Green Tunnel

Green Tunnel defeats the filtering hardware that sits between you and a blocked site, and it does it without sending your traffic anywhere else. There is no server in another country, no account, no bandwidth allowance. It runs a proxy on your own machine at 127.0.0.1 on port 8000, rewrites the shape of your first packet, and your connection continues straight to the destination as it always did.

The trick is that most filtering equipment reads the beginning of a connection to find the hostname, then decides. Deep packet inspection is done cheaply, at line rate, on assumptions about how normal software behaves.

Break those assumptions and the filter simply fails to recognise what it is looking at. Nothing is encrypted, nothing is tunnelled, the request is just delivered in a shape the inspection was not written to handle.

Splitting the packet so the filter cannot read it

For plain HTTP, a request carries the hostname in a header, and cheap filters search the packet for a banned word. Green Tunnel sends the request across two TCP segments with the split placed mid-hostname, so one segment ends with “Host: www.you” and the next begins “tube.com”. Neither segment contains the string the filter is hunting for. Reassembling them would reveal it, but a filter built for throughput does not reassemble.

The HTTPS case is where Green Tunnel gets interesting, because the hostname there is not incidental, it is structural. TLS puts the destination name in the Server Name Indication field of the opening handshake, in clear text, before any encryption starts. That field is precisely what SNI-based filtering reads, which is why blocking works on HTTPS at all despite the certificate and the padlock.

So the application chops that first CLIENT-HELLO message into small chunks. The handshake completes normally because the server reassembles it properly, while the equipment in between never sees a parseable SNI field. Same principle as the HTTP case, applied to the one part of an encrypted connection that is not encrypted.

Encrypted DNS, and the resolver you point it at

Hostname filtering is only half of it. The other half happens earlier, when your computer asks for the address and the network’s own resolver answers with a lie or with nothing. Green Tunnel takes that lookup away from the network by resolving over DNS over HTTPS, which is the default, or DNS over TLS if you prefer. The difference matters in practice.

Encrypted lookups over HTTPS travel on the same port as ordinary web traffic and are awkward to single out, while the TLS variant uses its own port and is therefore trivial to block outright. If the encrypted lookups are failing, that port is the first thing to check.

You can also aim it at a resolver of your choosing rather than the default, which is worth doing if the default is itself interfered with. And it exposes a plain DNS listener locally, so other software on the machine can use the same protected lookups. If encrypted DNS is all you actually want, Simple DNSCrypt does that job on its own without touching your traffic.

Nothing passes through anybody else’s server

This is the structural difference from every circumvention tool that people reach for first. A proxy or a VPN moves your traffic to a machine elsewhere and back, which adds latency, depends on that machine’s capacity, and puts an operator in a position to see what you are doing. Green Tunnel adds none of that, because the packets still go directly from your computer to the site.

The consequence people miss is that your address is unchanged. The destination sees exactly where you are, geographic restrictions apply as they always did, and nothing about your browsing is hidden from anyone except the filter you just walked past. Anonymity is not on offer here, and Psiphon exists precisely because sometimes you do need your traffic to appear from somewhere else.

The flags that actually change behaviour

There is a command-line version of Green Tunnel alongside the window, and it is where the useful controls live. The proxy address and port can be moved off the defaults, which matters if something else already owns port 8000. System proxy configuration happens automatically and can be switched off, which you want if you would rather send one browser through it than the whole machine, and FoxyProxy will then route only the hostnames you nominate.

The flag to pay attention to blocks insecure HTTP entirely. Turning it on means any request that would leave as plain text is refused rather than sent, which is a blunt but effective way to guarantee you never hand a hostname to the network in readable form.

There is also a container image with an ARM build, which turns a small board into a bypassing proxy for the whole house. Point a television or a phone at that board’s address on port 8000 and it gets the same treatment as the desktop, provided you opened the port on the board’s firewall.

Where it stops working

Against address-level blocking it is powerless. If the network is dropping packets to the destination’s address rather than inspecting names, no amount of clever segmentation helps, because the filter never needed to read the hostname in the first place. That is the situation where you want a service that moves your traffic to another country instead.

The whole approach also depends on the inspection being lazy. Equipment that reassembles TCP streams before matching reads the hostname exactly as it was always going to, and nothing in Green Tunnel survives that, which makes whether it works a question about your provider rather than about the software.

Conclusion

This suits somebody facing hostname-based filtering who wants their normal connection speed back, and who is comfortable with a command line for anything beyond on and off. On a naive filter it is the most elegant answer available, because it removes the block without adding a middleman, a subscription or a slowdown.

It is the wrong tool if you need to look like you are somewhere else, or if your provider’s equipment is modern enough to reassemble what it inspects. Test it for an evening and you will know which situation you are in, and if the answer is disappointing, a proxy-based circumvention tool is the next thing to try.