Zapret Technical Glossary

DPI (Deep Packet Inspection) is a technology for inspecting network packets in depth: the provider's equipment analyzes not just addresses but the contents of traffic — SNI, TLS fingerprints, protocol signatures — to detect and block connections to specific services. Zapret bypasses DPI by modifying packets so the inspection system fails to recognize the blocked connection, while the destination server still receives valid data.

WinDivert is an open-source driver and library for Windows that lets user-mode programs capture, modify and re-inject network packets. Zapret uses WinDivert to intercept outgoing packets and apply the selected bypass strategy to them. WinDivert is not a virus, but because of its capabilities some antivirus products flag it as a RiskTool — a false positive. In games with anti-cheat, WinDivert may require a special hiding mode (windivert-hide).

winws.exe is the Windows build of the nfqws engine from the original zapret project (bol-van). When you run general.bat or install a strategy for autostart via service.bat, it is winws that starts with the selected strategy's parameters. A manually started winws.exe shows up on the taskbar as an open console window with a padlock icon; installed as a system service, it runs invisibly in the background. The binaries in the bin folder come from zapret-win-bundle/zapret-winws and official releases — their authenticity can be verified against the published checksums.

A strategy is a specific combination of winws launch parameters: which fake packets to send, how to fragment the TLS ClientHello, which domain lists to use. In the zapret-discord-youtube bundle strategies ship as files named general.bat, general (ALT).bat … general (ALT13).bat, general (FAKE TLS AUTO).bat and others. Whether a strategy works depends on the provider and region, so you find a working one by testing: service.bat → Run Tests. A strategy can stop working over time — then you test the remaining ones or update to a newer release.

Secure DNS (DNS over HTTPS, DoH) sends DNS queries over an encrypted HTTPS channel so the provider cannot forge the responses. Without Secure DNS, zapret's bypass often does not work at all: DNS forgery neutralizes the strategy. In Chrome, enable "Use secure DNS" and pick a non-default provider; in Firefox, choose "DNS over HTTPS" → "Custom" (for example https://dns.google/dns-query). On Windows 11, Secure DNS can be enabled at the system level.

IPSet is a mechanism for filtering by IP address. The ipset-all.txt file contains the addresses and subnets of blocked resources. In service.bat, the IPSet Filter item controls the mode: none — IPs are not checked; loaded — only addresses on the list are checked; any — every IP is filtered. The any mode can help in games but breaks access to many sites, so it must not be used permanently. The list is updated via service.bat → Update IPSet List.