### Entware Installation and Execution

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Instructions for installing the youtubeUnblock binary on Entware systems and starting the service using its init script.

```sh
# Install the binary with `opkg install youtubeUnblock-*.ipk`.
# After installation, the binary in /opt/bin and the init script in /opt/etc/init.d/S51youtubeUnblock will be available.
# To run the youtubeUnblock, simply run `/opt/etc/init.d/S51youtubeUnblock start`
```

--------------------------------

### Compilation and Installation

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Commands to compile and install youtubeUnblock. Requires development tools and kernel headers with netfilter nfqueue support.

```make
make
```

```make
make install
```

--------------------------------

### OpenWRT CLI Service Management

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Provides examples of managing the youtubeUnblock service from the command line on OpenWRT, including enabling the service to start on boot.

```sh
# You can check the logs in CLI mode with `logread -l 200 | grep youtubeUnblock` command.
# In CLI mode you will use youtubeUnblock as a normal init.d service:
/etc/init.d/youtubeUnblock enable
```

--------------------------------

### OpenWRT/Entware Installation and Architecture Check

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Commands to check the hardware architecture on OpenWRT systems and install the youtubeUnblock program using the opkg package manager. It also covers manual unpacking for read-only filesystems.

```shell
grep ARCH /etc/openwrt_release
```

```shell
opkg install youtubeunblock
```

```shell
opkg -o <destdir> install youtubeunblock
```

--------------------------------

### OpenWRT UCI Configuration Example

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Demonstrates how to set configuration strategies and arguments for youtubeUnblock using the UCI command-line interface on OpenWRT. This includes setting custom arguments and committing the changes.

```sh
uci set youtubeUnblock.youtubeUnblock.conf_strat="args"
uci set youtubeUnblock.youtubeUnblock.args="--queue-num=537 --threads=1"

# To save the configs you should do `uci commit` and then `reload_config` to restart youtubeUnblock

```

--------------------------------

### Build OpenWRT .ipk Package for youtubeUnblock

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

This sequence of shell commands adds the youtubeUnblock repository to the OpenWRT build system's feeds, updates the feed list, installs the package, and initiates the compilation process to create an .ipk file. This .ipk file can then be installed on an OpenWRT router.

```sh
echo "src-git youtubeUnblock https://github.com/Waujito/youtubeUnblock.git;openwrt" >> feeds.conf
./scripts/feeds update youtubeUnblock
./scripts/feeds install -a -p youtubeUnblock
make package/youtubeUnblock/compile
```

--------------------------------

### Build Kernel Module on Host System

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

This command compiles the kernel module `kyoutubeUnblock.ko` on a host system. It requires `linux-headers` and a `gcc` compiler suite to be installed. The `make kmake` command initiates the build process.

```sh
make kmake
```

--------------------------------

### Build youtubeUnblock Kernel Module for OpenWrt

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

This snippet outlines the essential shell commands required to build the youtubeUnblock kernel module for OpenWrt. It involves adding the module's source feed, updating the package feeds, installing the module, configuring the OpenWrt build system, and finally compiling the specific package. The output is an .ipk file that can be installed on the router.

```sh
echo "src-git youtubeUnblock https://github.com/Waujito/youtubeUnblock.git;openwrt" >> feeds.conf
./scripts/feeds update youtubeUnblock
./scripts/feeds install -a -p youtubeUnblock
make defconfig
make package/kyoutubeUnblock/compile V=s
```

--------------------------------

### Load and Configure Kernel Module Parameters

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

This snippet shows how to load the kernel module `kyoutubeUnblock.ko` and then configure its runtime parameters. Parameters are passed as a string to `/sys/module/kyoutubeUnblock/parameters/parameters` using `echo` and `tee` with `sudo` for elevated privileges.

```sh
insmod kyoutubeUnblock.ko 
echo "--fake_sni=1 --exclude_domains=.ru --quic_drop" | sudo tee /sys/module/kyoutubeUnblock/parameters/parameters
```

--------------------------------

### OpenWRT nftables Dependencies

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Lists the required kernel modules for systems using nftables as the firewall backend.

```text
kmod-nft-queue
kmod-nf-conntrack
```

--------------------------------

### Build Kernel Module for External Kernel

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

This command builds the kernel module `kyoutubeUnblock.ko` against an external, pre-built Linux kernel. The `KERNEL_BUILDER_MAKEDIR` environment variable is used to point the build process to the directory containing the external kernel's build configuration and Makefiles.

```sh
make kmake KERNEL_BUILDER_MAKEDIR=~/linux
```

--------------------------------

### Cross-Compile youtubeUnblock with OpenWRT Toolchain

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

This command demonstrates cross-compilation of the youtubeUnblock project using a pre-built OpenWRT toolchain. It sets essential environment variables like STAGING_DIR, CC, LD, AR, OBJDUMP, NM, STRIP, and CROSS_COMPILE_PLATFORM to target a specific architecture (e.g., mipsel for ramips/mt76x8).

```sh
STAGING_DIR=temp make CC=/usr/bin/mipsel-openwrt-linux-gcc LD=/usr/bin/mipsel-openwrt-linux-ld AR=/usr/bin/mipsel-openwrt-linux-ar OBJDUMP=/usr/bin/mipsel-openwrt-linux-objdump NM=/usr/bin/mipsel-openwrt-linux-nm STRIP=/usr/bin/mipsel-openwrt-linux-strip CROSS_COMPILE_PLATFORM=mipsel-buildroot-linux-gnu
```

--------------------------------

### OpenWRT iptables Dependencies

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Lists the required kernel modules and iptables user-space packages for systems using iptables as the firewall backend.

```text
kmod-ipt-nfqueue
iptables-mod-nfqueue
kmod-ipt-conntrack-extra
iptables-mod-conntrack-extra
```

--------------------------------

### View Kernel Module Parameters and Statistics

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

These commands allow users to inspect the configured parameters of the `kyoutubeUnblock` kernel module and view its runtime statistics. The first command reads the current parameters, while the second reads statistics from the module's entry in `/proc`.

```sh
cat /sys/module/kyoutubeUnblock/parameters/parameters
```

```sh
sudo cat /proc/kyoutubeUnblock
```

--------------------------------

### UDP and QUIC Handling Strategies

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Configuration options for managing UDP traffic, including QUIC protocol. This section details strategies for dropping or faking UDP packets, filtering ports, and specific QUIC handling modes.

```APIDOC
--udp-mode={drop|fake}
  Description: Specifies the UDP handling strategy. 'drop' discards UDP packets (useful for QUIC fallback to TCP). 'fake' fakes UDP packets.
  Type: Enum (drop, fake)
  Default: fake
```

```APIDOC
--udp-fake-seq-len=<amount of faking packets sent>
  Description: Sets the number of faking packets sent over the network for UDP.
  Type: Integer
  Default: 6
```

```APIDOC
--udp-fake-len=<size of udp fake>
  Description: Defines the size of the UDP fake payload, typically consisting of zeroes.
  Type: Integer
  Default: 64
```

```APIDOC
--udp-dport-filter=<5,6,200-500>
  Description: Filters UDP destination ports. Specify ports or ranges to be handled by youtubeUnblock.
  Type: String (comma-separated ports or ranges)
  Default: No ports filtered
```

```APIDOC
--udp-faking-strategy={checksum|ttl|none}
  Description: Faking strategy for UDP packets. 'checksum' fakes UDP checksum. 'ttl' fakes UDP content size without changing TTL. 'none' applies no faking.
  Type: Enum (checksum, ttl, none)
  Default: none
```

```APIDOC
--udp-filter-quic={disabled|all|parse}
  Description: Enables QUIC filtering for the UDP handler. 'disabled' means QUIC is not processed. 'all' handles all QUIC initial packets. 'parse' decrypts, parses QUIC initial messages, and matches against --sni-domains.
  Type: Enum (disabled, all, parse)
  Default: disabled
```

```APIDOC
--quic-drop
  Description: Alias for --udp-filter-quic=all --udp-mode=drop. Drops all QUIC packets directed to youtubeUnblock without affecting other UDP packets.
  Type: Flag
```

```APIDOC
--no-dport-filter
  Description: Disables the default filtering of UDP destination ports 443 for TLS and QUIC. This flag does not affect --udp-dport-filter.
  Type: Flag
```

--------------------------------

### NFNETLINK_QUEUE Kernel Module Loading

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Command to manually load the nfnetlink_queue kernel module, which is a common dependency for netfilter queueing functionality used by youtubeUnblock.

```sh
modprobe nfnetlink_queue
```

--------------------------------

### youtubeUnblock: Section Scoped Flags

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Manages multiple sets of strategies for specific filters using `--fbegin` and `--fend` flags. Each section can have its own configuration, with priority given to later sections. The default settings are applied when a new section is initiated without explicit parameters.

```APIDOC
--fbegin
  Description: Initiates a new set of strategies for specific filters. Allows for multiple, prioritized configurations.
  Example: --sni-domains=googlevideo.com --faking-strategy=md5sum --fbegin --sni-domains=youtube.com --faking-strategy=tcp_check

--fend
  Description: Marks the end of a section of strategies. Used in conjunction with `--fbegin` to delineate strategy sets.
  Note: The priority of these sets goes backwards; the last section defined is the first to be applied.
```

--------------------------------

### Testing youtubeUnblock Functionality

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Commands to verify the functionality of youtubeUnblock by comparing download speeds. The first command tests traffic routed through youtubeUnblock, while the second tests direct access.

```sh
curl -o/dev/null -k --connect-to ::google.com -k -L -H Host:\ mirror.gcr.io https://test.googlevideo.com/v2/cimg/android/blobs/sha256:6fd8bdac3da660bde7bd0b6f2b6a46e1b686afb74b9a4614def32532b73f5eaa
```

```sh
curl -o/dev/null -k --connect-to ::google.com -k -L -H Host:\ mirror.gcr.io https://mirror.gcr.io/v2/cimg/android/blobs/sha256:6fd8bdac3da660bde7bd0b6f2b6a46e1b686afb74b9a4614def32532b73f5eaa
```

--------------------------------

### Configure nftables to drop QUIC traffic

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

This snippet shows how to configure nftables to drop QUIC (UDP port 443) traffic for a specific IP address, which can help resolve issues with some TVs that rely on QUIC.

```shell
nft insert rule inet fw4 forward ip saddr 192.168.. udp dport 443 counter drop
```

--------------------------------

### Configure NAT Offloading for OpenWRT

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Modify the firewall template on OpenWRT to allow NAT hardware/software offloading to coexist with youtubeUnblock. This workaround limits offloading to packets beyond the initial ones processed by youtubeUnblock.

```shell
Edit /usr/share/firewall4/templates/ruleset.uc by replacing
meta l4proto { tcp, udp } flow offload @ft;
with
meta l4proto { tcp, udp } ct original packets ge 30 flow offload @ft;
```

```shell
service firewall restart
```

--------------------------------

### SYN Payload Options

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Configure the behavior of sending SYN payloads before requests. This can help in certain network environments by mimicking legitimate traffic, potentially bypassing restrictive firewalls. Options control the presence and size of the fake SYN packet.

```APIDOC
--synfake={1|0}
  Description: If 1, a SYN payload will be sent before each request. This payload is typically discarded by the endpoint but may be handled by TSPU. This option applies to all sites regardless of --sni-domains.
  Type: Boolean (1 for true, 0 for false)
  Default: 0
```

```APIDOC
--synfake-len=<len>
  Description: Sets the size of the fake packet sent in the SYN payload. Lower this value if you experience issues. A value of 0 means an entire fake packet is sent.
  Type: Integer
  Default: 0
```

--------------------------------

### Manage youtubeUnblock Processes

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Commands to check for and terminate running youtubeUnblock instances. This is a common solution for EPERM errors caused by multiple instances competing for the same netfilter queue number.

```bash
ps -e | grep youtubeUnblock
```

```bash
killall youtubeUnblock
```

--------------------------------

### SNI Detection and Domain Filtering

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Options for detecting Server Name Indication (SNI) and managing domain lists for specific handling. This includes choosing detection methods and specifying domains to include or exclude from SNI processing.

```APIDOC
--sni-detection={parse|brute}
  Description: Specifies how to detect SNI. 'parse' detects SNI by parsing the Client Hello message. 'brute' checks the entire message for SNI occurrence. Note: 'brute' without --sni-domains has O(nm) complexity.
  Type: Enum (parse, brute)
  Default: parse
```

```APIDOC
--sni-domains=<comma separated domain list>|all
  Description: A list of domains to be handled by SNI. Use 'all' to handle every ClientHello. Can be used with --exclude-domains.
  Type: String (comma-separated list or 'all')
  Default: googlevideo.com,ggpht.com,ytimg.com,youtube.com,play.google.com,youtu.be,googleapis.com,googleusercontent.com,gstatic.com,l.google.com
```

```APIDOC
--exclude-domains=<comma separated domain list>
  Description: A list of domains to be excluded from SNI targeting.
  Type: String (comma-separated list)
```

```APIDOC
--sni-domains-file=<file contains comma or new-line separated list>
  Description: Specifies a file containing a list of domains for SNI handling. The file can use comma or new-line separation.
  Type: File Path (String)
```

```APIDOC
--exclude-domains-file=<file contains comma or new-line separated list>
  Description: Specifies a file containing a list of domains to be excluded from SNI targeting. The file can use comma or new-line separation.
  Type: File Path (String)
```

--------------------------------

### nftables Firewall Rules

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Configures nftables chains and rules for the youtubeUnblock service. It sets up a 'mangle' chain to queue specific TCP (dport 443) and UDP packets, directing them to a specified queue number for processing.

```sh
nft add chain inet fw4 youtubeUnblock '{ type filter hook postrouting priority mangle - 1; policy accept; }'
ft add rule inet fw4 youtubeUnblock 'tcp dport 443 ct original packets < 20 counter queue num 537 bypass'
ft add rule inet fw4 youtubeUnblock 'meta l4proto udp ct original packets < 9 counter queue num 537 bypass'
ft insert rule inet fw4 output 'mark and 0x8000 == 0x8000 counter accept'
```

--------------------------------

### youtubeUnblock: Fragmentation Options

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Controls the fragmentation strategy for packets, including TCP, IP, or no fragmentation. It also allows for reversing fragment order, adding fake data, and specifying split positions within the SNI data.

```APIDOC
--frag={tcp,ip,none}
  Description: Specifies the fragmentation strategy for the packet. 'tcp' is default. 'ip' fragmentation might be blocked by DPI. 'none' disables fragmentation.
  Default: tcp

--frag-sni-reverse={0|1}
  Description: Reverses the order in which ClientHello fragments are sent.
  Default: 1

--frag-sni-faked={0|1}
  Description: Sends fake packets near the ClientHello, filling the payload with zeroes.
  Default: 0

--frag-middle-sni={0|1}
  Description: Splits the packet in the middle of the SNI data.
  Default: 1

--frag-sni-pos=<pos>
  Description: Specifies the exact position at which to split the packet.
  Default: 1

--fk-winsize=<winsize>
  Description: Specifies the window size for fragmented TCP packets. This setting is applicable if you want the response to be fragmented and may slow down connection initialization.
```

--------------------------------

### youtubeUnblock: Faking Strategies and TTL

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Defines the strategy for invalidating fake packets and tunes the Time To Live (TTL) for these messages. These settings are crucial for evading DPI systems and ensuring packet delivery or non-delivery as intended.

```APIDOC
--faking-strategy={randseq|ttl|tcp_check|pastseq|md5sum}
  Description: Determines the strategy for invalidating fake packets. Options include:
    - randseq: Sets random sequence/acknowledgment numbers.
    - ttl: Invalidates packets after a specified number of hops (`--faking-ttl`).
    - pastseq: Uses a sequence number referencing a packet sent in the past.
    - tcp_check: Invalidates faking packets with an invalid checksum.
    - md5sum: Invalidates faking packets with an invalid TCP md5sum.
  Default: randseq

--faking-ttl=<ttl>
  Description: Tunes the Time To Live (TTL) for fake SNI messages. A higher TTL allows packets to traverse more network hops before expiring, potentially bypassing DPI systems.
  Default: 8

--fake-seq-offset
  Description: Tunes the offset from the original sequence number for fake packets, used by the randseq faking strategy. If set to 0, a random sequence number is used.
  Default: 10000
```

--------------------------------

### GNU General Public License v3

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

The licensing terms under which the youtubeUnblock program is distributed, allowing redistribution and modification under the GNU GPL v3 or later versions.

```text
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.
```

--------------------------------

### Configure iptables to drop QUIC traffic

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

This snippet demonstrates how to configure iptables to drop QUIC (UDP port 443) traffic for a specific IP address, useful for troubleshooting TV connectivity issues.

```shell
iptables -I FORWARD --src 192.168.. -p udp --dport 443 -j DROP
```

--------------------------------

### youtubeUnblock: TLS and Fake SNI Settings

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Configures TLS traffic processing and enables advanced fake SNI techniques. These flags help in bypassing network restrictions by manipulating the TLS ClientHello packets.

```APIDOC
--tls={enabled|disabled}
  Description: Controls whether TLS traffic is processed within the current section. Useful for UDP-based sections.
  Default: enabled

--fake-sni={0|1}
  Description: Enables fake SNI, forcing youtubeUnblock to send multiple packets (Fake ClientHello, 1st part of original ClientHello, 2nd part of original ClientHello) instead of one. May help resolve EPERMS errors.
  Default: 1

--fake-sni-seq-len=<length>
  Description: Specifies the length of the complicated construction of fake client hello packets. Determines how many fakes will be sent.
  Default: 1

--fake-sni-type={default|custom|random}
  Description: Selects the faking message type for fake packets. 'random' uses random length/payload. 'default' uses a standard payload (sni=www.google.com). 'custom' uses payload from `--fake-custom-payload`.
  Default: default

--fake-custom-payload=<payload>
  Description: Manually specifies the payload for fake messages when `--fake-sni-type=custom` is used. Payload should be in hex format.
  Example: --fake-custom-payload=0001020304

--fake-custom-payload-file=<binary file containing TLS message>
  Description: Specifies the payload for fake messages using a binary file instead of hex format. The file must contain raw binary TLS message (TCP payload).
```

--------------------------------

### Strip Debug Symbols from Kernel Module

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

This command uses the `strip` utility to remove debugging symbols from the compiled kernel module `kyoutubeUnblock.ko`. This process can significantly reduce the file size of the module, which is beneficial for deployment on resource-constrained devices.

```sh
strip --strip-debug kyoutubeUnblock.ko
```

--------------------------------

### Iptables Firewall Rules (IPv4 & IPv6)

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Provides iptables and ip6tables rules for the youtubeUnblock service. It creates a custom 'mangle' chain to queue specific TCP (dport 443) and UDP packets based on connection packet counts, and marks outgoing traffic.

```sh
iptables -t mangle -N YOUTUBEUNBLOCK
iptables -t mangle -A YOUTUBEUNBLOCK -p tcp --dport 443 -m connbytes --connbytes-dir original --connbytes-mode packets --connbytes 0:19 -j NFQUEUE --queue-num 537 --queue-bypass
iptables -t mangle -A YOUTUBEUNBLOCK -p udp -m connbytes --connbytes-dir original --connbytes-mode packets --connbytes 0:8 -j NFQUEUE --queue-num 537 --queue-bypass
iptables -t mangle -A POSTROUTING -j YOUTUBEUNBLOCK
iptables -I OUTPUT -m mark --mark 32768/32768 -j ACCEPT

ip6tables -t mangle -N YOUTUBEUNBLOCK
ip6tables -t mangle -A YOUTUBEUNBLOCK -p tcp --dport 443 -m connbytes --connbytes-dir original --connbytes-mode packets --connbytes 0:19 -j NFQUEUE --queue-num 537 --queue-bypass
ip6tables -t mangle -A YOUTUBEUNBLOCK -p udp -m connbytes --connbytes-dir original --connbytes-mode packets --connbytes 0:8 -j NFQUEUE --queue-num 537 --queue-bypass
ip6tables -t mangle -A POSTROUTING -j YOUTUBEUNBLOCK
ip6tables -I OUTPUT -m mark --mark 32768/32768 -j ACCEPT
```

--------------------------------

### Accept Marked Packets with nftables

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

An nftables rule to explicitly accept packets marked by youtubeUnblock. This is the ultimate solution for EPERM errors when sending fake SNI packets, preventing them from being dropped by firewall rules.

```nftables
nft insert rule inet fw4 output mark and 0x8000 == 0x8000 counter accept
```

--------------------------------

### Disable Conntrack Dependency

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Compile youtubeUnblock with conntrack disabled if it causes dependency issues. This is useful in custom stacks where conntrack is broken or not available.

```make
make kmake EXTRA_CFLAGS="-DNO_CONNTRACK"
```

--------------------------------

### Packet Segmentation Delay

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

Configures a delay for sending the second part of a split packet. This option is useful for fine-tuning packet timing in specific network conditions.

```APIDOC
--seg2delay=<delay>
  Description: Forces youtubeUnblock to wait for a specified duration before sending the second part of a split packet.
  Type: Time duration (e.g., milliseconds, seconds)
```

--------------------------------

### Accept Marked Packets with iptables

Source: https://github.com/waujito/youtubeunblock/blob/main/README.md

An iptables rule to explicitly accept packets marked by youtubeUnblock. This is the ultimate solution for EPERM errors when sending fake SNI packets, preventing them from being dropped by firewall rules.

```iptables
iptables -I OUTPUT -m mark --mark 32768/32768 -j ACCEPT
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.