Obfuscated SSH tunnel

VPN providers were cracked down, open source anti-censorship tools were eliminated. This is what’s happening in China and has become even more severe than ever. Shadowsocks alone is no longer reliable due to more powerful deep packet inspection implemented at the GFW.

I am now replacing shadowsocks on my gateway with obfuscated SSH tunnel, based on Tor‘s obfsproxy. To the impatient ones, I will first give a concise summary of the necessary steps of my set up. You can follow it without drilling down the details. I will explain in more details later. But please note that you have to follow the other instructions in this blog post to complete the whole set up.

Quick Set up

On your server

Assume your server runs Debian 8 (jessie) or Ubuntu, and its IP is, run these commands:

On Raspberry Pi gateway

Edit ~/.ssh/config:

Run these commands:

Boost WIFI Speed by Forcing 40 MHz Channels in hostapd on RPi

802.11n can double the channel bandwidth of 802.11g from 20 MHz to 40 MHz, but this operation mode is not recommended in areas that the spectrums are congested and likely interfere with existing WIFI and bluetooth devices. As a result, hostapd will not enable 40 MHz when it finds other channels are being used, like what is seen from the hostapd log below:

However, this is unrealistic in modern cities. You should be grateful the primary channel you choose has not been used already, let alone the additional one for 40 MHz. What can we do? We have to force hostapd to turn on 40 MHz anyway. But since hostapd does not have any configuration options for that, we have to recompile hostapd from source. Actually, this has been done in other distros. For example, OpenWRT and Arch has patched their hostapd with the noscan patch, which adds an option to force 40MHz mode regardless of the environment.

Before turning on 40 MHz, the iwconfig on my laptop is like this, notice the bit rate is only 54 Mb/s:

Now let us start. First you need to add a deb-src source to apt so that we can download source packages. Note that I am still using Raspbian Wheezy. If you use Jessie, change the deb-src line according to your original deb line.

Save the following patch into a file:

Because we are going to create a new hostapd package, it’d be a good practice to increment the version number by adding a new section at the top of debian/changelog, like this:

Now we are ready to compile the packages:

If it succeeds, install the new package with dpkg -i.

Restart hostapd, it should now force 40 MHz mode:

And my iwconfig output now shows Bit Rate is 150 Mb/s, yay!

Deploy Shadowsocks on Raspberry Pi with ChinaDNS and Redsocks

Assume you already have a Raspberry Pi configured as a WIFI router like mine shown below, but you live in China and have to deal with the fact that many websites can’t be accessed due to GFW. Don’t be despair and with some hacking you can get your Internet freedom back.


The mechanism is to use shadowsocks on your router which directs any traffic to a shadowsocks server in the free world. It’s simple to get it up and running on a local machine, but on a router you need to use redsocks to redirect traffic to the shadowsocks client running on your Raspberry Pi. DNS traffic has to be routed by redsocks as well otherwise your DNS replies will be contaminated. To remain as fast as normal when accessing China websites you also need to skip routing traffic to Redsocks for anything within the China IP ranges. Even if you don’t care about performance, this is still necessary in some circumstances like geoip restriction such as tv.sohu.com does not deliver contents if you live outside of China.

Finally, we want to improve the performance even further by using ChinaDNS. To avoid DNS poisoning, we can always resolve DNS over our secured shadowsocks connection, but this is not optimal if a China website have CDNs outside China. ChinaDNS queries local DNS servers to resolve Chinese domains and queries foreign DNS servers to resolve foreign domains, and from my testing it is useful to avoid DNS poisoning with the “DNS compression pointer mutation” option.


I assume that you have shadowsocks server running on a public server, so I will skip that part and only talk about the client side.

Installing shadowsocks is very simple, note that it will be installed under /usr/local/.

Start up shadowsocks while listening on local port 1080:


Install redsocks, simply apt-get from the archive:

Then you need to change the START option in /etc/default/redsocks from NO to YES, so that redsocks will start automatically at boot time and also can be started by sudo /etc/init.d/redsocks start:

Then update /etc/redsocks.conf. Most of the default settings work fine, just need to change local_ip in the redsocks section to your address of the network interface that accepts traffic from your local network. The default is, but that does not work well if you want to re-route traffic from other machines on your network, so change it to something like:

But we want traffic from other hosts in your network to be redirected by redsocks to your local shadowsocks client, which in turn sent to the the remote shadowsocks server. We need to pay special attention to DNS traffic, as DNS poisoning is prevalent in China. We need to take special care to redirect DNS traffic through redsocks/shadowsocks.

We also want all China traffic NOT to go through shadowsocks for performance. This can be easily done by looking at the destination IP, if it is in the China IP range we skip going through the REDSOCKS china. First we need to get all network segments allocated to China and save it to a file called chnroute.txt:

These all can be accomplished by iptables. You need to run the following iptables commands, or put them in a local script and run it with sudo.

Run iptables -t nat -L -n to make sure the rules have been added correctly. Now start up redsocks by sudo /etc/init.d/redsocks start and let’s test it out by doing some web browsing on another computer in your local network. If that works fine, congratulations and you have set up everything correctly! If not, look at shadowsocks output and also turn on redsock’s log_debug and check if there is anything useful in /var/log/daemon.log.


ChinaDNS is not absolutely necessary, but as explained at the beginning it is desirable. There is no pre-built package so we need to compile it. It is simple to do:

After it is successfully compiled, test it out:

If it goes well, run src/chinadns -m -c chnroute.txt when your router boots.

That’s it!

解決 WordPress 中 Google Web Font 被 GFW 屏蔽問題

自從本 blog 的 wordpress 升級並更換 theme 後,偶爾發現 page load 得很慢,用 chrome 自帶的 developer tool 查了一下才發現原來 theme 用了 google web font,因爲 google service 被牆了所以在大陸瀏覽就像卡住了一樣。由於我絕大部份時間都是科學上網,所以一開始沒有發現問題。

Google font is blocked in China

既然 google web font 不能用,最簡單就是乾脆不用,把相關代碼拿掉就行,不過這樣做的後果是網站會極其難看。上策還是把 google web font 放到 wordpress server,再將 CSS 配置好。Google 一下發現有個很棒的 shell script 能幫個大忙:https://neverpanic.de/blog/2014/03/19/downloading-google-web-fonts-for-local-hosting/,它能幫你把需要的字體下載下來並產生一個立馬能用的 CSS 文檔。

WordPress 最少有兩個地方會加載 google web font,第一是 wordpress 本身用到的 Open Sans,另外是個別 theme 可能會用到的字體。視乎你的 theme 有沒有用 google font,有可能兩個地方都要處理。

目前我用的 theme 基於 twentyfourteen(我把原來左邊的 navigation 拿掉,header 加了 facebook, twitter 等幾個 icon),best practice 是在 wordpress 的 themes 目錄開一個叫 twentyfourteen-child 的新目錄,裏面只放用來 override parent theme 的東西。


  1. 下載剛才介紹過的網站的 shell script,我把它命名爲 downloadgooglefont.sh
  2. 先下載 wordpress 會下載的所有 Open Sans 字體(包括不同粗幼和斜體),在 downloadgooglefont.sh 裏要指定它們:

  3. 針對你使用的 theme,需要把 theme 用到的 google 字體寫進去。你要查一下你的 theme 會用到什麼字體,例如 twentyfourteen 會用到的字體在 themes/twentyfourteen/functions.php 的 215 行有提到:

    總共有7個字體,所以 script 需要加上:

  4. 執行該 script:

    這些就是下載完的所有文檔,包括適用於 chrome/chromium, firefox, safari 會用到的字體,還有一個 CSS file:

  5. 把上面所有的字體上傳到 wordpress server 的 wp-content/themes/twentyfourteen-child/ 目錄。
  6. 把 font.css 複製到 wp-content/themes/twentyfourteen-chile/style.css。
  7. 由於 twentyfourteen 在 functions.php 通過 wp_enqueue_style 加上 fonts.googleapis.com 的 link 來加載 Lato 字體,要想辦法把它拿掉:

    不過我不喜歡直接修改 parent theme,所以我選擇在 twentyfourteen-child 把它 dequeue 掉。注意 add_action 的 priority 必須低於 10,dequeue 才會成功。 theme_enqueue_styles 的前兩行是用來禁止 Open Sans 字體從 google server 加載,第3行才是禁止 Lato。

Osaka, Kyoto and Nara Travel Tips

After more than 10 years I traveled to Japan again. This time I went with my wife to Kyoto, Nara and Osaka. Here are some tips about travelling to these areas I want to share and also serve as notes to myself if I will ever go there again in future, which I will definitely do as Kansai is so beautiful and relaxing.

Keep connected

Getting mobile internet connection was not easy in the past since you need Japan residency to get a SIM from telco, but nowadays the market is more open and there are now many options. In this travel, I used a SIM card called Fuji card (富士卡), which I bought from Taobao at 76 CNY (about 1450 JPY or 12 USD). This card has 1.8GB 3G data, valid for 7 days, but does not have any voice call and cannot be recharged after you have used it up. This card is backed by China Unicom and Softbank, in my experience the data connection and coverage is very good. If you live in Hong Kong, you can find this card in Sham Shui Po as well.

If this card does not suit your purpose, you can find other alternatives:

  1. Fuji card has a cheaper sibling which has 1GB data only, sold at 66 CNY, and a more expensive sibling which has double the data to 3.2GB, sold at 155 CNY.
  2. Before the existence of Fuji card, there was Sakura card (櫻花卡). Sakura card still exists and offers 3GB of data with 7-day validity. From what I read it is slower than Fuji card’s 7.2Mbps and lesser coverage.
  3. There is also a nameless SIM which offers unlimited data. The first 100MB data each day uses 3G speed but afterwards it falls back to 2G speed. It is cheaper but I bet no one want to suffer from slow speed especially during traveling.
  4. If your phone does not support WCDMA or you are not good at fiddling mobile phone settings, you can rent a WIFI router. More expensive, and you have to return it after the trip which I find inconvenient.
  5. So-net also sells pre-paid SIM cards at the airport, at a higher price than the Fuji card.

About Hotel

Valentine’s day is not a good day to travel to Japan not (just) because restaurants are fully booked but room rates could be more expensive than normal days 2 to 3 times, even for budget hotels like Toyoko Inn. I was very lucky that I found a really nice ryokan called Kitanoya (北野家) where the rates remained the same on the special day. Only available at Jalan, so knowing some basic Japanese is a pre-requisite. In general, check Jalan and Airbnb and you might find hidden gems.

Hotel near Kansai Airport

My flight landed almost at midnight so I chose to stay in a hotel close to the airport and began our journey the next day. There are not many options, the hotel at the airport is too expensive so I chose to stay at First Hotel. It is located in Izumisano (泉佐野) and very close to the Izumisano railway station, so you can take a train there, or if it is too late like my case, you can take the late night airport bus, the last stop is exactly the Izumisano railyway station.

The bus station is just outside the exit of the departure hall. After exiting the airport, turn right, look for the stand numbered ’12’. No need to buy ticket beforehand, pay when you take off, so better make sure you have 1000 yen notes or coins, which I did not have. Luckily the bus driver was able to find a lady who had ten 1000 yen notes to change for my 10000 yen note, otherwise I don’t know what would end up.

Travel to/from Kansai Airport/Kyoto

If your destination is either Osaka or Kyoto and your flight will land at the Kansai International airport, you will likely buy the “ICOCA and Haruka” ticket set to take advantage of the Haruka train (non-reserved seat) from airport to Osaka or Kyoto.

In my journey I made a mistake of buying the one-way instead of the round-trip, thinking that I would take the Nankai railway back as many people suggest. Later I found out my hotel actually is closer to Tennoji (天王寺) where there is JR station, so at the end I took the JR Hanwa line rapid train to the airport, that costs 1060 JPY, and in total it is more expensive than the round-trip “ICOCA and Haruka” ticket set.

The ticket set is sold on the 2nd floor of the JR office at Kansai airport, show them the passport when buying.

The railway system in Japan is complicated and could be astounding to new individual travelers, so
do your homework carefully in advance.

Travel in Kyoto

Kyoto is well connected with buses, they are very frequent and can reach all the popular attractions in the city. I took the bus almost exclusively in Kyoto, so I highly recommend buying the one-day bus pass. The pass costs 500 JPY and each bus ride costs 220 JPY, so the pass makes sense if you take more than 3 bus rides, not to mention you free your mind from worrying coins.

There are other passes that let you take subway as well, but since there are only two subway lines in Kyoto, I find bus to be more convenient and so subway passes may not be worth buying.

Travel in Nara

As Nara is not big and most attractions are close to each other, most people go to Nara as a day trip and stay in Osaka or Kyoto at night. For me, I stayed in Osaka and went to Nara in the morning by taking Kintetsu train to Nara Kintetsu station. Kintetsu has discount tickets called Nara-Ikaruga one-day pass (奈良・斑鳩1dayチケット) that offers unlimited bus rides in Nara and round-trip Kintetsu trains from/to Nara. Like Kyoto, you can go to many places just by bus so this ticket is highly recommended.

Depending on which city you buy the ticket, there are additional benefits. As I bought in Osaka, I could also enjoy unlimited rides on bus, subway and new tram in Osaka.

In Osaka, the ticket can be bought at the subway station supervisor office (駅長室), which is surprisingly located after passing the gate, which could be hard to find in maze-like Osaka subway stations.

Travel in Osaka

Osaka has a good subway system that covers most key destinations so getting a one-day pass is a smart choice.

The most basic form of the one-day pass is the Enjoy Eco card, which costs 800 JPY on week days and 600 JPY on weekends and national holidays. It can be bought directly from ticket machines. This card can be used on New Tram and bus as well, and offers discounts to some attractions like Osaka Castle and Floating Garden Observatory.

If you ever come across the Osaka Visitors’ Ticket and wonder what it is, forget it if you do not live in Hong Kong, Taiwan or Korea. It has the same benefits as the Enjoy Eco card, but with a lower price and is only sold in these 3 regions.

There are many other passes, such as Osaka Amazing Pass and Osaka Kaiyu Ticket, see which one suits you best here.

Money Matters

If you buy the “ICOCA and Haruka” ticket set, you will then have the ICOCA e-money card with 1500 JPY in it, which can be used to take trains and subways. But it is not too useful as a means in buying stuffs as many shops do not accept it, except convenient stores like 7-11. In Osaka, I found vending machines accepts PiTaPa rather than ICOCA as well.

Before leaving Japan, ICOCA can be returned at JR office and you can get 500 JPY deposit back. 220 JPY will be charged as handling fee from the remaining amount in your card, so if you have spent all the money in the card then it means no handling fee. If you think you will visit Kansai again in 10 years, you can keep the card and recharge it next time when you come back to Japan.

That’s it! Hope you enjoy Japan and find my tips useful.