I'm recently running openvpn in openwrt-x86-generic, and I want to use obfsproxy to obfuscate the traffic.

The problem is that the package of obfsproxy in openwrt(which I use as a openvpn server) has been abandoned for quite a long time, so the latest version I can get through opkg is 0.1.4. However, in a PC running windows xp(which is a client), the oldest version of obfsproxy I can get through pip install is 0.2.1. When I try to connect the server, it always cast an error saying corrupted magic number, which is likely to be the version problem.

I've tried from 0.2.1 to 0.2.13 in client, none of which worked. There seems to be no specific document on this problem, and it seems complicated now since the package in openwrt in nolonger maintained.

Could anyone give me some advice on how to solve it, or offer some reference about obfsproxy?

BTW, I'm using obfs2 method, but I don't think that is the key problem.

Thanks. Tgn

1 Answer 1


obfs2 should be considered dead and buried. A passive observer can remove the obfuscation (and an active attacker can remove obfs3).

The "Corrupted magic value" is actually part of the protocol, it's not related to the "version number", it expects that a "magic" value (obfs2.py, obfs2.h) is part of the decrypted message.

You can read more about obfs2 here, it includes example code that should allow you to reconstruct and review the key exchange from a packet capture.

They should be interoperable, using 0.2.13 obfs2.py as the client and 0.1.4 obfsproxy as the server:

setup the server:

$ ./obfsproxy obfs2 --dest= server
2016-xx-xx xx:xx:xx [notice] Starting (obfsproxy version: 0.1.4 (git-94ebc4c3edf1e3e5)).

setup the client:

$ ./bin/obfsproxy obfs2 --dest client
2016-xx-xx xx:xx:xx,xxx [WARNING] Obfsproxy (version: obfsproxy-0.2.13-1-g2bf9d09) starting up.
2016-xx-xx xx:xx:xx,xxx [WARNING] Pyptlib version: 0.0.6

connect into the client and send some data:

$ ncat 31339 -c 'echo "Hello, this is dog."'

and the receiving end-point receives it over obfs2:

$ ncat -l 31337
Hello, this is dog.

So "Hello, this is dog." was sent into the waiting 0.2.13 obfs2.py client listener, across to the 0.1.4 obfsproxy server listener and out to the destination.

You should, however, stop using obfs2 and upgrade to obfs4. For how to cross-compile it, try this answer and incorporate setting environment variables in the launch script, in line with pt-spec.txt.

  • Thanks a lot! I find the cause of corrupted magic number is the --shared-secret option, if I don't specify this option, it works well, and openvpn along with obfsproxy is working now. However, I find that the traffic is not routed through obfsproxy(for example, ping www.github.com would still use ICMP package without obfuscation) even if I specify redirect-gateway def1 local in server config. If I use merely openvpn without obfsproxy, the whole traffic is indeed redirected through openvpn, so I doubt it might be the configuration of obfsproxy, but I couldn't figure out the reason.
    – Tgn Yang
    Aug 6, 2016 at 11:09
  • Since your answer has solved my original problem, I'll take it as the right answer.
    – Tgn Yang
    Aug 6, 2016 at 11:15
  • I'll have a look at --shared-secret option, but I've no idea about openvpn.
    – cacahuatl
    Aug 6, 2016 at 17:24
  • Yeah, I can reproduce the issue by using --shared-secret (which looks to be used as some kind of MAC), at a glance of both code bases I think one of them is hashing it differently from the other. I'll update with more info and a possible fix if I can, once I've given it a proper read.
    – cacahuatl
    Aug 6, 2016 at 23:39
  • Thanks for your help. I'm wondering where I can get the code bases of same programming language. The latest obfsproxy seems to use python while the old one in obfsproxy-legacy is using C, would that be a possible reason for the incongruous implemention of hasing method? And is there a C version of the latest obfsproxy?
    – Tgn Yang
    Aug 8, 2016 at 3:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .