Configure Openvpn With Obfuscation For Censored Networks

OpenVPN is a widely-used open-source VPN protocol that provides encryption and flexibility. However, in regions or networks where VPN traffic is actively blocked, standard OpenVPN connections fail because firewalls can identify the protocol signatures. This is where obfuscation becomes essential.

Obfuscation wraps VPN traffic in a different protocol layer, making it appear like normal HTTPS traffic or another benign protocol. This guide covers practical methods to configure OpenVPN with obfuscation, focusing on server and client setups that work in censored environments.

Understanding OpenVPN Obfuscation Methods

Several obfuscation techniques exist for OpenVPN, each with different trade-offs:

TCP port 443 — Running OpenVPN over TCP port 443 mimics HTTPS traffic. This is the simplest approach but can be detected by deep packet inspection (DPI) in sophisticated firewalls.
Obfsproxy — A Tor project that wraps traffic in an obfuscation layer. It requires additional software on both server and client.
OpenVPN with TLS handshake camouflage — Modifying the TLS handshake to look like regular web traffic, evading protocol detection.
Stunnel or SSL tunneling — Encapsulating OpenVPN inside an SSL tunnel, making it indistinguishable from HTTPS connections.

For most developers and power users, the combination of OpenVPN with obfsproxy or stunnel provides the best balance of compatibility and effectiveness.

Server-Side Configuration

This section walks through setting up OpenVPN with obfsproxy on a Linux server. The example assumes Ubuntu 22.04.

Installing Required Packages

First, install OpenVPN and obfsproxy:

sudo apt update
sudo apt install openvpn easy-rsa obfs4proxy

Generating Certificates

Set up the PKI infrastructure:

cd /usr/share/easy-rsa
sudo ./easyrsa init-pki
sudo ./easyrsa build-ca nopass
sudo ./easyrsa build-server-full server nopass
sudo ./easyrsa build-client-full client1 nopass

Configuring OpenVPN Server

Create the server configuration file:

sudo nano /etc/openvpn/server.conf

Add the following configuration:

port 1194
proto tcp
dev tun
ca /usr/share/easy-rsa/pki/ca.crt
cert /usr/share/easy-rsa/pki/issued/server.crt
key /usr/share/easy-rsa/pki/private/server.key
dh /usr/share/easy-rsa/pki/dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
cipher AES-256-GCM
auth SHA256
keepalive 10 60
persist-key
persist-tun
status /var/log/openvpn/status.log
verb 3

Configuring Obfsproxy

Create the obfsproxy service:

sudo nano /etc/systemd/system/obfs4proxy.service

[Unit]
Description=Obfs4proxy for OpenVPN
After=network.target

[Service]
Type=simple
ExecStart=/usr/bin/obfs4proxy -logLevel=INFO -enableLogging=true -certFile=/var/lib/tor/pt-state/obfs4_measured_certs -nodeType=bridge -proxy=127.0.0.1:1194
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target

Enable and start the service:

sudo systemctl daemon-reload
sudo systemctl enable obfs4proxy
sudo systemctl start obfs4proxy

Client-Side Configuration

On the client machine, install OpenVPN and configure the connection.

Installing OpenVPN Client

# macOS
brew install openvpn

# Ubuntu/Debian
sudo apt install openvpn

# Windows
# Download from https://openvpn.net/community-downloads/

Client Configuration File

Create the client configuration:

nano ~/client.ovpn

client
dev tun
proto tcp
remote your-server-ip 1194
resolv-retry infinite
nobind
persist-key
persist-tun
cipher AES-256-GCM
auth SHA256
verb 3
<ca>
# Paste CA certificate here
</ca>
<cert>
# Paste client certificate here
</cert>
<key>
# Paste client private key here
</key>

For obfsproxy connections, add the obfuscation plugin:

<plugin>
/usr/lib/openvpn/plugins/obfsproxy.so
obfs2
</plugin>

Connecting with Obfuscation

Launch the VPN connection:

sudo openvpn --config ~/client.ovpn

Verify the connection by checking the assigned IP address:

curl ifconfig.me

Alternative: Using Stunnel for Obfuscation

Stunnel provides another effective obfuscation method by wrapping OpenVPN in SSL. This makes traffic appear as regular HTTPS.

Server-Side Stunnel Configuration

Install stunnel:

sudo apt install stunnel4

Configure stunnel:

sudo nano /etc/stunnel/stunnel.conf

[openvpn]
accept = 443
connect = 127.0.0.1:1194
cert = /etc/stunnel/stunnel.pem

Generate a self-signed certificate:

sudo openssl req -new -x509 -days 365 -nodes \
  -out /etc/stunnel/stunnel.pem \
  -keyout /etc/stunnel/stunnel.pem

Start stunnel:

sudo systemctl enable stunnel4
sudo systemctl start stunnel4

Client-Side Stunnel Configuration

On the client, configure OpenVPN to connect to localhost:11443, then tunnel through stunnel to the server on port 443. This creates a double-layer: OpenVPN inside SSL inside your local stunnel client.

Troubleshooting Common Issues

When OpenVPN with obfuscation fails to connect, verify these common problems:

Port blocking — Test if the obfuscation port is reachable using nc -zv server-ip port.
Firewall rules — Ensure the server firewall allows traffic on the configured ports.
Protocol mismatches — Verify that both client and server use the same protocol (TCP/UDP) and port.
Certificate expiration — Check if generated certificates have expired using openssl x509 -in cert.crt -noout -dates.
Logging — Increase verbosity in the configuration (verb 4) and review logs at /var/log/openvpn/status.log.

Security Considerations

While obfuscation helps bypass censorship, it does not replace strong encryption. Always use modern cipher suites (AES-256-GCM with SHA-256 authentication) and maintain proper key management practices. Rotate certificates regularly and never share private keys across multiple clients.

For additional security layers, consider combining obfuscation with Tor or using WireGuard in addition to OpenVPN for different network scenarios.

Testing Your Setup

After configuration, verify that the obfuscation is working correctly. Tools like Wireshark can confirm that traffic appears as HTTPS or the configured obfuscation protocol rather than standard OpenVPN. Test from multiple network environments to ensure reliability across different firewall configurations.

Building a reliable obfuscated VPN requires careful attention to both the encryption layer and the transport layer. The methods outlined here provide a solid foundation for developers and power users needing to maintain secure communications in restrictive network environments.

Built by theluckystrike — More at zovo.one