= Introduction =

Sometimes it's useful to obfuscate the fact that your traffic is generated by OpenVPN. For example, if your ISP is blocking OpenVPN for some reason. This article describes various ways to obfuscate OpenVPN traffic so that it's not as easily detected and blocked. Most of the content here originates from [http://thread.gmane.org/gmane.network.openvpn.devel/5386 this email thread]. Additionally, for some reason [http://sourceforge.net/mailarchive/message.php?msg_id=28851866 this mail] was not included in Gmane archives.

= Use static keys =

This was suggested [http://thread.gmane.org/gmane.network.openvpn.devel/5386 here].

{{{
"My recent suggestion to someone regarding this was to use a 
static-key tunnel to encapsulate a second secure channel (either 
openvpn with TLS or ssh(1) as needed.) The static key tunnel looks 
like random junk to a sniffer. Nothing should identify it as being 
openvpn."One

"That said, it DOES look suspicious. Maintain a moving target if 
possible ... changing ports and IP addresses. Also, because of the 
potential weakness of static keys, you should rotate them on a 
timetable, such as weekly or monthly."
}}}

= Use obfsproxy =

[https://www.torproject.org/projects/obfsproxy-instructions.html.en Obfsproxy] is a [https://www.torproject.org/ Tor] subproject. It can be used to obfuscate (any) traffic so that it becomes unrecognizable. Obfuscating OpenVPN traffic using obfsproxy was suggested [http://thread.gmane.org/gmane.network.openvpn.devel/5386 here], with one additional mail available [http://sourceforge.net/mailarchive/message.php?msg_id=28851866 here]:

{{{
"However, the obfsproxy project sounds very interesting.  And it should be
possible to use obfsproxy (as it can talk like a SOCKS proxy) with
OpenVPN, by using the --socks-proxy argument.  But I'm not aware of any
openvpn services providing obfsproxy services in conjunction with OpenVPN."
}}}

A user provided an OpenVPN installer which bundles OpenVPN with obfsproxy. Look [http://sourceforge.net/mailarchive/message.php?msg_id=28851866 here] for downloads and instructions.

= Using a patched OpenVPN version =

A [http://thread.gmane.org/gmane.network.openvpn.devel/7285 patch] is available for making OpenVPN handle traffic obfuscation internally.