tags: opensource, security, python, bash

If you live in a region with strict internet censorship (like China, Iran, or Russia), you probably know that the golden age of traditional VPNs is over. Protocols like OpenVPN, IPSec, and even WireGuard are easily identified and blocked by Deep Packet Inspection (DPI) systems within milliseconds.

To keep our users connected, my team and I built Obelisk PN — a privacy service based on the Xray-core and the VLESS REALITY protocol.

Today, we are open-sourcing our core engine (server deployment and routing logic). In this post, I want to share the architectural decisions that make our network invisible to DPI.

1. The Nginx Facade (Active Probing Defense)

Modern censors don't just passively analyze traffic; they actively probe suspicious IP addresses. If a censor detects encrypted traffic going to an unknown server, they send HTTP/TLS requests to that IP.…