Psiphon blocking since 08 Dec 2021

Psiphon VPN software server addresses are getting filtered on some of Russian ISPs (the ones that block Tor). The filtering is done with DPI, by blocking the TCP session after some amount of transmitted packets.

The filtering applies to custom Psiphon’s HTTP protocol, custom DNS masking protocol, and what’s more importantly, to SSH (a regular one) protocol.

ssh root@ — is one of Psiphon IPs. The connection is “hung” after several packets transferred. SSH client receives the server keys but never manages to establish connection to the password entering stage — the packets are filtered and dropped.

The filtering applies only towards known Psiphon IP addresses.

PCAPs are here: OONI reports of Tor blocking in certain ISPs since 2021-12-01 - #57 by ValdikSS

(rounded count)

I don’t see any data for Dec. 9th 2021, on
Do I miss anything?

"daily unique users in ru";"2021-11-25t00:00:00+00:00";null
"daily unique users in ru";"2021-11-26t00:00:00+00:00";38000
"daily unique users in ru";"2021-11-27t00:00:00+00:00";38000
"daily unique users in ru";"2021-11-28t00:00:00+00:00";38000
"daily unique users in ru";"2021-11-29t00:00:00+00:00";40000
"daily unique users in ru";"2021-11-30t00:00:00+00:00";40000
"daily unique users in ru";"2021-12-01t00:00:00+00:00";39000
"daily unique users in ru";"2021-12-02t00:00:00+00:00";40000
"daily unique users in ru";"2021-12-03t00:00:00+00:00";40000
"daily unique users in ru";"2021-12-04t00:00:00+00:00";38000
"daily unique users in ru";"2021-12-05t00:00:00+00:00";37000
"daily unique users in ru";"2021-12-06t00:00:00+00:00";40000
"daily unique users in ru";"2021-12-07t00:00:00+00:00";41000
"daily unique users in ru";"2021-12-08t00:00:00+00:00";42000
"daily unique users in ru";"2021-12-09t00:00:00+00:00";null

They started blocking, but it did not affect the users.

This is also from psix:

IIRC, Psiphon has 10 different ways to connect.

I can’t find it on I see no data after Dec. 8th 2021.

They have, but they will not show it to you. :stuck_out_tongue:
(I will send you a DM in Slack)

OONI measurements show instances of blocking as well. An aggregated view of OONI Psiphon tests during: 2021-12-06 - 2021-12-10

OONI RiseupVPN suggest also blocking by means of DNS manipulation.

Excerpt from an OONI measurement in AS 25513 that suggest that RiseupVPN API endpoints couldn’t be reached by HTTP GET requests:

"api_failure": "dns_nxdomain_error"
"api_status": "blocked"

Relevant doc: OONI RiseupVPN test specification

Psiphon block is in effect on Saint Petersburg’s OBIT (Eneva). There’s no Tor block on this provider, but it used to slow down Twitter.