Bypass DPI with Zapret on Keenetic/OpenWrt & VPS

To bypass DPI for your entire network using Zapret on Keenetic and OpenWrt routers, you'll need a minimum of 128 MB of free RAM and the installation of specialized packages like zapret-repo for OpenWrt or entware for Keenetic, which enables automatic traffic routing for tens of thousands of blocked domains without configuring each individual device.

What is Zapret and Why Install it on Your Router for DPI Bypass?

With internet traffic under increasing scrutiny and the widespread implementation of Deep Packet Inspection (DPI) systems by ISPs, users often face blocked access to numerous online resources. The Zapret utility offers an effective solution for bypassing these blocks by operating at the network protocol level and modifying requests to circumvent DPI filters. Installing Zapret directly on your router solves the problem of DPI bypass without a VPN for all devices in your home network, providing a "whole-home DPI bypass" effect without individual settings on each smartphone, PC, or tablet.

The advantages of installing Zapret on a router are clear: centralized management, no need for client software on every device, and transparent operation. This is especially relevant for those who want to ensure access to blocked resources for all family members or numerous smart home gadgets. The solution of using Zapret on a VPS and router is becoming increasingly popular, as it allows you to use your own server for more reliable bypass if the router alone is insufficient.

Zapret on Keenetic: Installation and Entware Setup

Keenetic routers, thanks to their flexible NDMS operating system and support for Entware packages, are an excellent platform for deploying Zapret. For a successful Zapret Keenetic installation, you'll need a USB drive (flash drive or external HDD) of at least 4 GB, formatted in ext2/ext3/ext4, which will be used to store Entware packages and Zapret data.

Preparing Keenetic and Installing Entware

Before installing Zapret, ensure your Keenetic router has up-to-date firmware and is connected to the internet. The first step is to install Entware – a package repository for embedded systems. Connect your USB drive to the router.

1. Formatting the USB drive: Through the Keenetic web interface (usually 192.168.1.1), navigate to "System" -> "Storage". If the drive is not formatted with a Linux-compatible file system, format it directly from the router's interface.
2. Installing Entware components: In the same "Storage" section, select your USB drive and activate "Install Entware". The router will automatically download and install the necessary packages.
3. Accessing the command line: Enable SSH or Telnet access to the router in "General settings" -> "Management". Use an SSH client (e.g., PuTTY or the built-in Linux/macOS terminal) to connect:

   ssh [email protected]

   Enter the router's administrator password.

Installing and Configuring Zapret via Entware

After successfully installing Entware, you can proceed with deploying Zapret Entware.

1. Updating package lists and installing Zapret:

   opkg update
   opkg install zapret

   If the zapret package is not found, you may need to add an additional repository. Check official Entware or Zapret resources for up-to-date instructions.
2. Configuring Zapret: The main Zapret configuration file is located at /opt/etc/zapret/config.yaml. You will need to edit it, specifying the domain lists for bypass and, if necessary, proxy server parameters.

   nano /opt/etc/zapret/config.yaml

   Example basic configuration:

   # /opt/etc/zapret/config.yaml
   rules:
     - type: doh
       domains:
         - example.com
         - blocked.org
         - ... # Add your domains here or use pre-made lists
   dns:
     upstream: 1.1.1.1:53
     listen: 127.0.0.1:5353 # Or another free port
   log_level: info

   To use pre-made domain lists, you can specify the path to a file containing the list.
3. Zapret autostart: To make Zapret launch automatically when the router starts, add the startup command to the /opt/etc/init.d/S99zapret file:

   #!/bin/sh
   # /opt/etc/init.d/S99zapret
   #
   # Start Zapret
   #
   
   START=99
   STOP=10
   
   start() {
       if ! pidof zapret >/dev/null; then
           logger -t "Zapret" "Starting Zapret..."
           /opt/bin/zapret --config /opt/etc/zapret/config.yaml &
       fi
   }
   
   stop() {
       if pidof zapret >/dev/null; then
           logger -t "Zapret" "Stopping Zapret..."
           killall zapret
       fi
   }

   Make the script executable:

   chmod +x /opt/etc/init.d/S99zapret

   Or add the startup command to the /opt/etc/rc.local file, if it exists:

   /opt/bin/zapret --config /opt/etc/zapret/config.yaml &

   Reboot the router to check autostart.
4. DNS Redirection: For all devices on the network to use Zapret for bypass, you need to redirect DNS queries to the port Zapret is listening on (e.g., 127.0.0.1:5353). This can be done in the router's DHCP settings, by specifying the router's IP address as the primary DNS server, and Zapret will intercept queries internally within the router.

After these steps, your Keenetic will be using Zapret on your router to bypass DPI for the entire network.

Zapret on OpenWrt: Installation, Configuration, and Automation

OpenWrt is an open-source operating system for routers, providing maximum flexibility and control. Installing Zapret OpenWrt requires deeper knowledge, especially if you plan to build the firmware with Zapret from source. However, pre-built packages are also available, simplifying the process.

Requirements and Zapret Installation on OpenWrt

For an OpenWrt router, you'll need a minimum of 8 MB of Flash memory (16 MB+ recommended) and at least 128 MB of RAM for comfortable Zapret operation with large domain lists. Connect to the router via SSH.

1. Updating package lists:

   opkg update

2. Installing Zapret: In most cases, Zapret is available in the official OpenWrt repositories.

   opkg install zapret

   If the package is not found, you may need to add the zapret-repo repository or install Zapret from a manually downloaded deb package. This is especially relevant for custom builds or specific architectures.
3. Zapret Configuration: The configuration file /etc/zapret/config.yaml is similar to Keenetic.

   nano /etc/zapret/config.yaml

   Ensure that ports do not conflict with other services on the router.

Automating Zapret on OpenWrt: Init Script and Hotplug

To ensure stable DPI bypass router operation, Zapret must start with the router and correctly handle network changes.

1. Init script for autostart: Create the file /etc/init.d/zapret:

   #!/bin/sh /etc/rc.common
   # /etc/init.d/zapret
   
   START=99
   STOP=10
   
   start() {
       if ! pidof zapret >/dev/null; then
           logger -t "Zapret" "Starting Zapret..."
           /usr/bin/zapret --config /etc/zapret/config.yaml &
       fi
   }
   
   stop() {
       if pidof zapret >/dev/null; then
           logger -t "Zapret" "Stopping Zapret..."
           killall zapret
       fi
   }
   
   restart() {
       stop
       start
   }

   Make the script executable and enable it for autostart:

   chmod +x /etc/init.d/zapret
   /etc/init.d/zapret enable

2. DNS and Firewall Configuration: To redirect all DNS traffic through Zapret, configure dnsmasq and firewall.

   In /etc/config/dhcp:

   config dnsmasq
       option rebind_protection '1'
       option localuse '1'
       list server '127.0.0.1#5353' # Port Zapret DNS listens on

   In /etc/config/firewall, add a rule to intercept DNS traffic:

   config redirect
       option name 'Zapret DNS Redirect'
       option src 'lan'
       option proto 'tcp udp'
       option src_dport '53'
       option dest_ip '127.0.0.1'
       option dest_port '5353'
       option target 'DNAT'

   Apply changes and restart services:

   /etc/init.d/dnsmasq restart
   /etc/init.d/firewall restart

3. Hotplug (optional): For more advanced scenarios, such as when the WAN interface state changes, you can use hotplug scripts. Create the file /etc/hotplug.d/iface/99-zapret:

   #!/bin/sh
   # /etc/hotplug.d/iface/99-zapret
   
   [ "$ACTION" = "ifup" -a "$INTERFACE" = "wan" ] && {
       logger -t "Zapret Hotplug" "WAN interface up, restarting Zapret..."
       /etc/init.d/zapret restart
   }

   Make it executable:

   chmod +x /etc/hotplug.d/iface/99-zapret

   This ensures that Zapret restarts and updates its routes if the WAN connection was temporarily interrupted.

Now your OpenWrt router is fully configured for Zapret OpenWrt and provides DPI bypass for your entire network.

Quick pick

Need a dedicated server?

Bare metal with NVMe in 70+ locations — configure and order in minutes.

Browse servers

How Zapret Works: Principles of DPI Bypass

Zapret employs several techniques to bypass Deep Packet Inspection (DPI) systems that ISPs use to filter traffic. The main methods include:

• Modification of SNI (Server Name Indication) and HTTP Host: DPI often analyzes SNI fields in TLS handshakes and HTTP Host in HTTP headers to identify the requested domain. Zapret can alter these fields by adding random characters or substituting them with unblocked domains to conceal the true target resource.
• Packet Fragmentation: Some DPI systems are unable to correctly analyze heavily fragmented packets. Zapret can split TLS ClientHello or other critical parts of a request into smaller fragments, making inspection difficult.
• Using Alternative DNS Servers: Zapret can redirect DNS queries to trusted DNS servers (e.g., DoH/DoT) that are not subject to censorship, preventing DNS-level blocking.

However, it's important to understand that Zapret, like any bypass technology, has its limitations. It works most effectively against blocks based on SNI, HTTP Host, and DNS analysis. If an ISP uses more sophisticated methods, such as IP address blocking or active traffic behavioral analysis, Zapret may be ineffective. Additionally, Zapret handles HTTP/HTTPS traffic better and is less effective with other protocols, such as UDP traffic from game servers or specialized VPN protocols.

When Zapret Isn't Enough: A Fallback VPS Tunnel for Your Entire Network

Despite its effectiveness, Zapret is not a panacea for all types of blocking. In cases where an ISP employs more aggressive methods, such as IP address blocking, or when bypass is required for specific protocols other than HTTP/HTTPS, Zapret on a router may be insufficient. This is where your own VPS with a configured tunnel comes to the rescue, providing "DPI bypass for the entire network" through a full-fledged VPN or proxy.

Using your own Virtual Private Server (VPS) to create a tunnel via protocols like VLESS (with XTLS) or Hysteria2 offers a more reliable and versatile solution. These protocols are designed with modern DPI systems in mind, offering traffic obfuscation, masking, and high performance. By configuring such a tunnel on your router (Keenetic or OpenWrt), you can redirect all your home network's traffic through the VPS, effectively hiding it from your ISP.

To implement this fallback path, you will need:

• VPS: A virtual server with a Linux operating system (e.g., Ubuntu, Debian). Recommended minimum specifications: 1 vCPU, 1 GB RAM, 10-20 GB NVMe/SSD disk.
• VPS Location: It is crucial to choose a VPS location that is outside the zone of blocks and censorship. European countries (Germany, Netherlands, Finland) or North America are often good choices.
• Protocols: Install VLESS, Hysteria2, or another modern VPN protocol specifically designed for DPI bypass on your VPS server. Then configure the client on your router. Detailed instructions on setting up VPN on a router via your own VPS for OpenWrt, Keenetic, and Mikrotik are available in our blog.

This solution provides maximum flexibility and resilience against blocking, ensuring uninterrupted access to any resources for all devices in your home.

Choosing a VPS for a Fallback Tunnel: Optimal Specifications

For 10-20 concurrent connections through a VPS tunnel, 1 vCPU, 1 GB RAM, and a 20 GB NVMe disk are sufficient.

When choosing a VPS for a fallback tunnel, not only specifications but also provider reliability and network infrastructure quality are critically important. Valebyte offers a wide range of VPS plans that are ideal for deploying VLESS, Hysteria2, or other tunnel protocols. Our servers in Europe and North America provide low latency and high throughput, which are key for stable DPI bypass. When selecting a plan, consider the number of devices that will simultaneously use the tunnel and the anticipated traffic volume. For example, for a small family with 5-10 active devices, a plan with 1 vCPU, 1 GB RAM, and a 20 GB NVMe disk will be an optimal choice, offering an excellent price-to-performance ratio.

Quick pick

Need a dedicated server?

Bare metal with NVMe in 70+ locations — configure and order in minutes.

Browse servers

Comparison Table: ISPs, Blocking Types, and Effective Solutions

Different internet service providers use various blocking methods, which affects the effectiveness of Zapret and the necessity of using a VPS tunnel. The table below presents typical scenarios and recommended solutions.

Frequently Asked Questions

Q: Which Keenetic routers are suitable for Zapret with Entware?

A: To install Zapret via Entware on Keenetic, you need a router with a USB port and Entware support, as well as a minimum of 128 MB of RAM. Most modern Keenetic models, such as Keenetic Viva, Giga, Ultra, Speedster, are ideal. Ensure you have a USB drive of at least 4 GB for installing Entware and storing Zapret files.

Q: Can Zapret be installed on OpenWrt without rebuilding the firmware?

A: Yes, in most cases, Zapret can be installed on OpenWrt as a regular package via opkg install zapret, if it's available in the official repositories or a specially added zapret-repo. Rebuilding the firmware is only necessary for older or highly customized devices where pre-built packages are unavailable, or if specific optimizations not included in standard builds are required.

Q: How much bandwidth does Zapret consume on a router?

A: Zapret itself consumes a minimal amount of traffic—only a few megabytes per month for updating domain lists and logs. The main traffic is generated by your devices when accessing blocked resources. If you use a fallback VPS tunnel, all your internet traffic will pass through the VPS, so ensure your VPS plan includes sufficient bandwidth (e.g., 1 TB per month is usually enough for home use).

Q: What is the advantage of VLESS/Hysteria2 over standard OpenVPN/WireGuard for DPI bypass?

A: VLESS and Hysteria2 are designed with modern DPI methods in mind and feature traffic obfuscation and masking, making them less detectable by blocking systems. They offer better performance and stability under active DPI compared to classic VPN protocols like OpenVPN or WireGuard, which can be easily recognized and blocked by ISPs. Hysteria2 also uses UDP, which is often preferred for lower latency.

Conclusion

Installing Zapret directly on a Keenetic or OpenWrt router is an effective way to centrally bypass DPI for your entire home network, eliminating the need for manual configuration on each device. However, in situations with aggressive blocking or when access to specific protocols is required, combining Zapret with a fallback VPS tunnel based on VLESS or Hysteria2 becomes the optimal solution. Choosing a reliable Valebyte VPS with optimal specifications (from 1 vCPU, 1 GB RAM) and a location outside blocking zones will ensure maximum resilience and uninterrupted access to any internet resources.

SSD NVMe

Ready to launch your VPS?

NVMe VPS with 60-second activation: full root access, 20+ locations, pay with card or crypto.

Choose a plan