Psiphon VPN software server addresses are getting filtered on some of Russian ISPs (the ones that block Tor). The filtering is done with DPI, by blocking the TCP session after some amount of transmitted packets.
The filtering applies to custom Psiphon’s HTTP protocol, custom DNS masking protocol, and what’s more importantly, to SSH (a regular one) protocol.
ssh root@87.101.94.44
— is one of Psiphon IPs. The connection is “hung” after several packets transferred. SSH client receives the server keys but never manages to establish connection to the password entering stage — the packets are filtered and dropped.
The filtering applies only towards known Psiphon IP addresses.
PCAPs are here: OONI reports of Tor blocking in certain ISPs since 2021-12-01 - #57 by ValdikSS
xhdix
December 10, 2021, 7:46am
2
anadahz
December 10, 2021, 10:26am
3
I don’t see any data for Dec. 9th 2021, on psix.ca .
Do I miss anything?
"series";"time";"value"
"daily unique users in ru";"2021-11-25t00:00:00+00:00";null
"daily unique users in ru";"2021-11-26t00:00:00+00:00";38000
"daily unique users in ru";"2021-11-27t00:00:00+00:00";38000
"daily unique users in ru";"2021-11-28t00:00:00+00:00";38000
"daily unique users in ru";"2021-11-29t00:00:00+00:00";40000
"daily unique users in ru";"2021-11-30t00:00:00+00:00";40000
"daily unique users in ru";"2021-12-01t00:00:00+00:00";39000
"daily unique users in ru";"2021-12-02t00:00:00+00:00";40000
"daily unique users in ru";"2021-12-03t00:00:00+00:00";40000
"daily unique users in ru";"2021-12-04t00:00:00+00:00";38000
"daily unique users in ru";"2021-12-05t00:00:00+00:00";37000
"daily unique users in ru";"2021-12-06t00:00:00+00:00";40000
"daily unique users in ru";"2021-12-07t00:00:00+00:00";41000
"daily unique users in ru";"2021-12-08t00:00:00+00:00";42000
"daily unique users in ru";"2021-12-09t00:00:00+00:00";null
xhdix
December 10, 2021, 10:51am
4
anadahz:
Do I miss anything?
They started blocking, but it did not affect the users.
This is also from psix:
xhdix:
IIRC, Psiphon has 10 different ways to connect.
anadahz
December 10, 2021, 10:53am
5
xhdix:
This is also from psix:
I can’t find it on psix.ca I see no data after Dec. 8th 2021.
xhdix
December 10, 2021, 10:56am
6
They have, but they will not show it to you.
(I will send you a DM in Slack)
anadahz
December 10, 2021, 5:00pm
7
OONI measurements show instances of blocking as well. An aggregated view of OONI Psiphon tests during: 2021-12-06 - 2021-12-10
anadahz
December 10, 2021, 5:09pm
8
OONI RiseupVPN suggest also blocking by means of DNS manipulation.
Excerpt from an OONI measurement in AS 25513 that suggest that RiseupVPN API endpoints couldn’t be reached by HTTP GET requests:
"api_failure": "dns_nxdomain_error"
"api_status": "blocked"
Relevant doc: OONI RiseupVPN test specification
Psiphon block is in effect on Saint Petersburg’s OBIT (Eneva). There’s no Tor block on this provider, but it used to slow down Twitter.
The block is active again.
afansv
March 17, 2022, 8:42am
11
Block is active - MTS, Moscow (Connection succeeds after a couple of minutes of waiting)
No block - Rostelecom, Moscow
first time see block at RT/Kaluga
на какое то время сняли блокировку
(последний тест от 17 июня 2024 писал что блокировки Псифона нет.)
сейчас вернули
никаких триггеров чтобы получить “динамический” бан вроде не делал