TLS over VMESS-TCP 被 GFW 定向阻断 #2262

wloot · 2022-10-19T15:14:19Z

wloot
Oct 19, 2022

最近遇到同一个代理, 内层流量为 http 等流量时可以正常连接, 但 https 被阻断的情况.

被阻断的 https 流量, 经测试指定 tls 1.0/.1/.2/.3 版本均是如此.

% curl https://1.1.1.1 -vv
*   Trying 1.1.1.1:443...
* Connected to 1.1.1.1 (1.1.1.1) port 443 (#0)
* ALPN: offers h2
* ALPN: offers http/1.1
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN: server accepted h2
* Server certificate:
*  subject: C=US; ST=California; L=San Francisco; O=Cloudflare, Inc.; CN=cloudflare-dns.com
*  start date: Sep 13 00:00:00 2022 GMT
*  expire date: Sep 13 23:59:59 2023 GMT
*  subjectAltName: host "1.1.1.1" matched cert's IP address!
*  issuer: C=US; O=DigiCert Inc; CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1
*  SSL certificate verify ok.
* Using HTTP2, server supports multiplexing
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* h2h3 [:method: GET]
* h2h3 [:path: /]
* h2h3 [:scheme: https]
* h2h3 [:authority: 1.1.1.1]
* h2h3 [user-agent: curl/7.84.0]
* h2h3 [accept: */*]
* Using Stream ID: 1 (easy handle 0x125012e00)
> GET / HTTP/2
> Host: 1.1.1.1
> user-agent: curl/7.84.0
> accept: */*
> 
* HTTP/2 stream 1 was not closed cleanly before end of the underlying stream
* Connection #0 to host 1.1.1.1 left intact

而 http 可以正常通过:

% curl http://1.1.1.1 -vv 
*   Trying 1.1.1.1:80...
* Connected to 1.1.1.1 (1.1.1.1) port 80 (#0)
> GET / HTTP/1.1
> Host: 1.1.1.1
> User-Agent: curl/7.84.0
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 301 Moved Permanently
< Server: cloudflare
< Date: Wed, 19 Oct 2022 15:03:50 GMT
< Content-Type: text/html
< Content-Length: 167
< Connection: keep-alive
< Location: https://1.1.1.1/
< CF-RAY: 75ca671cbcb1ddf4-HKG
< 
<html>
<head><title>301 Moved Permanently</title></head>
<body>
<center><h1>301 Moved Permanently</h1></center>
<hr><center>cloudflare</center>
</body>
</html>
* Connection #0 to host 1.1.1.1 left intact

还发现这个现象可能跟客户端 IP 有关系, 部分代理在客户端重新拨号后恢复正常.

olbb · 2022-10-31T10:21:15Z

olbb
Oct 31, 2022

同样的问题应该是墙又升级了

0 replies

SakuraSakuraSakuraChan · 2022-11-03T09:49:02Z

SakuraSakuraSakuraChan
Nov 3, 2022

请问运营商是联通吗

0 replies

liujunhui2 · 2022-11-07T08:38:45Z

liujunhui2
Nov 7, 2022

发现最近移动有类似问题

0 replies

zhychen1173 · 2022-11-17T02:14:55Z

zhychen1173
Nov 17, 2022

我也是自建的3个vps节点同一时间齐刷刷连不上了，vmess+tls+ws，ip并没有被屏蔽，ssh可登录，但就是梯子连不上。

0 replies

kdanfly · 2022-11-27T03:20:12Z

kdanfly
Nov 27, 2022

请问运营商是联通吗

我这里联通的定向阻断很明显，2-3天端口就失效了。IP不封。另一个二级ISP就好很多

0 replies

fobfofo · 2022-11-28T04:13:40Z

fobfofo
Nov 28, 2022

我用的是搬瓦工cn2机房，ws域名用阿里云解析，实名备案，稳定两年多了。
一个月前，先是联通定向阻断，之后几天，443端口突然被封。
随后，我换了域名和搬瓦工ip。
前天，新ip的443再次被封。
今天，我另一个稳定三年的vultr也被封了443。
刚才，把443换成了8443，套上了cf，如果短期内还被封，就真没招了。

0 replies

brandon3343 · 2022-12-28T12:11:10Z

brandon3343
Dec 28, 2022

开高一些的端口试试，然后自己用。我已经很久没被封了，之前用的低一些的端口号，出现大流量端口就被封，我是移动的

1 reply

flxxyz Feb 20, 2023

开高一些的端口试试，然后自己用。我已经很久没被封了，之前用的低一些的端口号，出现大流量端口就被封，我是移动的

用DoH都会被封掉哦，并不是大流量的问题

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

TLS over VMESS-TCP 被 GFW 定向阻断 #2262

{{title}}

Replies: 7 comments 1 reply

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

Select a reply

TLS over VMESS-TCP 被 GFW 定向阻断 #2262

Replies: 7 comments · 1 reply

Replies: 7 comments 1 reply