mjhjmtu

I have a wonderful ISP blocking all UDP traffic (except DNS to its own DNS servers).

However, I want to use UDP for my VPN solution. I have root over both VPN endpoints, and both of them are using Linux.

My idea is to simply overwrite the packet type field in my outgoing UDP packets to look as TCP, and doing the reverse on the server side.

Thus, the routers/firewall of my wonderful ISP will see bad TCP packets, while my VPN processes will be able to communicate on UDP.

I strongly suspect, that the firewall of the ISP is not enough smart to detect, that something is not okay.

Of course it would be a dirty trick, but not more dirty than simply forbidding the second most used IP protocol and selling this as ordinary internet connection.

As far I know, there are some iptables rules for that, but which one?

I doubt iptables alone will be enough, as TCP and UDP are fundamentally different protocols.

You can forget setting up an IPsec VPN with such scenario (ISP blocking all UDP ports).

Tunnel all the traffic via ICMP. (best old school solution I know of. Lots of organizations still do not filter out any kind of ICMP) see https://github.com/DhavalKapil/icmptunnel

'icmptunnel' works by encapsulating your IP traffic in ICMP echo
packets and sending them to your own proxy server. The proxy server
decapsulates the packet and forwards the IP traffic. The incoming IP
packets which are destined for the client are again encapsulated in
ICMP reply packets and sent back to the client. The IP traffic is sent
in the 'data' field of ICMP packets.

RFC 792, which is IETF's rules governing ICMP packets, allows for an
arbitrary data length for any type 0 (echo reply) or 8 (echo message)
ICMP packets.

So basically the client machine uses only the ICMP protocol to
communicate with the proxy server. Applications running on the client
machine are oblivious to this fact and work seamlessly.

also, as A.B. points out, you have a UDP-to-raw tunneling software at https://github.com/wangyu-/udp2raw-tunnel

Or in alternative, setup an OpenVPN solution. If you manage to talk outside run OpenVPN over port 53/UDP, or on the lack of that, run it over TCP. Mind you that doing a VPN over TCP will be slower than UDP, but it works.

As for the actual question of changing an IP field: You want to look at the mangle table in iptables, however: 1) I suspect your ISP is blocking that too 2) I know mangle supports modifying some IP fields, not sure about the one you need. See https://serverfault.com/questions/467756/what-is-the-mangle-table-in-iptables

More alternatives, you can try GRE tunnels (protocol 47), see https://www.tldp.org/HOWTO/Adv-Routing-HOWTO/lartc.tunnel.gre.html ( it is easier than trying to develop an application ). Some organizations block this. Basically it is encapsulating IP/ICMP/UDP over protocol 47.

Or if nothing else works, you can tunnel it via an IP tunnel over SSH (mind you tun over SSH, not TCP port tunneling). see Ip Tunnel Over Ssh With Tun http://www.marcfargas.com/posts/ip-tunnel-over-ssh-with-tun/ By the way, no technology of smart/adaptative/deep inspection traffic shapper/firewall that will detect and block all the methods on this thread will be able to block a TUN over SSH.

PS. It is hard to believe an ISP blocking UDP, and furthermore, NTP and DNS UDP ports.

This will popably not work. The Firewall surely will track the TCP setup packets (SYN,SYN-ACK,ACK) needed for a correct TCP Connection, which are missing if you just use altered UDP Packets.

What you could do is: Write a small Application which picks up UDP on the one side, connects to the other side via TCP, and another application which accepts the incoming TCP Connection and Forwards TCP traffic to UDP.