# gubernievs/antizapret-vpn architecture

> Architecture diagram of the GitHub repository gubernievs/antizapret-vpn, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/gubernievs/antizapret-vpn
- Repository: https://github.com/gubernievs/antizapret-vpn

## Overview

AntiZapret VPN is a server setup and runtime for split-tunnel AntiZapret access plus a conventional full VPN, with OpenVPN, WireGuard, and AmneziaWG client profiles. The documented flow is clients connect through a selected VPN; DNS and routing policy determine which traffic uses the tunnel, and daily list updates refresh that policy. The tree shows the installer payload, VPN and resolver configuration, and update scripts. Source excerpts cover only the fake-IP DNS proxy, so links between other runtime stages are limited to documented behavior and explicit configuration.

Main entry points: [`setup/root/antizapret/proxy.py`](https://github.com/gubernievs/antizapret-vpn/blob/main/setup/root/antizapret/proxy.py) (Fake-IP DNS proxy), [`setup/root/antizapret/doall.sh`](https://github.com/gubernievs/antizapret-vpn/blob/main/setup/root/antizapret/doall.sh) (Update runner), [`setup/etc/openvpn/server`](https://github.com/gubernievs/antizapret-vpn/tree/main/setup/etc/openvpn/server) (OpenVPN server), [`setup/etc/knot-resolver/kresd.conf`](https://github.com/gubernievs/antizapret-vpn/blob/main/setup/etc/knot-resolver/kresd.conf) (Knot Resolver)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_install["Server setup"]
  node_installer["Installer<br/>[setup.sh]"]
  node_server_payload["Server payload"]
end

subgraph group_vpn["VPN access"]
  node_ovpn_server["OpenVPN server"]
  node_wg_templates["WireGuard profiles"]
  node_ovpn_templates["OpenVPN profiles"]
  node_vpn_service["VPN service overrides"]
  node_client_hooks["Client hooks"]
end

subgraph group_policy["DNS and routing policy"]
  node_resolver["Knot Resolver<br/>[kresd.conf]"]
  node_resolver_rules["Resolver rules"]
  node_fake_dns["Fake-IP DNS proxy<br/>[proxy.py]"]
  node_policy_lists["Policy lists"]
  node_fake_ip_state[("Fake-IP mappings<br/>[proxy.py]")]
  node_firewall["Firewall rules<br/>[99-antizapret.conf]"]
end

subgraph group_updates["Policy updates"]
  node_updater["Update runner<br/>[doall.sh]"]
  node_update_timer["Daily timer"]
  node_downloads["Policy downloads"]
  node_custom_scripts["Custom update hooks<br/>[custom-update.sh]"]
end

node_client(("VPN client"))
node_upstream_dns(("Upstream DNS"))

node_installer -->|"installs"| node_server_payload
node_server_payload -->|"configures"| node_vpn_service
node_client -->|"connects"| node_ovpn_server
node_client -->|"uses profile"| node_wg_templates
node_client -->|"uses profile"| node_ovpn_templates
node_ovpn_server -->|"dispatches"| node_client_hooks
node_vpn_service -->|"configures"| node_ovpn_server
node_resolver -->|"loads"| node_resolver_rules
node_resolver -.->|"uses proxy"| node_fake_dns
node_fake_dns -->|"forwards queries"| node_upstream_dns
node_fake_dns -->|"tracks mappings"| node_fake_ip_state
node_fake_dns -->|"updates iptables"| node_firewall
node_update_timer -->|"starts"| node_updater
node_updater -->|"refreshes lists"| node_downloads
node_updater -->|"updates"| node_policy_lists
node_updater -.->|"runs hooks"| node_custom_scripts
node_policy_lists -->|"feeds rules"| node_resolver_rules

click node_installer "https://github.com/gubernievs/antizapret-vpn/blob/main/setup.sh"
click node_server_payload "https://github.com/gubernievs/antizapret-vpn/tree/main/setup"
click node_ovpn_server "https://github.com/gubernievs/antizapret-vpn/tree/main/setup/etc/openvpn/server"
click node_wg_templates "https://github.com/gubernievs/antizapret-vpn/tree/main/setup/etc/wireguard/templates"
click node_ovpn_templates "https://github.com/gubernievs/antizapret-vpn/tree/main/setup/etc/openvpn/client/templates"
click node_vpn_service "https://github.com/gubernievs/antizapret-vpn/tree/main/setup/etc/systemd/system"
click node_client_hooks "https://github.com/gubernievs/antizapret-vpn/tree/main/setup/etc/openvpn/server/scripts"
click node_resolver "https://github.com/gubernievs/antizapret-vpn/blob/main/setup/etc/knot-resolver/kresd.conf"
click node_resolver_rules "https://github.com/gubernievs/antizapret-vpn/tree/main/setup/etc/knot-resolver"
click node_fake_dns "https://github.com/gubernievs/antizapret-vpn/blob/main/setup/root/antizapret/proxy.py"
click node_policy_lists "https://github.com/gubernievs/antizapret-vpn/tree/main/setup/root/antizapret/config"
click node_fake_ip_state "https://github.com/gubernievs/antizapret-vpn/blob/main/setup/root/antizapret/proxy.py"
click node_firewall "https://github.com/gubernievs/antizapret-vpn/blob/main/setup/etc/sysctl.d/99-antizapret.conf"
click node_updater "https://github.com/gubernievs/antizapret-vpn/blob/main/setup/root/antizapret/doall.sh"
click node_update_timer "https://github.com/gubernievs/antizapret-vpn/blob/main/setup/etc/systemd/system/antizapret-update.timer"
click node_downloads "https://github.com/gubernievs/antizapret-vpn/tree/main/setup/root/antizapret/download"
click node_custom_scripts "https://github.com/gubernievs/antizapret-vpn/blob/main/setup/root/antizapret/custom-update.sh"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_installer,node_server_payload,node_client toneBlue
class node_ovpn_server,node_wg_templates,node_ovpn_templates,node_vpn_service,node_client_hooks toneAmber
class node_resolver,node_resolver_rules,node_fake_dns,node_policy_lists,node_fake_ip_state,node_firewall toneMint
class node_updater,node_update_timer,node_downloads,node_custom_scripts toneRose
class node_upstream_dns toneIndigo
```

## Components

### Server setup

- [Installer](https://github.com/gubernievs/antizapret-vpn/blob/main/setup.sh): `setup.sh`
- [Server payload](https://github.com/gubernievs/antizapret-vpn/tree/main/setup): `setup`

### VPN access

- [OpenVPN server](https://github.com/gubernievs/antizapret-vpn/tree/main/setup/etc/openvpn/server): `setup/etc/openvpn/server`
- [WireGuard profiles](https://github.com/gubernievs/antizapret-vpn/tree/main/setup/etc/wireguard/templates): `setup/etc/wireguard/templates`
- [OpenVPN profiles](https://github.com/gubernievs/antizapret-vpn/tree/main/setup/etc/openvpn/client/templates): `setup/etc/openvpn/client/templates`
- [VPN service overrides](https://github.com/gubernievs/antizapret-vpn/tree/main/setup/etc/systemd/system): `setup/etc/systemd/system`
- [Client hooks](https://github.com/gubernievs/antizapret-vpn/tree/main/setup/etc/openvpn/server/scripts): `setup/etc/openvpn/server/scripts`

### DNS and routing policy

- [Knot Resolver](https://github.com/gubernievs/antizapret-vpn/blob/main/setup/etc/knot-resolver/kresd.conf): `setup/etc/knot-resolver/kresd.conf`
- [Resolver rules](https://github.com/gubernievs/antizapret-vpn/tree/main/setup/etc/knot-resolver): `setup/etc/knot-resolver`
- [Fake-IP DNS proxy](https://github.com/gubernievs/antizapret-vpn/blob/main/setup/root/antizapret/proxy.py): `setup/root/antizapret/proxy.py`
- [Policy lists](https://github.com/gubernievs/antizapret-vpn/tree/main/setup/root/antizapret/config): `setup/root/antizapret/config`
- [Fake-IP mappings](https://github.com/gubernievs/antizapret-vpn/blob/main/setup/root/antizapret/proxy.py): `setup/root/antizapret/proxy.py`
- [Firewall rules](https://github.com/gubernievs/antizapret-vpn/blob/main/setup/etc/sysctl.d/99-antizapret.conf): `setup/etc/sysctl.d/99-antizapret.conf`

### Policy updates

- [Update runner](https://github.com/gubernievs/antizapret-vpn/blob/main/setup/root/antizapret/doall.sh): `setup/root/antizapret/doall.sh`
- [Daily timer](https://github.com/gubernievs/antizapret-vpn/blob/main/setup/etc/systemd/system/antizapret-update.timer): `setup/etc/systemd/system/antizapret-update.timer`
- [Policy downloads](https://github.com/gubernievs/antizapret-vpn/tree/main/setup/root/antizapret/download): `setup/root/antizapret/download`
- [Custom update hooks](https://github.com/gubernievs/antizapret-vpn/blob/main/setup/root/antizapret/custom-update.sh): `setup/root/antizapret/custom-update.sh`

### Other components

- **VPN client**
- **Upstream DNS**

## Connections

- Installer → Server payload: installs
- Server payload → VPN service overrides: configures
- VPN client → OpenVPN server: connects
- VPN client → WireGuard profiles: uses profile
- VPN client → OpenVPN profiles: uses profile
- OpenVPN server → Client hooks: dispatches
- VPN service overrides → OpenVPN server: configures
- Knot Resolver → Resolver rules: loads
- Knot Resolver → Fake-IP DNS proxy: uses proxy
- Fake-IP DNS proxy → Upstream DNS: forwards queries
- Fake-IP DNS proxy → Fake-IP mappings: tracks mappings
- Fake-IP DNS proxy → Firewall rules: updates iptables
- Daily timer → Update runner: starts
- Update runner → Policy downloads: refreshes lists
- Update runner → Policy lists: updates
- Update runner → Custom update hooks: runs hooks
- Policy lists → Resolver rules: feeds rules