packet TTL from SYN-ACK analysis
- Domain filtering — Blacklist/whitelist with subdomain matching for targeted bypass
- Real-time TUI monitor — Built-in dashboard via
cachydpi monitor - IPv4 + IPv6 support
- Comprehensive systemd hardening — 20+ security directives, dedicated user, minimal capabilities
- Linux kernel with
nfnetlink_queuesupport - nftables
libnetfilter_queue,libnfnetlink,libmnl
yay -S cachydpi
# or
paru -S cachydpi# Install build dependencies (Arch)
sudo pacman -S libnetfilter_queue libnfnetlink libmnl nftables rust cargo pkg-config
# Install build dependencies (Debian/Ubuntu)
sudo apt install libnetfilter-queue-dev libnfnetlink-dev libmnl-dev nftables rustc cargo pkg-config
# Build and install
git clone https://github.com/byalphas/cachydpi.git
cd cachydpi
make release
sudo make install
# Enable and start
sudo systemctl enable --now cachydpigit clone https://github.com/byalphas/cachydpi.git
cd cachydpi
sudo ./install.shsudo systemctl enable --now cachydpi # Start and enable at boot
sudo systemctl status cachydpi # Check status
journalctl -u cachydpi -f # Follow logs
sudo cachydpi restart # Restart service# Default mode (all active techniques)
sudo cachydpi -m 5 --foreground
# Passive only (drop forged packets)
sudo cachydpi -m 1 --foreground
# Verbose logging
sudo cachydpi -m 5 -vvv --foregroundcachydpi monitor # No root neededThe monitor displays real-time packet statistics, strategy hits, resource usage, passive defense counters, and recent events. It connects to the daemon via a Unix socket with zero overhead on the packet processing path.
| Command | Description |
|---|---|
monitor |
Real-time TUI performance dashboard |
status |
Show service and configuration status |
restart |
Restart the systemd service |
detect <domain> |
Fingerprint your ISP's DPI system |
install-rules |
Manually install nftables rules |
remove-rules |
Manually remove nftables rules |
| Mode | Description | When to Use |
|---|---|---|
| 1 | Passive DPI | ISPs that only inject forged RST/302 packets |
| 2 | HTTP fragmentation | HTTP-only sites |
| 3 | TLS SNI fragmentation | HTTPS sites with simple SNI inspection |
| 4 | Fake packet injection | HTTP+HTTPS, TTL-based evasion |
| 5 | All active (default) | General use — start here |
| 6 | Aggressive | All + QUIC + out-of-order delivery (see warning below) |
| 7 | Auto-detect | AllActive + all desync options enabled (runtime auto-detection planned) |
Warning: Mode 6 sends out-of-order TCP segments and fake RST packets. This can break connections to sites that are in the blacklist but not actually blocked by your ISP. Use mode 5 unless you have a specific reason.
Config file: /etc/cachydpi/config.toml
[general]
mode = 5 # Bypass mode (1-7)
queue_num = 200 # NFQUEUE number
ipv6 = true # Enable IPv6 support
manage_rules = true # Auto-manage nftables rules
[strategies]
passive_dpi = true # Drop forged RST/302/TLS alerts
fake_packet_enabled = false # Fake packet injection (can trigger aggressive DPI)
auto_ttl = true # Per-destination TTL auto-detection
multi_fragment = true # 3-piece TLS fragmentation
disorder = true # Reverse-order fragment delivery
quic_desync = false # QUIC fragmentation (mode 6 only)
[domains]
mode = "blacklist" # "none", "blacklist", or "whitelist"
blacklist_file = "/etc/cachydpi/blacklist.txt"
[logging]
level = "info" # trace, debug, info, warn, error
journald = true # Log to systemd journalMost ISPs (start here):
sudo cachydpi -m 5 --auto-ttlISPs with aggressive DPI:
sudo cachydpi -m 6 --auto-ttl --wrong-seqISPs with passive DPI only (RST/redirect injection):
sudo cachydpi -m 1Tip: Use
sudo cachydpi detect <domain>to fingerprint your ISP's DPI type before choosing a mode.
| Option | Description |
|---|---|
-m, --mode <1-7> |
Bypass mode |
-c, --config <file> |
Config file path |
-q, --queue-num <N> |
NFQUEUE number (default: 200) |
--ipv6 / --no-ipv6 |
Toggle IPv6 support |
--set-ttl <N> |
Fixed fake packet TTL |
--auto-ttl |
Auto TTL detection (recommended) |
-w, --window-size <N> |
TCP window size override |
--wrong-chksum |
Send fake packets with wrong TCP checksum |
--wrong-seq |
Send fake packets with wrong TCP sequence |
--http-split <N> |
HTTP split position (0 = auto) |
--tls-split <N> |
TLS split position (0 = auto) |
--blacklist <file> |
Domain blacklist file |
--whitelist <file> |
Domain whitelist file |
-v |
Verbose logging (-v, -vv, -vvv) |
--foreground |
Run in foreground (don't daemonize) |
--no-rules |
Don't auto-install nftables rules |
--dry-run |
Show config and exit |
┌─────────────┐ ┌──────────┐ ┌───────────────┐
│ Application │────▶│ Kernel │────▶│ Network │
│ (browser) │ │ (nftables)│ │ Interface │
└─────────────┘ └────┬─────┘ └───────────────┘
│ NFQUEUE
┌────▼─────┐
│ CachyDPI │
│ (daemon) │
├──────────┤
│ Strategy │──── Metrics ──── Unix Socket
│ Engine │ (AtomicU64) /run/cachydpi/
├──────────┤ metrics.sock
│ Packet │ │
│ Parser │ ┌────────▼────────┐
├──────────┤ │ cachydpi monitor │
│ Raw │ │ (TUI binary) │
│ Socket │ └──────────────────┘
└──────────┘
Packet flow: Application → kernel nftables → NFQUEUE → CachyDPI (inspect/modify/fragment) → raw socket → network. Inbound forged packets are intercepted via a separate NFQUEUE input chain and silently dropped.
| Metric | Value |
|---|---|
| Memory (idle) | ~5 MB |
| Memory (under load) | < 10 MB |
| CPU (idle) | < 1% |
| Latency overhead | ~0 ms |
| Startup time | < 100 ms |
| Binary size | ~1 MB |
| Thread count | 5 |
| Open file descriptors | ~11 |
Resource limits enforced by systemd: MemoryMax=64M, CPUQuota=25%.
CachyDPI is a client-side packet manipulation tool. This fundamentally limits what it can and cannot do:
Works well against:
- Passive DPI that injects forged RST or HTTP redirect packets
- SNI-based blocking where DPI inspects but doesn't reassemble TCP streams
- ISPs that rely on first-packet SNI inspection
Does not work against:
- Inline DPI with TCP stream reassembly — If the DPI appliance reassembles the full TCP stream before inspecting it, fragmentation-based techniques are ineffective
- Server-side blocking — If the DPI sends a RST to the server (not just the client), the server terminates the connection regardless of what the client does
- IP-based blocking — If the ISP blocks destination IPs directly, no packet manipulation can help
- DNS poisoning — CachyDPI does not handle DNS. Use DNS-over-TLS or DNS-over-HTTPS separately (a
dns-over-tls.conffor systemd-resolved is included in the repo)
Known ISP behavior (Turkey, tested April 2026):
- Passive defense (RST/TLS alert drop) works on all tested sites
- SNI fragmentation bypasses some blocked sites
- Cloudflare-fronted domains (e.g., Discord) are inline-blocked and cannot be bypassed client-side
- IP-blocked sites (~229 domains in the default blacklist) cannot be bypassed
See tests/reports/FAILURE_ANALYSIS.md for detailed DPI analysis.
CachyDPI does not intercept or modify DNS traffic. To prevent DNS-based censorship, configure DNS-over-TLS separately:
# Copy the included config
sudo cp dns-over-tls.conf /etc/systemd/resolved.conf.d/dns-over-tls.conf
sudo systemctl restart systemd-resolvedThis configures systemd-resolved to use Cloudflare (1.1.1.1) and Google (8.8.8.8) DNS over TLS with Quad9 as fallback.
Service won't start:
journalctl -u cachydpi -e --no-pager
sudo cachydpi -m 5 --foreground -vvvnftables errors:
sudo nft list tables # Check existing tables
sudo nft list table ip cachydpi # Inspect CachyDPI rules
sudo cachydpi remove-rules # Manual cleanupPermission denied:
# The install script handles this, but if needed:
sudo setcap cap_net_admin,cap_net_raw=eip /usr/bin/cachydpiKernel module missing:
sudo modprobe nfnetlink_queueMonitor can't connect:
sudo systemctl start cachydpi # Ensure daemon is running
ls -la /run/cachydpi/metrics.sock # Check socket existsSite still blocked after enabling CachyDPI:
- Check if the domain is in your blacklist:
grep domain /etc/cachydpi/blacklist.txt - Run DPI detection:
sudo cachydpi detect <domain> - Check if it's an IP-level block:
curl -k --resolve "google.com:443:<site-ip>" https://google.com— if this also fails, it's an IP block - Try mode 6:
sudo cachydpi -m 6 --foreground - If none of these work, the ISP likely uses inline DPI — consider a VPN
# Rust tests (no root)
cargo test
# Full system test suite
sudo bash tests/run_all_tests.sh
# Blacklist accessibility test
sudo bash tests/blacklist_test.sh --quickSee tests/README.md for the full test suite documentation.
make release # Optimized release build
make debug # Debug build
make test # Run tests
make clippy # Lint
make install # Install to system
make uninstall # Remove from systemBuild without the monitor TUI:
cargo build --release --no-default-featuresCachyDPI runs as a dedicated cachydpi system user with only CAP_NET_ADMIN and CAP_NET_RAW capabilities. The systemd service applies 20+ hardening directives including NoNewPrivileges, ProtectSystem=strict, MemoryDenyWriteExecute, namespace restrictions, and syscall architecture filtering. Security score: 3.4/10 (lower is better) per systemd-analyze security.
See SECURITY.md for the full security architecture, threat model, and vulnerability reporting process.
- Inspired by GoodbyeDPI by ValdikSS
- Techniques from zapret by bol-van
- Built for the CachyOS community