MCI is blocking REALITY servers in Iran

[WatchDogsDev]

Discussed in #2450

^{Originally posted by WatchDogsDev August 16, 2023}
Hi, First thanks for your great work.
I had servers with clean IP using the recommended latest protocol VLESS+TCP+RPRX-VISION+REALITY for 2 month and everything was fine.
Recently (about 4 days ago) the biggest internet operator in Iran known as MCI started blocking reality server IPs under 24 hours.
I have used many less known server providers to get clean IP but it got blocked under 24 hours with around 70 users.

Any ideas how we can handle this? Or how is it detected ?

[RPRX]

如果是 4 天前开始的广泛封锁，那么早就应该有报告，但目前除了 你们，并无其他人报告这个情况
GFW 当然在不断增强自己的能力，但若只封了你，基本上可以确定是和你自己的配置有关，至少你应当把配置贴上来
我们不喜欢被封后发贴不附上具体配置且标题为“XX 被识别了”的人，更不喜欢被这样的东西到处刷

但我暂时不会点 Close，看有没有更多报告

[SaintShit]

如果是 4 天前开始的广泛封锁，那么早就应该有报告，但目前除了 你们，并无其他人报告这个情况 GFW 当然在不断增强自己的能力，但若只封了你，基本上可以确定是和你自己的配置有关，至少你应当把配置贴上来 我们不喜欢被封后发贴不附上具体配置且标题为“XX 被识别了”的人，更不喜欢被这样的东西到处刷

但我暂时不会点 Close，看有没有更多报告

I'd say that to some extent he's talking right, not exactly about "REALITY being detected", but about the fact that they're failing to work in the recent days. the way that MCI had been blocking IPs before, was to limiting upstream to suspicious destinations, but now, they're interrupting downstream. so, if you perform an URL test, you see a success result ( as it's only a 204 response and small amount of bytes to transfer ). but when it comes to using the proxy, it fails to work.

The way that I'm testing my REALITY servers is to make an http request with 2 seconds timeout and check if it gets the response completely or not, as limited IPs have a long delay in receiving

curl -v --max-time 2 --resolve www.example.com:443:123.123.123.123 https://www.example.com

[nursery01]

@SaintShit So how do isp determine illegal ip?

According to the list of legal IPs obtained from DNS？

#2407

[randomguy-on-internet]

I've been using reality + Hiddify panel for 2 months without any ip bans!

but last 3-4 days, every day around 4 PM and 11 pm, my reality configs gets blocked but the ip still has ping + i can access it with nmap -p443 IP so i assume its TLS handshake Blocking and it only happens in one provider, MCI !

I use multiple SNI's, speedtest.net , www.theverge.com , cdn.discordapp.com and 2 more, that are whitelisted in MCI isp.

so after getting blocked 2nd day, i disabled speedtest sni and changed reality keys, cuz i thought they are banning ips based on that sni particularly but still i get banned and im so frustrated.

i'm using Linode VPS provider, their ips used to be whitelisted as it would work with any sni.

[SaintShit]

@SaintShit So how do isp determine illegal ip?

According to the list of legal IPs obtained from DNS？

#2407

maybe by the sudden traffic they get?
seems that IPs that had REALITY running and they had been working for a long time, are not about to be limited. but about IPs that have recently become active in the network, there is a high chance that they'll be limited after a few hours. no matter which port or which SNI you're using.

[SaintShit]

I've been using reality + Hiddify panel for 2 months without any ip bans!

but last 3-4 days, every day around 4 PM and 11 pm, my reality configs gets blocked but the ip still has ping + i can access it with nmap -p443 IP so i assume its TLS handshake Blocking and it only happens in one provider, MCI !

I use multiple SNI's, speedtest.net , www.theverge.com , cdn.discordapp.com and 2 more, that are whitelisted in MCI isp.

so after getting blocked 2nd day, i disabled speedtest sni and changed reality keys, cuz i thought they are banning ips based on that sni particularly but still i get banned and im so frustrated.

i'm using Linode VPS provider, their ips used to be whitelisted as it would work with any sni.

Actually I've tested it and handshakes are all done, there's no problem with it

[Argo160]

I am having the same issue.
My reality servers are also getting blocked by MCI since 4 or 5 days ago.
no matter what SNI i use or what flow to be set. even i tried to use different known ports, ... and no different. at the end of the day they are getting blocked.

[RPRX]

I'd say that there are too many possible & available ways to recognize & block your proxy servers. We've discussed many of them here over the past few months (not on my subjective purpose), the problems that we can not solve yet, if you noticed.

maybe by the sudden traffic they get?
seems that IPs that had REALITY running and they had been working for a long time, are not about to be limited. but about IPs that have recently become active in the network, there is a high chance that they'll be limited after a few hours. no matter which port or which SNI you're using.

Maybe it's the key.

[nursery01]

seems that IPs that had REALITY running and they had been working for a long time, are not about to be limited. but about IPs that have recently become active in the network, there is a high chance that they'll be limited after a few hours. no matter which port or which SNI you're using.

Is there a possibility that the old IP is on the white list?So it can be used for a long time.

[nursery01]

how can we discover the whitelisted SNI?

Use go http client to access sni and point to a random Web IP. If you can receive 403, it means that this sni maybe a whitelist.

[Phoenix-999]

If it was a widespread blockade that started 4 days ago, it should have been reported long ago, but no one else has reported this except you GFW is of course constantly increasing its own capabilities, but if it only blocks you, it is basically sure that it is It is related to your own configuration, at least you should post the configuration We don’t like people who post without specific configuration after being banned and the title is “XX is recognized”, and we don’t like being brushed around by such things

But I won't click Close for now to see if there are more reports

Just a quick update to let you know that I can confirm the recent happenings. In the past four days, MCI has been on a spree, closing down servers and throwing up IP blocks. And they're not holding back – we've even had cases where servers got the boot just a couple of hours after firing up, without any serious traffic.

Now, I've got a hunch this isn't your typical random IP-blocking gig from GFW. It seems like they've figured out a way to pinpoint those VPS servers that are actually in action, or maybe they've cracked the code on spotting real activity through SNI.

But here's the kicker – it's not just a wild goose chase. We've been hearing from folks all over the place, from different cities, and it's clear that this MCI onslaught is widespread.

[mortada-jafar]

Thank you, @nursery01, In our current scenario, we are utilizing www.theverge.com, which operates behind the Fastly CDN infrastructure. The associated IP address for this site is 151.101.41.91. I undertook a thorough comparison with other domains that share similar attributes, including SSL certificates and CDN IPs. However, it's noteworthy that my findings diverged from those observed with The Verge.

when we use The Verge with dirty IP it's working!

[RPRX]

如果这次的封锁主要是基于流量特征，那么还有解决的余地，我们有一些计划。如果主要是基于 IP，比如说 MCI 已经将更多的 IP 列入了“不可轻信”名单，那么现有的协议解决不了，只能用一些魔法，但我不是很想用。

[nursery01]

如果这次的封锁主要是基于流量特征，那么还有解决的余地，我们有一些计划。如果主要是基于 IP，比如说 MCI 已经将更多的 IP 列入了“不可轻信”名单，那么现有的协议解决不了，只能用一些魔法，但我不是很想用。

中國人做的代理百花齊放，如果站在中國gfw和伊朗isp的角度來看，成本比較低的方式就是升級基於ip的審查系統，並且ip很難造假後還能正常使用，如果是每個協定都識別過去還聽麻煩的

[RPRX]

ISP Unableed to detect Reality, only popular SNI has been blocked recently (www.speedtest.net), and only white SNI now is www.theverge.com and working on MCI. However, the question remains: how can we discover the whitelisted SNI?

@RPRX

www.speedtest.net 是一个 Cloudflare 网站，后者的 IP 段似乎是公开的，想封它并不难。
你们那里能直接上 Google，我好像没有见过你们租谷歌云的服务器并使用 www.google.com 作为 dest？