geph4-client
Geph (迷霧通) is a modular Internet censorship circumvention system designed specifically to deal with national filtering.
Top Related Projects
Outline Client and Manager, developed by Jigsaw. Outline Manager makes it easy to create your own VPN server. Outline Client lets you share access to your VPN with anyone in your network, giving them access to the free and open internet.
Streisand sets up a new server running your choice of WireGuard, OpenConnect, OpenSSH, OpenVPN, Shadowsocks, sslh, Stunnel, or a Tor bridge. It also generates custom instructions for all of these services. At the end of the run you are given an HTML file with instructions that can be shared with friends, family members, and fellow activists.
Set up a personal VPN in the cloud
A Rust port of shadowsocks
Quick Overview
Geph4-client is the official client implementation for Geph4, a resilient and user-friendly censorship circumvention system. It provides a robust solution for users to bypass internet censorship and access blocked content securely.
Pros
- Strong focus on censorship resistance and privacy
- User-friendly interface for easy setup and use
- Supports multiple platforms (Windows, macOS, Linux, Android)
- Actively maintained and regularly updated
Cons
- Limited documentation for advanced users or developers
- Requires a subscription for full access to all features
- May have performance impacts on slower internet connections
- Potential legal concerns in some jurisdictions
Getting Started
To get started with Geph4-client:
- Visit the Geph website and create an account.
- Download the appropriate client for your operating system from the releases page.
- Install the client on your device.
- Launch the application and log in with your account credentials.
- Select a server and connect to start browsing securely.
For more detailed instructions, refer to the official documentation.
Competitor Comparisons
Outline Client and Manager, developed by Jigsaw. Outline Manager makes it easy to create your own VPN server. Outline Client lets you share access to your VPN with anyone in your network, giving them access to the free and open internet.
Pros of outline-apps
- More comprehensive cross-platform support (Android, iOS, Windows, macOS, Linux)
- Backed by a larger organization (Jigsaw, a subsidiary of Alphabet Inc.)
- Extensive documentation and user guides available
Cons of outline-apps
- Less focus on censorship resistance compared to geph4-client
- May have a steeper learning curve for non-technical users
- Requires setting up a server, which can be challenging for some users
Code Comparison
geph4-client (Rust):
pub async fn connect(&mut self) -> Result<(), Error> {
let bridge = self.select_bridge().await?;
self.tunnel = Some(self.create_tunnel(bridge).await?);
Ok(())
}
outline-apps (TypeScript):
async connect(): Promise<void> {
const server = await this.selectServer();
this.tunnel = await this.createTunnel(server);
return;
}
Both projects use asynchronous programming for connection handling, but geph4-client is implemented in Rust while outline-apps uses TypeScript. The connection process appears similar, involving server/bridge selection and tunnel creation.
Streisand sets up a new server running your choice of WireGuard, OpenConnect, OpenSSH, OpenVPN, Shadowsocks, sslh, Stunnel, or a Tor bridge. It also generates custom instructions for all of these services. At the end of the run you are given an HTML file with instructions that can be shared with friends, family members, and fellow activists.
Pros of Streisand
- Supports multiple VPN protocols (OpenVPN, WireGuard, etc.), offering more flexibility
- Automates the setup process for various cloud providers, simplifying deployment
- Includes additional privacy-enhancing tools like Tor and DNSCrypt
Cons of Streisand
- Less actively maintained, with fewer recent updates compared to Geph4
- May require more technical knowledge to set up and manage
- Lacks some of the advanced censorship circumvention features found in Geph4
Code Comparison
Streisand (setup script):
#!/bin/bash
set -e
if [ ! -d "$HOME/.ssh" ]; then
mkdir "$HOME/.ssh"
fi
Geph4 (client initialization):
pub fn new(config: ClientConfig) -> Result<Self> {
let runtime = tokio::runtime::Builder::new_multi_thread()
.enable_all()
.build()?;
Ok(Client { config, runtime })
}
While both projects aim to provide secure communication, Streisand focuses on automating VPN server setup across various protocols, whereas Geph4 is a specialized censorship circumvention tool with its own protocol and infrastructure.
Set up a personal VPN in the cloud
Pros of algo
- Focuses on setting up personal VPN servers, offering more control over infrastructure
- Supports multiple cloud providers, allowing flexible deployment options
- Emphasizes security with features like automatic updates and fail2ban integration
Cons of algo
- Requires more technical knowledge to set up and maintain
- Limited to VPN functionality, lacking additional privacy features
- May have higher ongoing costs due to cloud server requirements
Code comparison
algo:
def deploy_algo():
configure_vpn_server()
setup_wireguard()
enable_security_features()
geph4-client:
fn connect_geph() {
establish_bridge_connection();
apply_obfuscation();
route_traffic();
}
Key differences
- algo is primarily a VPN server setup tool, while geph4-client is a client-side censorship circumvention tool
- algo focuses on self-hosted infrastructure, geph4-client relies on a network of exit nodes
- geph4-client includes additional obfuscation techniques to bypass censorship
- algo provides a more traditional VPN experience, while geph4-client offers a specialized anti-censorship solution
Both projects aim to enhance online privacy and security but take different approaches. algo is better suited for users who want full control over their VPN infrastructure, while geph4-client is designed for users in censored environments seeking a turnkey solution for accessing restricted content.
A Rust port of shadowsocks
Pros of shadowsocks-rust
- More established and widely used project with a larger community
- Simpler protocol design, potentially easier to set up and maintain
- Better performance in some network environments due to its lightweight nature
Cons of shadowsocks-rust
- Less advanced obfuscation techniques compared to geph4-client
- Lacks built-in censorship circumvention features like those in geph4-client
- May be more vulnerable to detection in heavily censored networks
Code Comparison
geph4-client (Rust):
pub async fn connect(
&self,
exit_descriptor: ExitDescriptor,
protocol: Protocol,
) -> anyhow::Result<TcpStream> {
// Connection logic
}
shadowsocks-rust (Rust):
pub async fn connect(
&self,
addr: &Address,
) -> io::Result<TcpStream> {
// Connection logic
}
Both projects use Rust and implement similar connection functions, but geph4-client includes additional parameters for exit descriptors and protocols, reflecting its more complex architecture designed for censorship resistance.
Convert designs to code with AI
Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.
Try Visual CopilotREADME
geph4-client
Geph (è¿·é§é) is a modular Internet censorship circumvention system designed specifically to deal with national filtering.
geph4-client
is the command-line Geph client.
To install geph4-client
, you need to first install Rust, then run
cargo install geph4-client
in a terminal. To see a list of the subcommands and flags available, simply run
geph4-client -h
Below is how each subcommand works.
1. connect
Given user credentials and other optional inputs, connect
establishes a network connection to a Geph exit server. If that exit server is blocked from the client, connect
proxies the connection through dynamical bridge servers that are not blocked in the region.
A typical connect
command might look like:
geph4-client connect --exit-server 2.mtl.ca.ngexits.geph.io auth-password --username public5 --password public5
Internally, connect
- makes a
ClientTunnel
that manages asosistab2
Multiplex
session to the specified remote Geph server, and - enables
socks5
andhttp
proxies through thisClientTunnel
, as well as routing VPN packets.
The ClientTunnel
A tunnel starts and keeps alive the best sosistab Multiplex
session it can given the specified connect
parameters.
A sosistab2 Multiplex
is a single end-to-end connection between a client and a server. This can be thought of as analogous to TcpStream, except all reads and writes are datagram-based and unreliable. For more on Multiplex
, see sosistab2
.
The Multiplex
session consists of several routes to the exit server, both through different bridges and without bridges. (If the user is in China, then we only provide routes that use bridges, because all the exit servers are blocked by the Great Firewall.) The sositab protocol then monitors the routes and switches seamlessly to the best working route. Finally, The ClientTunnel
actively updates the set of bridges used by its Multiplex
to switch out servers that get blocked.
Finally, ClientTunnel
exposes channels to the Multiplex
for handling proxy requests and packet forwarding for VPN mode.
Proxies
connect
sets up two proxy servers on localhost. By default, the socks5
server listens on 127.0.0.1:9909
, and http
listens on 127.0.0.1:9910
. These ports can be changed with the --socks5-listen
and --http-listen
flags. These localhost servers accept proxy connections and fulfills requests by forwarding them to the ClientTunnel
, after which they are proxied through the exit server.
When the socks5
server accepts a connection, it establishes a sosistab2
reliable stream along with a task to forward all traffic from the socks5
connection to the sosistab
stream.
The http
server is the socks5
server converted using an adaptation of the socks2http
repo.
VPN
VPN mode takes packets from the source specified by --vpn-mode
and sends them over a UDP-like unreliable connection on the ClientTunnel
.
Starting geph4-client
in VPN mode on Linux might look like:
sudo $(which geph4-client) connect --vpn-mode tun-route --exit-server 2.mtl.ca.ngexits.geph.io auth-password --username public5 --password public5
Note that VPN mode requires us to run geph4-client
with root privileges. We use $(which geph4-client)
because geph4-client
might not be in root
's path.
- On Linux, use
--vpn-mode tun-route
. This startsgeph4-client
in VPN mode, starts a TUN device, and route all packets to it usingiptables
. - On Windows, use
--vpn-mode windivert
. This routes packets to it usingWindivert
. - VPN mode is currently not support for MacOS. Contributions are welcome!
2. sync
sync
takes in a user's credentials and obtains the latest information about the user's subscription status, as well as what exits there are.
To bypass censorship, we connect to the binder using domain fronting. To mitigate attacks in the case that an attacker compromises the central Geph binder, we verify the exit list given by the binder against a public record on the Mel blockchain. You can read more about Geph's use of the blockchain here.
sync
is designed to be used by the GUI interface around geph4-client
.
3. binder_proxy
binder_proxy
creates a BinderClient
that is a JSON-RPC
client to the Geph binder. This is used by gephgui
for things like obtaining exit statistics and user registration and deletion.
4. debugpack
geph4-client debugpack --export-to /your/preferred/path/
exports an SQLite
database containing Geph's debug logs to /your/preferred/path/
.
5. iOS support
geph4-client
also supports compiling as a universal C
library for calling on iOS (this is because you cannot start a new process on iOS; on other platforms we start geph4-client
in a new process). One difference to note is that this version of geph4-client
completely avoids using stdin/out
for any communication, as doing so would crash the app on iOS. Most of the logic surrounding iOS support is in ios.rs
.
Top Related Projects
Outline Client and Manager, developed by Jigsaw. Outline Manager makes it easy to create your own VPN server. Outline Client lets you share access to your VPN with anyone in your network, giving them access to the free and open internet.
Streisand sets up a new server running your choice of WireGuard, OpenConnect, OpenSSH, OpenVPN, Shadowsocks, sslh, Stunnel, or a Tor bridge. It also generates custom instructions for all of these services. At the end of the run you are given an HTML file with instructions that can be shared with friends, family members, and fellow activists.
Set up a personal VPN in the cloud
A Rust port of shadowsocks
Convert designs to code with AI
Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.
Try Visual Copilot