Advanced Evasion Suite

Overview of DNS-MNS advanced censorship evasion tools

Overview

The Advanced Evasion Suite gives you access to the most effective censorship circumvention technologies currently available. Multiple protocols are supported, each working through different mechanisms — so you have options depending on your network conditions.

Available Tools

1. VLESS + REALITY (Most Effective)

Effectiveness: 99.5% success rate against Iran’s DPI

The most effective protocol currently available. REALITY masks the TLS fingerprint by mimicking legitimate HTTPS connections to major websites.

Best for: Daily use when maximum reliability is needed

dns-mns singbox start --protocol vless \
  --server example.com:443 \
  --uuid YOUR_UUID \
  --public-key REALITY_KEY \
  --sni www.microsoft.com

Learn more →

2. Hysteria2 (QUIC + Salamander)

Effectiveness: 95%+ against Iran’s protocol filter

QUIC-based proxy with Salamander obfuscation. Excellent performance for gaming and streaming due to QUIC’s congestion control.

Best for: Gaming, streaming, low-latency needs

dns-mns singbox start --protocol hysteria2 \
  --server gaming.example.com:443 \
  --password your-password

Learn more →

3. Other Sing-box Protocols

Access multiple protocols through sing-box integration:

• VMess: Versatile proxy protocol
• Trojan: HTTPS-masking proxy
• ShadowTLS: Certificate stealing — hides traffic behind legitimate TLS handshakes
• TUIC: QUIC-based alternative

# ShadowTLS via sing-box
dns-mns singbox start --protocol shadowtls \
  --server proxy.example.com:443 \
  --password secret

# VMess
dns-mns singbox start --protocol vmess \
  --server proxy.example.com:443 \
  --uuid YOUR_UUID

4. Tunnel Suite (DNSTT / Slipstream / Paqet)

DNS-MNS includes a unified Tunnel Suite (nested under Advanced Evasion) with profile-based tunnel operations:

• Profile create/list/select/import/export
• Resolver scan and health checks (with optional auto-switching)
• Runtime start/stop/status/logs (requires upstream tunnel binaries installed in PATH)

CLI example:

dns-mns tunnel profile create --name demo-dnstt --transport dnstt --mode client --remote 127.0.0.1:5300
dns-mns tunnel scan --name demo-dnstt
dns-mns tunnel test --name demo-dnstt

Learn more →

5. TLS Fragmentation

For: Breaking SNI-based blocking at the TCP/TLS layer

Split the TLS ClientHello across multiple TCP segments, defeating SNI inspection.

# Enable fragmentation on any proxy
dns-mns doh-proxy --fragment sni
dns-mns proxy --fragment sni --fingerprint firefox

Learn more →

Choosing the Right Protocol

Situation	Recommended
Maximum reliability	VLESS + REALITY
Gaming / low latency	Hysteria2
Profile-based tunneling	Tunnel Suite (DNSTT / Slipstream / Paqet)
HTTPS-looking traffic	ShadowTLS (via singbox)
SNI blocking	TLS Fragmentation
UDP blocked	Hysteria2 or VLESS

Evasion Status

Check the status of all running evasion tools:

# CLI mode
dns-mns singbox status

Configuration Examples

Scenario 1: Maximum Reliability

dns-mns singbox start --protocol vless \
  --server your-server.com:443 \
  --uuid your-uuid \
  --public-key your-key \
  --sni www.microsoft.com

Scenario 2: Maximum Stealth

# ShadowTLS via sing-box
dns-mns singbox start --protocol shadowtls \
  --server proxy.example.com:443 \
  --password secret

Scenario 3: Gaming / Low Latency

dns-mns singbox start --protocol hysteria2 \
  --server gaming.example.com:443 \
  --password your-password

Troubleshooting

All Protocols Failing

1. Check basic connectivity: ping 1.1.1.1
2. Run diagnostics: dns-mns diagnose
3. Try a different network: Test on mobile hotspot
4. Check system time: Incorrect time causes TLS failures

Protocol Connects but Slow

1. Try a different server: Geographic distance affects speed
2. Disable fragmentation: Try --fragment none for speed
3. Switch protocol: Each protocol performs differently per network

Frequent Disconnections

1. Check for QoS shaping: Try different ports (443, 8443)
2. Use the fallback proxy: dns-mns proxy auto-switches protocols
3. Run diagnostics: dns-mns diagnose > debug.txt

---

No single protocol works everywhere all the time. Try different options to find what works best for your specific network conditions.