Mobile network website whitelist

Non-whitelisted DNS resolvers — including 1.1.1.1, 9.9.9.9, and Yandex DNS — were blocked with ICMP also blocked, while Beeline's own UDP DNS and Google's 8.8.8.8 remained accessible and non-hijacked (verified via Akamai WHOIS). This selective resolver blocking constrains which DNS infrastructure circumvention tools can use for bootstrap.

Issue body (its0ka, Sep 7 2025) detection dns-poisoningip-blocking ru

Beeline mobile users in certain Russian regions observed complete IP-based whitelisting: non-whitelisted IPs were unreachable at the ICMP level (traceroutes returned empty), TCP SYN packets were delivered but TLS ClientHello was silently dropped, and any domain resolving to a non-whitelisted IP was inaccessible regardless of SNI value. Only a curated set of IPs (primarily .gov.ru domains plus selected commercial sites) remained reachable.

Issue body (its0ka, Sep 7 2025) deployment ip-blockingtls-fingerprint ru

SNI spoofing — sending a whitelisted domain (e.g., yandex.ru) in the ClientHello while connecting to a non-whitelisted IP — did not bypass the block: any SNI value worked when connecting to a whitelisted IP, but no SNI value worked when connecting to a non-whitelisted VPS IP. This confirms the enforcement is IP-based rather than SNI-based, and SNI spoofing provides no circumvention value in this regime.

Issue body (its0ka, Sep 7 2025) evaluation ip-blockingsni-blocking ru

The whitelist enforcement drops TLS ClientHello packets to non-whitelisted destination IPs while still accepting the TCP SYN, meaning the block occurs at or after the TCP handshake completes but before application-layer data is processed. This behavior is consistent with TSPU-level in-path interception rather than BGP null-routing.

Issue body (its0ka, Sep 7 2025) detection dpiip-blocking ru

Stunnel tunneling achieved temporary circumvention before being blocked, and the enforcement was observed consistently across Beeline and Tele2 in affected regions, suggesting centralized TSPU-level implementation rather than per-ISP configuration. The whitelist appeared in September 2025 following a period of mobile-network shutdowns in some Russian regions or cities.

Comments (Ximerixx, someone2037492034, Sep 2025) deployment ip-blockingdpi ru