新协议 Paqet 和GFW-Knocker

技术交流
1

来源: GitHub - SamNet-dev/paqctl: Unified proxy manager for bypassing firewalls - supports Paqet (KCP/raw socket) and GFW-Knocker (violated TCP/QUIC) with dual-backend simultaneous operation

Paqet (Simple)

YOUR COMPUTER                YOUR VPS                   INTERNET
+--------------+            +--------------+           +----------+
|  Browser     |            |    Paqet     |           |  Google  |
|      |       |            |    Server    |           |  YouTube |
|      v       |  ---KCP--> |      |       |  -------> |  etc.    |
|  Paqet       | (random    |      v       |           |          |
|  Client      |    UDP)    |    SOCKS5    |           |          |
+--------------+            +--------------+           +----------+
  127.0.0.1:1080              your.vps.ip

GFW-Knocker (Advanced)

YOUR COMPUTER                YOUR VPS                   INTERNET
+--------------+            +--------------+           +----------+
|  Browser     |            |  GFK Server  |           |  Google  |
|      |       | "Violated  |      |       |           |  YouTube |
|      v       |    TCP"    |      v       |           |  etc.    |
|  GFK Client  | ---------> | QUIC Tunnel  |  -------> |          |
|  (VIO+QUIC)  | (malformed |      |       |           |          |
|      |       |  +QUIC)    |      v       |           |          |
|  Port 14000  |            |    Xray      |           |          |
+--------------+            +--------------+           +----------+
  127.0.0.1:14000             your.vps.ip

How GFK bypasses firewalls:

  1. Violated TCP: Sends TCP packets that are intentionally “broken” - they have wrong flags, no proper handshake. Firewalls expect normal TCP and often pass these through.
  2. QUIC Tunnel: Inside these violated packets, there’s a QUIC connection carrying your actual data.
  3. Xray Backend: On the server, Xray provides the actual SOCKS5 proxy service.
2

可以备用，但不适合黑洞路由封锁IP的方法

1 个赞