ValdikSS/GoodbyeDPI

What it does

GoodbyeDPI is a Windows command-line tool that bypasses Deep Packet Inspection (DPI) systems used by some ISPs to block access to websites. It targets both passive DPI (which replies faster than the real destination to inject redirects or TCP resets) and active DPI placed inline in the connection. It works by fragmenting packets, tweaking HTTP Host headers, and sending decoy packets with manipulated TTL, checksum, or sequence numbers so DPI cannot classify the traffic. Because it operates locally, it keeps your original IP address rather than routing traffic through a VPN.

It is aimed at Windows users whose ISP filters specific sites and who need a lightweight workaround rather than a full VPN. The project is written in C and relies on the WinDivert driver to redirect packets to userspace.

Quick start

1. Download the latest build from the Releases page and unpack it.
2. For Russia, run 1_russia_blacklist_dnsredir.cmd; for other countries, run 2_any_country_dnsredir.cmd (quick start scripts). These launch GoodbyeDPI in a recommended mode and redirect DNS to Yandex DNS on a non-standard port to avoid DNS poisoning.
3. If it works, keep the console window open; closing it stops the tool. You can then customize behavior via command-line options.

To test manually, first enable Secure DNS in your browser (Chrome: Privacy and security → Use secure DNS → NextDNS; Firefox: Network Settings → Enable DNS over HTTPS → NextDNS), then run goodbyedpi.exe with no options (checking steps). If your ISP intercepts DNS, use --dns-addr with a public resolver on a non-standard port, or set up DNS over HTTPS/TLS separately.

For persistent use, the repository includes scripts to install it as a Windows service (e.g. service_install_russia_blacklist.cmd, service_remove.cmd) (service instructions).

Options and modes

goodbyedpi.exe -h prints the full option list (arguments). The most commonly used modesets are pre-grouped flags: -5 with --auto-ttl, -6 with --wrong-seq, and the default -9, which combines --wrong-seq, --wrong-chksum, --reverse-frag, and -q. The README describes the older -1 to -4 modesets as legacy. Use --blacklist with a hostname file to apply circumvention only to selected sites, and --max-payload to reduce CPU load on large transfers.

Requirements and constraints

• Windows 7, 8, 8.1, 10, or 11 with administrator privileges (requirements). Very old Windows 7 installs without SHA256 driver signature support cannot load WinDivert; updating the system or installing KB3033929 addresses this (known issues).
• The tool runs as long as its console window is visible and terminates when the window is closed.
• Intel/Qualcomm Killer network cards' Advanced Stream Detect is incompatible; disable it (issue note). QUIK trading software may also conflict — start QUIK before GoodbyeDPI (issue note).
• The more aggressive options (--set-ttl, --auto-ttl) are flagged as dangerous because they may break websites; use carefully or combine with --blacklist. Some header tricks can break certain sites despite being HTTP-compliant.
• The build requires GNU Make, mingw, and WinDivert headers/libraries (build instructions).

HotRepo's take

The project has drawn substantial attention on Hacker News over several years: a 2022 thread reached 297 points and 118 comments, and an earlier 2019 thread reached 112 points (2022 discussion). That discussion is worth reading for context on where the tool fits. One commenter argued its main advantage is preserving your own IP address, avoiding the VPN-related problems like bank blocks and local-content restrictions (comment). Others questioned how such simple tricks — swapping Host to hoSt or adding spaces — still work against DPI (comment), and noted that deployment at scale may keep these techniques viable for a while (comment). These are opinions from commenters, not maintainer claims, but they frame the practical trade-off: GoodbyeDPI is a local evasion tool, not a privacy or anonymity layer.