wkrp

This is an attempted synthesis of information that is spread across a few NTC threads over the past 5 days. I've linked to the points in the threads where the...

> * A user [claims](https://ntc.party/t/rkn-will-try-to-block-the-following-vpn-services/1022/62) that the detection pattern for WireGuard in Rostelecom is the following. I don't know how this was derived. A UDP datagram beginning with `\x01\x00` does...

Via a [post at NTC](https://ntc.party/t/warp-cloudflare/1236/13) and an [article at Meduza](https://meduza.io/news/2021/12/02/roskomnadzor-zablokiruet-esche-shest-vpn-servisov) ([archive](https://web.archive.org/web/20211202135053/https://meduza.io/news/2021/12/02/roskomnadzor-zablokiruet-esche-shest-vpn-servisov)), a new press release from Roskomnadzor announces the pending blocking of six more VPN services. This time, the list...

It's reported that **Cloudflare WARP** and **NordVPN** were blocked on 2022-03-16. I am not sure whether the blocking on March 16 was targeted at these two services specifically, or if...

> I am not sure whether the blocking on March 16 was targeted at these two services specifically, or if they were caught in a more general blocking of the...

In the past few weeks there was reported blocking of **Windscribe VPN** and **Proton VPN**. On 2022-05-26, Windscribe [tweeted](https://twitter.com/windscribecom/status/1529844382064599041) ([archive](https://web.archive.org/web/20220526151905/https://twitter.com/windscribecom/status/1529844382064599041)) that it was being blocked in Russia. https://tjournal.ru/news/634219-vpn-servis-windscribe-rasskazal-chto-ego-mogli-zablokirovat-v-rossii-polzovateli-zhalovalis-na-sboi-v-rabote ([archive](https://web.archive.org/web/20220528115449/https://tjournal.ru/news/634219-vpn-servis-windscribe-rasskazal-chto-ego-mogli-zablokirovat-v-rossii-polzovateli-zhalovalis-na-sboi-v-rabote)) >...

My first thought was that this may be a manifestation of the new protocol filter on ports 53, 80, and 443: https://geneva.cs.umd.edu/posts/iran-whitelister/. The protocol filter report also says that [interference...

I found a couple of tweets with more evidence of ESNI blocking in Iran. 2020-08-09 https://twitter.com/AliMirjamali/status/1292498063425187840 ([archive](https://web.archive.org/web/20200809165622/https://nitter.net/AliMirjamali/status/1292498063425187840)) > Blocking ESNI & TLS 1.3 has been evaluated for few months here...

> Does `curl` support ESNI?! This seems to be SNI blocking. Hmm, you may be right. I guess the sub-tweet doesn't claim to use ESNI, and the tweet quoting it...

The fact that the server is blocked after a variable delay of up to 15 minutes is interesting. It is similar to what was observed by [Winter and Lindskog](https://censorbib.nymity.ch/#Winter2012a) with...