SMTP Tunnel Proxy – Fast SMTP‑Based SOCKS5 to Evade DPI

Introduction

In an age where Deep Packet Inspection (DPI) can block web traffic, researchers and privacy advocates need solutions that blend invisibility with performance. The SMTP Tunnel Proxy fills that niche by converting any TCP stream into an SMTP conversation, letting data slip through SMTP‑approved ports (usually 25, 587, or 465). Built in pure Python, it’s quick to deploy and requires no kernel changes.

Problem Statement

• Many corporate and national firewalls filter traffic on port 80/443, blocking HTTPS.
• Traditional VPNs and SSH tunnels are discovered or throttled by DPI.
• Censorship circumvention requires tools that appear innocuous.

Solution: Use the standard SMTP protocol as a cover, leveraging TLS for encryption and standard mail relay ports that firewalls rarely scrutinize.

Architecture Overview

Browser   →   SOCKS5 Client   →   SMTP Tunnel Server   →   Internet
     TCP traffic   disguised as SMTP   over TLS   normal outbound

Key components: * Server – Listens on TCP 587, performs a STARTTLS handshake, then switches to a custom binary protocol. * Client – A local SOCKS5 proxy (port 1080 by default) that forwards traffic through the server. * User Layer – Each username gets a unique pre‑shared key, optional IP whitelist, and per‑user logging.

Core Features

Quick Start Guide

1. Server Setup (Linux VPS)

# 1. Pick a domain pointing at your VPS (DuckDNS, No‑IP, etc.)
# 2. Run the one‑liner installer
curl -sSL https://raw.githubusercontent.com/x011/smtp-tunnel-proxy/main/install.sh | sudo bash

2. Add Additional Users

sudo smtp-tunnel-adduser alice   # creates a ZIP with client config
sudo smtp-tunnel-adduser bob

3. Client Setup (Windows/Linux/macOS)

Option A – Easy (recommended) 1. Extract the alice.zip file. 2. Run start.bat (Windows) or ./start.sh (Linux/macOS).

Option B – Manual

cd alice
pip install -r requirements.txt
python client.py

4. Point Your Applications to the SOCKS Proxy

• Browser → http://127.0.0.1:1080 (Firefox, Chrome).
• System‑wide → Environment variable ALL_PROXY=socks5://127.0.0.1:1080.
• Test with curl -x socks5://127.0.0.1:1080 https://ifconfig.me.

Advanced Configuration

• IP Whitelisting – Edit users.yaml and add CIDR blocks under each user.
• Logging – Toggle logging: true/false per user.
• Custom Ports – Change socks_port or server_port in config.yaml.
• Upgrade – smtp-tunnel-update syncs the latest code while preserving config.

Security Recommendations

1. Use a domain – TLS certs require a hostname; IP addresses trigger verification errors.
2. Keep ca.crt – Distribute the CA file to clients to avoid MITM.
3. Restrict IPs – Whitelist known client IPs if feasible.
4. Protect users.yaml – Set file permissions to 600.
5. Disable logging for sensitive users – Prevent log‑leaking.

Troubleshooting FAQ

Conclusion

The SMTP Tunnel Proxy demonstrates that you can build a reliable, high‑speed tunnel that masquerades as legitimate SMTP traffic. Its pure‑Python implementation, straightforward one‑liner Installer, and robust feature set make it an excellent choice for developers, sysadmins, and privacy advocates looking to bypass restrictive networks without complex VPN configuration.

Feel free to fork the repository, contribute enhancements, or adapt it for your own censorship‑circumvention needs. Happy tunneling!