Guide to Configuring XOR-Obfuscation for OpenVPN Protocol on a SoftEther VPN Server
SoftEther is a versatile VPN solution that supports multiple protocols, including OpenVPN, WireGuard, L2TP/IPsec, SSTP, and more. In this guide, we’ll focus on configuring OpenVPN protocol with XOR-obfuscation on a SoftEther VPN Server using the vpncmd utility, which is the only currently possible way to control XOR-specific settings.
Note: This guide assumes you already have a functional SoftEther VPN Server set up in standalone mode (with at least one Virtual Hub and user) and are comfortable with basic Linux command-line operations.
What is XOR-obfuscation?
XOR-obfuscation involves applying a bitwise XOR operation to network packets using a predefined mask or key. While it does not enhance security in the same way that cryptographic encryption does, it helps conceal the recognizable patterns of OpenVPN traffic from DPI systems. If your local network or ISP actively blocks or throttles standard VPN connections, XOR-obfuscation may help in bypassing these restrictions.
In other words, XOR obfuscation acts as a simple disguise for your data. Much like a basic code that rearranges parts of a message, it modifies the data in a reversible manner using a fixed key. This process doesn’t secure the data as robust encryption would, but it does mask the inherent patterns that monitoring systems look for, making the traffic appear less like standard VPN traffic.
To use XOR-obfuscation with OpenVPN, both the server and the OpenVPN client must be configured (and in some cases patched) to support the feature. For macOS, for example, Tunnelblick can be used because it supports XOR obfuscation out of the box.
Step 1: Generate an Obfuscation Mask
The XOR-obfuscation mask (sometimes referred to as a key or password) is a string used to perform the bitwise XOR operations on your VPN packets. It can be any random or even word-based string, but for better concealment, consider using a lengthy and complex random string. You can use any token generator to create a long and random key.
Important: The XOR-obfuscation mask must match on both the SoftEther VPN Server and any OpenVPN client that connects using XOR-obfuscation.
Step 2: Enabling and Configuring OpenVPN XOR Settings in SoftEther
Before setting up the XOR-obfuscation for OpenVPN, make sure you have administrator rights on the VPN server. Begin by launching the vpncmd utility, choose option #1, and log in as Administrator:
./vpncmdOnce logged in, use ProtoOptionsSet to configure OpenVPN protocol parameters. Below is a set of commands to enable XOR-obfuscation, define the obfuscation mask, and configure basic OpenVPN parameters. Run these commands one by one:
ProtoOptionsSet openvpn /NAME=Enabled /VALUE=true
ProtoOptionsSet openvpn /NAME=Obfuscation /VALUE=true
# Replace 'YourObfuscationMask' with your generated random string
ProtoOptionsSet openvpn /NAME=ObfuscationMask /VALUE="YourObfuscationMask"
# Check if your server has any TCP listeners that you can connect to
ListenerList
# If list is empty, make sure to create a TCP listener on a chosen port (e.g., 443)
ListenerCreate 443
# Or if it already exists, ensure that it is enabled and has the "Listening" status:
ListenerEnable 443
Step 3: Creating an XOR-Obfuscated OpenVPN Client Configuration
Now, it’s time to create an OpenVPN config for your client app. Below is a sample OpenVPN client configuration file. Copy it into your client environment (e.g., as client.ovpn) and modify as needed.
Important: ensure that your client software (e.g., Tunnelblick) supports the scramble obfuscate directive and XOR obfuscation in general. Below are some examples of XOR-compatible OpenVPN clients:
A sample OpenVPN configuration using XOR obfuscation to connect to your SoftEther VPN server would look like this:
dev tun
proto tcp
remote 111.112.113.114 443
cipher AES-256-GCM
auth SHA384
nobind
client
verb 3
auth-user-pass
# The crucial line that enables XOR-based obfuscation on the client side
# The mask must match the one you've configured on SoftEther server using the ProtoOptionsSet command
scramble obfuscate 1e8aee72s63f49fjf910skj14d3d0defd40f91y2ehdkfa04cb1
<ca>
-----BEGIN CERTIFICATE-----
EludGVybmV0IFNlY3VyaXR5IFJlc2Vh...........
CgdNbOhdjsnvzqvHu7Ur/+jh5Xos1AnX5iItreGCc=
-----END CERTIFICATE-----
</ca>
Explanation of Key Lines:
Important: Make sure that your VPN config precisely matches your server settings. If you have any doubts, run the following command to generate a default OpenVPN configuration (which you can then modify to include your scramble setting):
OpenVpnMakeConfigYou can insert your scramble obfuscate line into the generated file to enable XOR-obfuscation.
All set!
By enabling XOR-obfuscation on your SoftEther VPN Server and configuring a matching scramble obfuscate directive on the OpenVPN client, you can camouflage your OpenVPN traffic. This may help bypass DPI-based blocking or throttling. Remember that XOR-obfuscation is not a replacement for robust encryption; it only hides the characteristic signature of OpenVPN packets.
If you encounter any connectivity issues, ensure that:
Once all parameters are correctly set, your OpenVPN tunnel should successfully connect using XOR-obfuscation, helping you evade basic traffic filtering mechanisms.