4 ms·
My Indian ISP blocks certain sites. I use Firefox and has DNS over HTTPS with CloudFlare enabled. I also use CloudFlare's 1.1.1.1 DNS in my router. The sites ar
by throwawaydoh 7y ago
My Indian ISP blocks certain sites. I use Firefox and has DNS over HTTPS with CloudFlare enabled. I also use CloudFlare's 1.1.1.1 DNS in my router. The sites are still blocked.
Firefox shows the error "Secure Connection Failed. An error occurred during a connection to 'site url'. PR_CONNECT_RESET_ERROR". When I search for this error, one of the first results say "this behavior is fairly typical for DPI firewalls".
To anyone knowledgeable about this: How can I confirm if my ISP is using DPI?
- StreamBright 7y agohttps://security.stackexchange.com/questions/108985/is-it-possible-to-detect-dpi-deep-packet-inspection https://security.stackexchange.com/questions/108985/is-it-po...
- tgragnato 7y agoFind an (allegedly) blocked website that is using CloudFlare and has TLS 1.3 enabled. In about:config set network.trr.mode=3, network.security.esni.enabled=true, security.OCSP.enabled=0, security.tls.version.max=4, security.tls.version.min=4. Exit, open Firefox again; if the website loads, then your ISP is using a DPI middlebox.
- throwawaydoh 7y agoThank you. Unfortunately, I wasn't able to find a blocked site that has TLS 1.3 enabled. I checked 3 blocked sites after enabling the options you suggested. They were still blocked. I confirmed all 3 didn't have TLS 1.3 by testing them with ssllabs ssltest. All had results show TLS 1.3 as "No".
- tgragnato 7y agoExpected, without esni (which requires tls1.3) there’s no way to conceal the domain from the boxes. Or.. your ISP might be blocking the IPs. Remember to revert the settings to the original values.