Re: VPN+Psiphon+ProxyBridge & Psiphon+ProxyBridge+VPN now both work!

Marian wrote:
> So the Psiphon rules.txt file needed to be modified extensively.

Correction. 

The "ProxyBridge" rules.txt file had to be extensively modified.
[Not the Psiphon rules.txt file (which doesn't exist).]

I never would have started this project of creating a robust proxy on
Windows had I known how many problems would have to be surmounted, but
finally, after a couple of months (elapsed time), it's all resolved.
 VPN + {Psiphon/SOCKS5 + ProxyBridge} required extensive modifications
 {Psiphon/SOCKS5 + ProxyBridge} + VPN required even more modifications

But it all works well now (although WinHTTP can't use PAC or SOCKS still)
 VPN first, Psiphon SOCKS5 proxy second & ProxyBridge last works well now.
 Psiphon SOCKS5 proxy first, ProxyBridge second & VPN last works well too.

The fundamental problems first & foremost were not only that Psiphon's
SOCKS5 proxy does not handle UDP tunneling, but that the Windows TAP
adapter (Terminal Access Point) takes time to come up with ProxyBridge.
 *Cannot connect OVPN (UDP) through SOCKS5 proxy*
 <https://github.com/OpenVPN/openvpn/issues/661>

 *What is TAP-Windows Adapter*
 <https://www.thewindowsclub.com/tap-windows-adapters-vpn-driver>

In theory, SOCKS5 proxies "should" be able to work with OpenVPN.
 *SOCKS5, HTTP, UDP Proxies in OpenVPN*
 <https://www.proxyfella.com/2024/11/30/socks5-http-udp-proxies-in-openvpn/>

Each operating system requires DIFFERENT commands to solve these issues.
For example, "ip-win32 adaptive" is a Windows-only OpenVPN directive.

Linux-based operating systems work better than Windows, where, for example,
on Android, Psiphon's tunneling is more complete (TCP + UDP), but Windows
support is limited such that some users have resorted to using dns2socks
for DNS resolution (but this has its own inherent problems as noted here).
 *psiphon-tun2socks*
 <https://github.com/Nebula-Mechanica/psiphon-tun2socks>

Windows is just a lousy platform for networking, it turns out, where, for
example, I had to extensively modify Windows just to make it work well.
 a. I had to sync WinINET & static WinHTTP proxy settings
 b. I had to set AutoConfigURL and AutoDetect registry keys
 c. I had to set the PAC file using the Windows registry
 d. I had to sync PAC from file:///C:/data/sys/batch/proxy.pac
 e. I had to run Mongoose to serve PAC at http://127.0.0.1/proxy.pac
 f. I had to route other traffic via SOCKS 127.0.0.1:1080
 g. And even then, WinHTTP can't use PAC or SOCKS, so I have to fix that
    etc.

Basically, Windows sucks as these things, but one by one we can work around
them, which is what the set of files I posted in this thread purport to do.
 1. Win+R > psiphon.bat (this starts Psiphon SOCKS5 & syncs the above)
 2. Win+R > pb.bat (this starts ProxyBridge which reads in rules.txt)
 3. rules.txt (this tells ProxyBridge what to send thru the socks proxy)
 4. pac.cmd (this sets a registry key to point to the PAC file)
 5. proxy.pac (this sets PAC rules of what domains to skip proxy)
 6. launchmongoose.vbs (this locally serves proxy.pac as http & https)
 7. Win+R > psiphonstop.bat (this gracefully undoes all of the above setup)

This is a general purpose solution in that it uses 100% freeware so anyone
can run all of the above without cost simply by installing the software.
 1. OpenVPN freeware + freely available UDP/TCP OpenVPN config files
 2. Psiphon freeware + scripts to sync WinINET + WinHTTP + PAC files
 3. ProxyBridge freeware + scripts to add missing rules.txt functionality
 4. Mongoose freeware + scripts to serve the localhost PAC file as HTTPS

In summary, this is a complete DIY proxy + VPN system for all Windows
executables (whether or not they inherently work with SOCKS5 proxies), 
but even now, WinHTTP apps (e.g., Windows update) do not use PAC/SOCKS 
and will and will connect directly unless I add something like Polipo.

What I conclude, personally, from this endeavor, is that while everything
you want to accomplish can be done with effort, Windows sucks at this type
of networking. It would have been much easier to do on a Linux-based PC.
-- 
Everything is possible if you're intelligent, but it's not always worth it.