Не работает половина интернета пока не выключу tls 1.3

cafeed28 · April 5, 2025, 8:00pm

в firefox сайты login.microsoftonline.com, minecraft.net, m.media-amazon.com (ассеты imdb) не открываются (PR_CONNECT_RESET_ERROR), до тех пор пока я не установлю security.tls.version.max = 3 в about:config (ограничивает максимальную версию tls 1.2)
выхлоп curl
tls 1.2:

curl --tls-max 1.2 -vv https://login.microsoftonline.com
00:46:41.148368 [0-0] * Host login.microsoftonline.com:443 was resolved.
00:46:41.148997 [0-0] * IPv6: 2603:1026:3000:110::2, 2603:1026:3000:108::5, 2603:1027:1:108::5, 2603:1027:1:108::4, 2603:1026:3000:110::5, 2603:1026:3000:118::3, 2603:1027:1:108::9, 2603:1026:3000:118::1
00:46:41.149277 [0-0] * IPv4: 40.126.53.13, 40.126.53.9, 20.231.128.67, 20.231.128.65, 40.126.53.10, 20.190.181.1, 40.126.53.15, 20.190.181.5
00:46:41.149532 [0-0] * [HTTPS-CONNECT] created with 1 ALPNs -> 0
00:46:41.151221 [0-0] * [HTTPS-CONNECT] added
00:46:41.151389 [0-0] * [HTTPS-CONNECT] connect, init
00:46:41.151891 [0-0] *   Trying [2603:1026:3000:110::2]:443...
00:46:41.152499 [0-0] * Immediate connect fail for 2603:1026:3000:110::2: Network is unreachable
00:46:41.153411 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:41.153765 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0 socks
00:46:41.154381 [0-0] *   Trying [2603:1026:3000:108::5]:443...
00:46:41.154789 [0-0] * Immediate connect fail for 2603:1026:3000:108::5: Network is unreachable
00:46:41.155673 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:41.155937 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0 socks
00:46:41.156271 [0-0] *   Trying [2603:1027:1:108::5]:443...
00:46:41.157057 [0-0] * Immediate connect fail for 2603:1027:1:108::5: Network is unreachable
00:46:41.157387 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:41.157743 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0 socks
00:46:41.158065 [0-0] *   Trying [2603:1027:1:108::4]:443...
00:46:41.158421 [0-0] * Immediate connect fail for 2603:1027:1:108::4: Network is unreachable
00:46:41.158924 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:41.159227 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0 socks
00:46:41.159883 [0-0] *   Trying [2603:1026:3000:110::5]:443...
00:46:41.160230 [0-0] * Immediate connect fail for 2603:1026:3000:110::5: Network is unreachable
00:46:41.160836 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:41.161062 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0 socks
00:46:41.161354 [0-0] *   Trying [2603:1026:3000:118::3]:443...
00:46:41.161797 [0-0] * Immediate connect fail for 2603:1026:3000:118::3: Network is unreachable
00:46:41.162126 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:41.162337 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0 socks
00:46:41.162784 [0-0] *   Trying [2603:1027:1:108::9]:443...
00:46:41.163152 [0-0] * Immediate connect fail for 2603:1027:1:108::9: Network is unreachable
00:46:41.163816 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:41.164147 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0 socks
00:46:41.164605 [0-0] *   Trying [2603:1026:3000:118::1]:443...
00:46:41.164964 [0-0] * Immediate connect fail for 2603:1026:3000:118::1: Network is unreachable
00:46:41.165378 [0-0] *   Trying 40.126.53.13:443...
00:46:41.166009 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:41.166460 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 1 socks
00:46:41.200186 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:41.200564 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 1 socks
00:46:41.275112 [0-0] * ALPN: curl offers h2,http/1.1
00:46:41.277148 [0-0] * TLSv1.2 (OUT), TLS handshake, Client hello (1):
00:46:41.354924 [0-0] *  CAfile: /etc/ssl/certs/ca-certificates.crt
00:46:41.355343 [0-0] *  CApath: none
00:46:41.355815 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:41.356102 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 1 socks
00:46:41.356752 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:41.357163 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 1 socks
00:46:41.376884 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:41.377206 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 1 socks
00:46:41.377558 [0-0] * TLSv1.2 (IN), TLS handshake, Server hello (2):
00:46:41.377969 [0-0] * TLSv1.2 (IN), TLS handshake, Certificate (11):
00:46:41.382774 [0-0] * TLSv1.2 (IN), TLS handshake, Server key exchange (12):
00:46:41.384062 [0-0] * TLSv1.2 (IN), TLS handshake, Server finished (14):
00:46:41.393644 [0-0] * TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
00:46:41.394673 [0-0] * TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
00:46:41.395332 [0-0] * TLSv1.2 (OUT), TLS handshake, Finished (20):
00:46:41.395778 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:41.395972 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 1 socks
00:46:41.492064 [0-0] * TLSv1.2 (IN), TLS handshake, Finished (20):
00:46:41.492709 [0-0] * SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 / secp384r1 / RSASSA-PSS
00:46:41.493060 [0-0] * ALPN: server accepted h2
00:46:41.493223 [0-0] * Server certificate:
00:46:41.493566 [0-0] *  subject: C=US; ST=WA; L=Redmond; O=Microsoft Corporation; CN=stamp2.login.microsoftonline.com
00:46:41.493990 [0-0] *  start date: Mar 24 06:50:35 2025 GMT
00:46:41.494166 [0-0] *  expire date: Sep 20 06:50:35 2025 GMT
00:46:41.494387 [0-0] *  subjectAltName: host "login.microsoftonline.com" matched cert's "login.microsoftonline.com"
00:46:41.494691 [0-0] *  issuer: C=US; O=Microsoft Corporation; CN=Microsoft Azure RSA TLS Issuing CA 03
00:46:41.495046 [0-0] *  SSL certificate verify ok.
00:46:41.495243 [0-0] *   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha384WithRSAEncryption
00:46:41.495410 [0-0] *   Certificate level 1: Public key type RSA (4096/152 Bits/secBits), signed using sha384WithRSAEncryption
00:46:41.495716 [0-0] *   Certificate level 2: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
00:46:41.496041 [0-0] * [HTTPS-CONNECT] connect+handshake h2: 344ms, 1st data: 211ms
00:46:41.496362 [0-0] * [HTTP/2] [0] created h2 session
00:46:41.496543 [0-0] * [HTTP/2] [0] -> FRAME[SETTINGS, len=18]
00:46:41.496881 [0-0] * [HTTP/2] [0] -> FRAME[WINDOW_UPDATE, incr=1048510465]
00:46:41.497035 [0-0] * [HTTP/2] cf_connect() -> 0, 1,
00:46:41.497451 [0-0] * [HTTPS-CONNECT] connect -> 0, done=1
00:46:41.497732 [0-0] * Connected to login.microsoftonline.com (40.126.53.13) port 443
00:46:41.497943 [0-0] * using HTTP/2
00:46:41.498192 [0-0] * [HTTP/2] [1] OPENED stream for https://login.microsoftonline.com/
00:46:41.498474 [0-0] * [HTTP/2] [1] [:method: GET]
00:46:41.498789 [0-0] * [HTTP/2] [1] [:scheme: https]
00:46:41.498991 [0-0] * [HTTP/2] [1] [:authority: login.microsoftonline.com]
00:46:41.499306 [0-0] * [HTTP/2] [1] [:path: /]
00:46:41.499564 [0-0] * [HTTP/2] [1] [user-agent: curl/8.12.1]
00:46:41.499853 [0-0] * [HTTP/2] [1] [accept: */*]
00:46:41.500003 [0-0] * [HTTP/2] [1] submit -> 87, 0
00:46:41.500276 [0-0] * [HTTP/2] [1] -> FRAME[HEADERS, len=38, hend=1, eos=1]
00:46:41.500801 [0-0] * [HTTP/2] [0] egress: wrote 111 bytes
00:46:41.501122 [0-0] * [HTTP/2] [1] cf_send(len=87) -> 87, 0, eos=1, h2 windows 65535-65535 (stream-conn), buffers 0-0 (stream-conn)
00:46:41.501408 [0-0] > GET / HTTP/2
00:46:41.501408 [0-0] > Host: login.microsoftonline.com
00:46:41.501408 [0-0] > User-Agent: curl/8.12.1
00:46:41.501408 [0-0] > Accept: */*
00:46:41.501408 [0-0] >
00:46:41.502685 [0-0] * [HTTP/2] [0] ingress: read 40 bytes
00:46:41.502916 [0-0] * [HTTP/2] [0] <- FRAME[SETTINGS, len=18]
00:46:41.503077 [0-0] * [HTTP/2] [0] MAX_CONCURRENT_STREAMS: 100
00:46:41.503290 [0-0] * [HTTP/2] [0] ENABLE_PUSH: TRUE
00:46:41.503555 [0-0] * [HTTP/2] [1] DRAIN select_bits=1
00:46:41.503931 [0-0] * [HTTP/2] [0] <- FRAME[WINDOW_UPDATE, incr=983041]
00:46:41.504158 [0-0] * [HTTP/2] [0] progress ingress: inbufg=0
00:46:41.504462 [0-0] * [HTTP/2] [0] progress ingress: done
00:46:41.504899 [0-0] * [HTTP/2] [0] -> FRAME[SETTINGS, ack=1]
00:46:41.505305 [0-0] * [HTTP/2] [0] egress: wrote 9 bytes
00:46:41.505507 [0-0] * [HTTP/2] [1] cf_recv(len=102400) -> -1 81, window=0/65535, connection 1048576000/1048576000
00:46:41.505847 [0-0] * Request completely sent off
00:46:41.506077 [0-0] * [HTTP/2] [0] progress ingress: done
00:46:41.506279 [0-0] * [HTTP/2] [1] cf_recv(len=102400) -> -1 81, window=0/65535, connection 1048576000/1048576000
00:46:41.595755 [0-0] * [HTTP/2] [0] ingress: read 9 bytes
00:46:41.596257 [0-0] * [HTTP/2] [0] <- FRAME[SETTINGS, ack=1]
00:46:41.596592 [0-0] * [HTTP/2] [0] progress ingress: inbufg=0
00:46:41.597101 [0-0] * [HTTP/2] [0] progress ingress: done
00:46:41.597521 [0-0] * [HTTP/2] [1] cf_recv(len=102400) -> -1 81, window=0/65536, connection 1048576000/1048576000
00:46:41.735156 [0-0] * [HTTP/2] [0] ingress: read 1295 bytes
00:46:41.736084 [0-0] < HTTP/2 302
00:46:41.737195 [0-0] * [HTTP/2] [1] local window update by 10420224
00:46:41.739773 [0-0] * [HTTP/2] [1] status: HTTP/2 302
00:46:41.740054 [0-0] < cache-control: no-store, no-cache
00:46:41.740324 [0-0] * [HTTP/2] [1] header: cache-control: no-store, no-cache
00:46:41.740721 [0-0] < pragma: no-cache
00:46:41.741114 [0-0] * [HTTP/2] [1] header: pragma: no-cache
00:46:41.741333 [0-0] < content-type: text/html; charset=utf-8
00:46:41.741557 [0-0] * [HTTP/2] [1] header: content-type: text/html; charset=utf-8
00:46:41.741986 [0-0] < expires: -1
00:46:41.742349 [0-0] * [HTTP/2] [1] header: expires: -1
00:46:41.742722 [0-0] < location: https://www.office.com/login#
00:46:41.743029 [0-0] * [HTTP/2] [1] header: location: https://www.office.com/login#
00:46:41.743213 [0-0] < strict-transport-security: max-age=31536000; includeSubDomains
00:46:41.743427 [0-0] * [HTTP/2] [1] header: strict-transport-security: max-age=31536000; includeSubDomains
00:46:41.743761 [0-0] < x-content-type-options: nosniff
00:46:41.744003 [0-0] * [HTTP/2] [1] header: x-content-type-options: nosniff
00:46:41.744304 [0-0] < p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
00:46:41.744585 [0-0] * [HTTP/2] [1] header: p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
00:46:41.744869 [0-0] < x-ms-request-id: a01a7879-c49c-4451-8c68-82d26cc9df00
00:46:41.745130 [0-0] * [HTTP/2] [1] header: x-ms-request-id: a01a7879-c49c-4451-8c68-82d26cc9df00
00:46:41.745395 [0-0] < x-ms-ests-server: 2.1.20393.4 - NEULR1 ProdSlices
00:46:41.745558 [0-0] * [HTTP/2] [1] header: x-ms-ests-server: 2.1.20393.4 - NEULR1 ProdSlices
00:46:41.745780 [0-0] < x-ms-srs: 1.P
00:46:41.746133 [0-0] * [HTTP/2] [1] header: x-ms-srs: 1.P
00:46:41.746436 [0-0] < content-security-policy-report-only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-ggekH1bgx-1DxmNwM53NbQ' 'unsafe-inline' 'unsafe-eval' https://*.msauth.net https://*.msftauth.net https://*.msftauthimages.net https://*.msauthimages.net https://*.msidentity.com https://*.microsoftonline-p.com https://*.microsoftazuread-sso.com https://*.azureedge.net https://*.outlook.com https://*.office.com https://*.office365.com https://*.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All
00:46:41.746779 [0-0] * [HTTP/2] [1] header: content-security-policy-report-only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-ggekH1bgx-1DxmNwM53NbQ' 'unsafe-inline' 'unsafe-eval' https://*.msauth.net https://*.msftauth.net https://*.msftauthimages.net https://*.msauthimages.net https://*.msidentity.com https://*.microsoftonline-p.com https://*.microsoftazuread-sso.com https://*.azureedge.net https://*.outlook.com https://*.office.com https://*.office365.com https://*.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All
00:46:41.747004 [0-0] < x-xss-protection: 0
00:46:41.747278 [0-0] * [HTTP/2] [1] header: x-xss-protection: 0
00:46:41.747548 [0-0] < set-cookie: fpc=AtwqH2PHG_tHnhFIIOhNaSQ; expires=Mon, 05-May-2025 19:46:41 GMT; path=/; secure; HttpOnly; SameSite=None
00:46:41.747932 [0-0] * [HTTP/2] [1] header: set-cookie: fpc=AtwqH2PHG_tHnhFIIOhNaSQ; expires=Mon, 05-May-2025 19:46:41 GMT; path=/; secure; HttpOnly; SameSite=None
00:46:41.748169 [0-0] < set-cookie: esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEP3y8lD9L4SNRR3o76DrHOiu4uCndFV8deHzKhmvKwWa6NjBehQKXAFM7_8PV-wO5iXDoSbNS-If2BVO9LkQt6G9oLJ0-ml8z6wNMqsdi4-Z4mw-cDRPBXnsWeu8H8P7IhlJbRQvcfvEgJ726w_C_uLM8hCRg7B3YswZIjPkz42YgAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None
00:46:41.748350 [0-0] * [HTTP/2] [1] header: set-cookie: esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEP3y8lD9L4SNRR3o76DrHOiu4uCndFV8deHzKhmvKwWa6NjBehQKXAFM7_8PV-wO5iXDoSbNS-If2BVO9LkQt6G9oLJ0-ml8z6wNMqsdi4-Z4mw-cDRPBXnsWeu8H8P7IhlJbRQvcfvEgJ726w_C_uLM8hCRg7B3YswZIjPkz42YgAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None
00:46:41.748570 [0-0] < set-cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly
00:46:41.748888 [0-0] * [HTTP/2] [1] header: set-cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly
00:46:41.749149 [0-0] < set-cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly
00:46:41.749404 [0-0] * [HTTP/2] [1] header: set-cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly
00:46:41.749709 [0-0] < date: Sat, 05 Apr 2025 19:46:41 GMT
00:46:41.749938 [0-0] * [HTTP/2] [1] header: date: Sat, 05 Apr 2025 19:46:41 GMT
00:46:41.750264 [0-0] < content-length: 146
00:46:41.750511 [0-0] * [HTTP/2] [1] header: content-length: 146
00:46:41.750721 [0-0] * [HTTP/2] [1] <- FRAME[HEADERS, len=1122, hend=1, eos=0]
00:46:41.750995 [0-0] <
00:46:41.751188 [0-0] * [HTTP/2] [1] DRAIN select_bits=1
<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href="https://www.office.com/login#">here</a>.</h2>
</body></html>
00:46:41.751580 [0-0] * [HTTP/2] [1] <- FRAME[DATA, len=146, eos=0, padlen=0]
00:46:41.751862 [0-0] * [HTTP/2] [1] DATA, window=146/10485760
00:46:41.752127 [0-0] * [HTTP/2] [1] <- FRAME[DATA, len=0, eos=1, padlen=0]
00:46:41.752418 [0-0] * [HTTP/2] [1] DATA, window=146/10485760
00:46:41.752696 [0-0] * [HTTP/2] [1] CLOSED
00:46:41.752955 [0-0] * [HTTP/2] [1] DRAIN select_bits=1
00:46:41.753179 [0-0] * [HTTP/2] [0] progress ingress: inbufg=0
00:46:41.753498 [0-0] * [HTTP/2] [1] DRAIN select_bits=1
00:46:41.753737 [0-0] * [HTTP/2] [0] progress ingress: done
00:46:41.753924 [0-0] * [HTTP/2] [1] returning CLOSE
00:46:41.754193 [0-0] * [HTTP/2] handle_stream_close -> 0, 0
00:46:41.754430 [0-0] * [HTTP/2] [1] cf_recv(len=102400) -> 0 0, window=-1/-1, connection 1048575854/1048576000
00:46:41.754739 [0-0] * Connection #0 to host login.microsoftonline.com left intact

tls 1.3

curl --tls-max 1.3 -vv https://login.microsoftonline.com
00:46:45.908122 [0-0] * Host login.microsoftonline.com:443 was resolved.
00:46:45.908749 [0-0] * IPv6: 2603:1027:1:28::11, 2603:1027:1:28::25, 2603:1027:1:28::e, 2603:1027:1:28::6, 2603:1027:1:28::10, 2603:1027:1:28::a, 2603:1027:1:28::22, 2603:1027:1:28::20
00:46:45.909045 [0-0] * IPv4: 40.126.53.15, 40.126.53.9, 20.190.181.5, 20.190.181.1, 40.126.53.13, 20.231.128.67, 20.231.128.65, 40.126.53.10
00:46:45.909339 [0-0] * [HTTPS-CONNECT] created with 1 ALPNs -> 0
00:46:45.910181 [0-0] * [HTTPS-CONNECT] added
00:46:45.910492 [0-0] * [HTTPS-CONNECT] connect, init
00:46:45.910850 [0-0] *   Trying [2603:1027:1:28::11]:443...
00:46:45.911747 [0-0] * Immediate connect fail for 2603:1027:1:28::11: Network is unreachable
00:46:45.912226 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:45.913543 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0 socks
00:46:45.913826 [0-0] *   Trying [2603:1027:1:28::25]:443...
00:46:45.914084 [0-0] * Immediate connect fail for 2603:1027:1:28::25: Network is unreachable
00:46:45.914889 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:45.915819 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0 socks
00:46:45.916156 [0-0] *   Trying [2603:1027:1:28::e]:443...
00:46:45.916534 [0-0] * Immediate connect fail for 2603:1027:1:28::e: Network is unreachable
00:46:45.916832 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:45.917103 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0 socks
00:46:45.917468 [0-0] *   Trying [2603:1027:1:28::6]:443...
00:46:45.917914 [0-0] * Immediate connect fail for 2603:1027:1:28::6: Network is unreachable
00:46:45.918188 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:45.918587 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0 socks
00:46:45.919003 [0-0] *   Trying [2603:1027:1:28::10]:443...
00:46:45.919344 [0-0] * Immediate connect fail for 2603:1027:1:28::10: Network is unreachable
00:46:45.919609 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:45.920030 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0 socks
00:46:45.920379 [0-0] *   Trying [2603:1027:1:28::a]:443...
00:46:45.920889 [0-0] * Immediate connect fail for 2603:1027:1:28::a: Network is unreachable
00:46:45.921255 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:45.921425 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0 socks
00:46:45.921797 [0-0] *   Trying [2603:1027:1:28::22]:443...
00:46:45.922214 [0-0] * Immediate connect fail for 2603:1027:1:28::22: Network is unreachable
00:46:45.922549 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:45.922960 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0 socks
00:46:45.923228 [0-0] *   Trying [2603:1027:1:28::20]:443...
00:46:45.923554 [0-0] * Immediate connect fail for 2603:1027:1:28::20: Network is unreachable
00:46:45.923975 [0-0] *   Trying 40.126.53.15:443...
00:46:45.924372 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:45.924590 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 1 socks
00:46:45.960150 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:45.960707 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 1 socks
00:46:46.036365 [0-0] * ALPN: curl offers h2,http/1.1
00:46:46.040538 [0-0] * TLSv1.3 (OUT), TLS handshake, Client hello (1):
00:46:46.120519 [0-0] *  CAfile: /etc/ssl/certs/ca-certificates.crt
00:46:46.120888 [0-0] *  CApath: none
00:46:46.121136 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:46.121547 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 1 socks
00:46:46.121859 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:46.122211 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 1 socks
00:46:46.136806 [0-0] * TLSv1.3 (IN), TLS handshake, Server hello (2):
00:46:46.137670 [0-0] * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
00:46:46.141588 [0-0] * TLSv1.3 (OUT), TLS handshake, Client hello (1):
00:46:46.142021 [0-0] * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
00:46:46.142391 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:46.142719 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 1 socks
00:46:46.238950 [0-0] * TLSv1.3 (IN), TLS handshake, Server hello (2):
00:46:46.246797 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:46.247033 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 1 socks
00:46:47.248848 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
00:46:47.249423 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 1 socks
# бесконечно повторяются последние две строки

провайдер: билайн тюмень, домашний интернет
с мобильного билайна всё работает нормально

перепробовал всё, что мог придумать: добавление разных доменов в хостлист запрета / запуск без хостлистов (на роутере с openwrt, отдельно на компе тоже пробовал запускать запрет), включение/отключение DoH (google/cloudflare) в браузере и на роутере (https-dns-proxy), подключение компа к интернету напрямую минуя роутер

Streptococcus · April 5, 2025, 9:12pm

По-моему это новость прошлого года, что тспу блокирует использующий TLS 1.3, особенно если он включает расширения вроде Encrypted Client Hello (ECH), с октября месяца прошлого года… интеграция медленно ползет по стране. Возможно в этом причина?)

cafeed28 · April 5, 2025, 9:17pm

но если дурить cloudflare-ech.com, начинает работает rutracker, который использует ech и tls 1.3
а login.microsoftonline.com судя по всему не использует ech

rkn-chan · April 6, 2025, 6:37am

в stackoverflow нету расширения Encrypted Client Hello (ECH)

somula · April 6, 2025, 3:59pm

Проверил на себе, на мобильном интернете от Билайна. Совет установить security.tls.version.max = 3 в about:config НЕ ПОМОГ.
Сайты как не работали так и не работают.
Вот я часто использую эти сайты для проверки типа IP и домена, они не работают у меня:

https://ru.infobyip.com/

А у вас как?

cafeed28 · April 6, 2025, 6:00pm

iplocation.io открывается и на домашнем, и на мобильном
whois.domaintools.com открывается только на мобильном
ru.infobyip.com открывается на мобильном только с byedpi, на домашнем начинает грузиться, но ассеты с unpkg.com не грузятся

Mathias_Duke · April 9, 2025, 10:02am

Тоже на билайне многие сайты начали тупить. Сегодня вообще сайт DNS откис и без впн не грузится никак. Чую пчелы начали свои собственные эксперименты по блокировкам. Совет из шапки не помог.