OpenWRT и SSL_ERROR_RX_RECORD_TOO_LONG/ERR_SSL_PROTOCOL_ERROR #15847

fixator10 · 2026-07-08T13:33:33Z

fixator10
Jul 8, 2026

Использую данную сборку вручную перенося страты на OpenWRT роутер. gelbooru (всегда), pixiv (иногда) и некоторые другие околояпонские имиджборды вываливаются с ошибкой SSL_ERROR_RX_RECORD_TOO_LONG в FF (Zen) и ERR_SSL_PROTOCOL_ERROR в Chrome (QuteBrowser).

Конфиг следующий:

NFQWS_OPT="
--skip --comment 'general (ALT)' --new
--filter-tcp=443 --hostlist=/opt/zapret/ipset/zapret-hosts-google.txt --ip-id=zero --dpi-desync=hostfakesplit --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=www.google.com --new
--filter-tcp=80,443 <HOSTLIST> --dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls=/opt/zapret/files/fake/stun.bin --dpi-desync-fake-tls=/opt/zapret/files/fake/tls_clienthello_www_google_com.bin --dpi-desync-fake-http=/opt/zapret/files/fake/tls_clienthello_www_onetrust_com.bin
"
NFQWS_IPSETS_OPT="--dpi-desync=fake,fakedsplit --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fakedsplit-pattern=0x00 --dpi-desync-fake-tls=/opt/zapret/files/fake/stun.bin --dpi-desync-fake-tls=/opt/zapret/files/fake/tls_clienthello_www_google_com.bin --dpi-desync-fake-http=/opt/zapret/files/fake/tls_clienthello_www_onetrust_com.bin"
NFQWS_OPT_DESYNC_DISCORD_MEDIA="--dpi-desync=fake --dpi-desync-fake-discord=/opt/zapret/files/fake/quic_initial_www_google_com.bin --dpi-desync-fake-stun=/opt/zapret/files/fake/quic_initial_www_google_com.bin --dpi-desync-repeats=6"
DISCORD_MEDIA_PORT_RANGE="19294-19344,50000-50100"
NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic=/opt/zapret/files/fake/quic_initial_www_google_com.bin"

NFQWS_IPSETS_OPT применяется в копиях 50-nfqws-ipset для почти каждого хостера/CDN.

/opt/zapret/init.d/openwrt/custom.d$ ls
50-akamai-ipset
50-aws-ipset
50-buyvm-ipset
50-cloudflare-ipset
50-constant-ipset
50-discord-media
50-do-ipset
50-hetzner-ipset
50-oracle-ipset
50-ovh-ipset
50-quic4all
50-vercel-ipset

NFQWS_OPT_DESYNC_QUIC применяется на 50-quic4all
NFQWS_OPT_DESYNC_DISCORD_MEDIA и DISCORD_MEDIA_PORT_RANGE на 50-discord-media

OpenTLS показывает следующее (на "клиентской" винде):

Details

~ λ openssl s_client --trace --connect gelbooru.com:443
Connecting to 131.143.124.72
CONNECTED(000002F0)
Sent TLS Record
Header:
  Version = TLS 1.0 (0x301)
  Content Type = Handshake (22)
  Length = 1547
    ClientHello, Length=1543
      client_version=0x303 (TLS 1.2)
      Random:
        gmt_unix_time=0xF2680383
        random_bytes (len=28): 91A26EBF36B9A2AC92CE68DD8499A8A4B01DFA6A14CA3EC44C466CE8
      session_id (len=32): 9119F377F2D8AF33A03BE2F1AA242D2B58F5620FAEA5D03CABB5A95CA66E7DC4
      cipher_suites (len=60)
        {0x13, 0x02} TLS_AES_256_GCM_SHA384
        {0x13, 0x03} TLS_CHACHA20_POLY1305_SHA256
        {0x13, 0x01} TLS_AES_128_GCM_SHA256
        {0xC0, 0x2C} TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
        {0xC0, 0x30} TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        {0x00, 0x9F} TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
        {0xCC, 0xA9} TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
        {0xCC, 0xA8} TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
        {0xCC, 0xAA} TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
        {0xC0, 0x2B} TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        {0xC0, 0x2F} TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        {0x00, 0x9E} TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
        {0xC0, 0x24} TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
        {0xC0, 0x28} TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
        {0x00, 0x6B} TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
        {0xC0, 0x23} TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
        {0xC0, 0x27} TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
        {0x00, 0x67} TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
        {0xC0, 0x0A} TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
        {0xC0, 0x14} TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
        {0x00, 0x39} TLS_DHE_RSA_WITH_AES_256_CBC_SHA
        {0xC0, 0x09} TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
        {0xC0, 0x13} TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
        {0x00, 0x33} TLS_DHE_RSA_WITH_AES_128_CBC_SHA
        {0x00, 0x9D} TLS_RSA_WITH_AES_256_GCM_SHA384
        {0x00, 0x9C} TLS_RSA_WITH_AES_128_GCM_SHA256
        {0x00, 0x3D} TLS_RSA_WITH_AES_256_CBC_SHA256
        {0x00, 0x3C} TLS_RSA_WITH_AES_128_CBC_SHA256
        {0x00, 0x35} TLS_RSA_WITH_AES_256_CBC_SHA
        {0x00, 0x2F} TLS_RSA_WITH_AES_128_CBC_SHA
      compression_methods (len=1)
        No Compression (0x00)
      extensions, length = 1410
        extension_type=renegotiate(65281), length=1
            <EMPTY>
        extension_type=server_name(0), length=17
          0000 - 00 0f 00 00 0c 67 65 6c-62 6f 6f 72 75 2e 63   .....gelbooru.c
          000f - 6f 6d                                          om
        extension_type=ec_point_formats(11), length=4
          uncompressed (0)
          ansiX962_compressed_prime (1)
          ansiX962_compressed_char2 (2)
        extension_type=supported_groups(10), length=18
          X25519MLKEM768 (4588)
          ecdh_x25519 (29)
          secp256r1 (P-256) (23)
          ecdh_x448 (30)
          secp384r1 (P-384) (24)
          secp521r1 (P-521) (25)
          ffdhe2048 (256)
          ffdhe3072 (257)
        extension_type=session_ticket(35), length=0
        extension_type=encrypt_then_mac(22), length=0
        extension_type=extended_master_secret(23), length=0
        extension_type=signature_algorithms(13), length=54
          mldsa65 (0x0905)
          mldsa87 (0x0906)
          mldsa44 (0x0904)
          ecdsa_secp256r1_sha256 (0x0403)
          ecdsa_secp384r1_sha384 (0x0503)
          ecdsa_secp521r1_sha512 (0x0603)
          ed25519 (0x0807)
          ed448 (0x0808)
          ecdsa_brainpoolP256r1tls13_sha256 (0x081a)
          ecdsa_brainpoolP384r1tls13_sha384 (0x081b)
          ecdsa_brainpoolP512r1tls13_sha512 (0x081c)
          rsa_pss_pss_sha256 (0x0809)
          rsa_pss_pss_sha384 (0x080a)
          rsa_pss_pss_sha512 (0x080b)
          rsa_pss_rsae_sha256 (0x0804)
          rsa_pss_rsae_sha384 (0x0805)
          rsa_pss_rsae_sha512 (0x0806)
          rsa_pkcs1_sha256 (0x0401)
          rsa_pkcs1_sha384 (0x0501)
          rsa_pkcs1_sha512 (0x0601)
          ecdsa_sha224 (0x0303)
          rsa_pkcs1_sha224 (0x0301)
          dsa_sha224 (0x0302)
          dsa_sha256 (0x0402)
          dsa_sha384 (0x0502)
          dsa_sha512 (0x0602)
        extension_type=supported_versions(43), length=5
          TLS 1.3 (772)
          TLS 1.2 (771)
        extension_type=psk_key_exchange_modes(45), length=2
          psk_dhe_ke (1)
        extension_type=key_share(51), length=1258
            NamedGroup: X25519MLKEM768 (4588)
            key_exchange:  (len=1216): FAF57ACA320EB1C5333111B3ED81B919CC86D40442B8DC517C50CDF2294992059085DCC520EC39C6936FD0E39C36A6B6DAA922B4218C5393671C2B5242F15E8DE081F9241253EA1FBC3A666650283176525902D0B7ACB274874D9B616B00BC5FAA857F4C2B6E0B30BD990B4B002B27DE778E44BA6E1E69A4F8B508CFE78DE34A3EFB3937DE24722AD935E15B82008C0829E2BA3FF02D4D683CEE03C79D8748B029AF7F10C0815B4306F5143D543AD8804A1D0B45847C767F39C87039AA7045BE2FCC532F853BA57B5893CA0A3EF077A9CA681DF09D6D855B6A81124AB4612280884C245047921194099456371465851113EA0EFA2B62D732B78F438EE0C677F937BA11E23DBDB44BA357706F683B9DAB0EB8FBC4DC789A0B6C67F5624A7DD5493BC28EADF39A12568AC7ABA352523B302C720F803E71A0B637F91F1B783B95419A2A67059B76941B7718AC9035CE96C019F0BB2AD342D77C207AD4B46DD831685B1A492B3B13EC2AF870AD08CAB38DC92818616C48661FC4A6C7551B0EB48312E3B6A12FF95294799739CC331B8BC7FC702713C98B036699EC43BAAE888910559206A384A111CABF1B8465A443B1E29E46E61DFB171F598A1CCE2C44A9889E0B74532CD9A2209AB2AE50210A3B0BF30A9EDB7880608C6CAD694AC21C5CCF41A20766B50A39797683B0216C2A0C076E910376C7D00A05244D320A66F8389371A0BD30D453D4524368C7091D7C7D3D095413F548705C988603B6E7B7B0BC123A5EB5305B81950C195CD6507214530D4D6ABEBF85C045794AAE8CBB7ADCC82971C49B3434D4D287390A9A6541966EDA9AADE268F31676F312B479AC340172CA7F513FABD21E4E68764C51AECBB32B8E793E8FF39FE0757B0D72B613A4B6D08B207899510329C19CD986DA6280DF9902C739438FE91B24316074D21224BC80F472A22C4308BE1A918D33CEA8982A9EE717E7681BADAC6762AAC764A09037D3C86A1466FBF9AF5E451171666C1237B0E36C4793515E7E3984B533494A4C0430E4299DB853AB96693F6A5F8DE03B8B608ED478C78D033D65F4C57EB08B4563057990A0E8AA5362AAA4D008C0DA92850811AA7BE4145AC33029789521470763BB27DDB270B19A35C9464CC97579F9F84EA753C7F0C07AC0125E8B680CA0DB9A37D3533FC28517DB58DE80A608D2C298609345CA4BD517C416658D1B248F616B1EE01BA437768EE6D73C6B753617164EA49A65E0CC8795AAA4162B215ADB7479B718B819C3BFEC42B8707656114F451BAB44397033366E7D2AC8A4E2B4570C90E7B42C2135BFE335B5DECA4C8E48C121F28F782621202921C711AA621981C084611B959F7A68C2E10712111C5181C884B8947795D2714E047316A24D50724F1A2866845B3B3BC01A259442189BB966639BBB52A43BCA3C4B839E9326C04ED94C2FA965FDF0C51D359B2CD2AB05802BAAD3B05A1026314445260C10F8315370BAA194E3256DA55FD4C9075B3799338935FCECCD9C7C1AEB46351CE70FEA39724F924308C39764C263417C4434A4212CF9CED6E41413764A5AC68950A6987F20A17D873ED34606B4C40D70D3995F19CABF2C3F0A5BA7DD71401DB8385932240C21516811C66C59B52D0C28ED365A2D87FADBC7C4582A4441223726574D76F47D0A3A6BB811A2EF61DECF32E55A1B89D20B435D37CDADFE861C0455F53787D34132F405C035
            NamedGroup: ecdh_x25519 (29)
            key_exchange:  (len=32): E341F83B0A083EDEF810FDFE80096D999EED9869C9BB2170E841DAC40D691E14
        extension_type=compress_certificate(27), length=3
          zlib (1)

Received TLS Record
Header:
  Version = UNKNOWN (0x5454)
  Content Type = UNKNOWN (72)
  Length = 20527
20670000:error:0A00010B:SSL routines:tls_validate_record_header:wrong version number:../openssl-3.5.7/ssl/record/methods/tlsany_meth.c:77:
---
no peer certificate available
---
No client certificate CA names sent
Negotiated TLS1.3 group: <NULL>
---
SSL handshake has read 5 bytes and written 1552 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Protocol: TLSv1.3
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

Памагитя

fixator10 · 2026-07-08T13:39:46Z

fixator10
Jul 8, 2026
Author

Вывод https://github.com/Runnin4ik/dpi-detector:

Details

Проверка TCP 16-20KB блокировки  Целей: 108 | timeout: 8.0s                                 
┌────────┬──────────┬───────────────────┬───────┬──────────────┬──────────────────────────┐ 
│ ID     │ ASN      │ Провайдер         │ Alive │    Статус    │ Детали                   │ 
├────────┼──────────┼───────────────────┼───────┼──────────────┼──────────────────────────┤ 
│ OR-01  │ AS31898  │ Oracle Cloud      │  Да   │  PROTO ERR   │ Protocol error           │ 
│ OR-02  │ AS31898  │ Oracle Cloud      │  Да   │      OK      │                          │ 
│ OR-03  │ AS31898  │ Oracle Cloud      │  Да   │      OK      │                          │ 
│ OR-04  │ AS31898  │ Oracle Cloud      │  Да   │  PROTO ERR   │ Protocol error           │ 
│ OR-05  │ AS54253  │ Oracle 1 HTTP     │  Да   │      OK      │                          │ 
│ OR-06  │ AS54253  │ Oracle 1          │  Да   │      OK      │                          │ 
│ OR-07  │ AS54253  │ Oracle 1          │  Да   │      OK      │                          │ 
│ OR-09  │ AS1219   │ Oracle 2          │  Нет  │   SYN DROP   │ TCP SYN timeout          │ 
│ OR-10  │ AS6142   │ Oracle 3          │  Да   │      OK      │                          │ 
│ OR-11  │ AS6142   │ Oracle 3          │  Да   │      OK      │                          │ 
│ OR-12  │ AS14544  │ Oracle 4          │  Да   │      OK      │                          │ 
│ OR-13  │ AS20054  │ Oracle 5          │  Да   │      OK      │                          │ 
│ AK-01  │ AS20940☆ │ Akamai 1          │  Да   │      OK      │                          │ 
│ AK-02  │ AS20940☆ │ Akamai 1          │  Да   │      OK      │                          │ 
│ AK-03  │ AS20940☆ │ Akamai 1 HTTP     │  Да   │      OK      │                          │ 
│ AK-04  │ AS20940☆ │ Akamai 1          │  Нет  │   TLS DROP   │ TLS Handshake timeout    │ 
│ AK-05  │ AS16625  │ Akamai 2          │  Да   │      OK      │                          │ 
│ AK-06  │ AS16625  │ Akamai 2          │  Да   │      OK      │                          │ 
│ AK-07  │ AS12222  │ Akamai 3          │  Да   │      OK      │                          │ 
│ AK-08  │ AS12222  │ Akamai 3          │  Да   │      OK      │                          │ 
│ AK-09  │ AS33905  │ Akamai 4          │  Да   │      OK      │                          │ 
│ AK-10  │ AS63949  │ Akamai Cloud      │  Да   │      OK      │                          │ 
│ AK-11  │ AS63949  │ Akamai Cloud      │  Да   │      OK      │                          │ 
│ HE-01  │ AS24940☆ │ Hetzner           │  Да   │      OK      │                          │ 
│ HE-02  │ AS24940☆ │ Hetzner           │  Да   │      OK      │                          │ 
│ HE-02  │ AS24940☆ │ Hetzner HTTP      │  Да   │ READ TIMEOUT │ Read Timeout             │ 
│ HE-03  │ AS213230 │ Hetzner Cloud 2   │  Да   │      OK      │                          │ 
│ HE-04  │ AS213230 │ Hetzner Cloud 2   │  Да   │   READ ERR   │ SSLError                 │ 
│ HE-05  │ AS212317 │ Hetzner Cloud 3   │  Да   │      OK      │                          │ 
│ HE-06  │ AS212317 │ Hetzner Cloud 3   │  Да   │      OK      │                          │ 
│ HE-07  │ AS215859 │ Hetzner Cloud 4   │  Нет  │   REFUSED    │ TCP соединение отклонено │ 
│ HE-08  │ AS215859 │ Hetzner Cloud 4   │  Да   │      OK      │                          │ 
│ SW-01  │ AS12876  │ Scaleway 1        │  Да   │   DETECTED   │ Read Timeout at 16KB     │ 
│ SW-02  │ AS12876  │ Scaleway 1        │  Да   │   DETECTED   │ Read Timeout at 20KB     │ 
│ SW-03  │ AS12876  │ Scaleway 1        │  Да   │   DETECTED   │ Read Timeout at 20KB     │ 
│ SW-04  │ AS12876  │ Scaleway 1 HTTP   │  Да   │   DETECTED   │ Read Timeout at 4KB      │ 
│ SW-05  │ AS29447  │ Scaleway 2        │  Да   │   DETECTED   │ Read Timeout at 20KB     │ 
│ SW-06  │ AS29447  │ Scaleway 2        │  Да   │   DETECTED   │ Read Timeout at 20KB     │ 
│ SW-07  │ AS29447  │ Scaleway 2        │  Нет  │   SYN DROP   │ TCP SYN timeout          │ 
│ SW-08  │ AS29447  │ Scaleway 2        │  Да   │   DETECTED   │ Read Timeout at 20KB     │ 
│ CNT-01 │ AS51167  │ Contabo 1         │  Да   │   DETECTED   │ Read Timeout at 20KB     │ 
│ CNT-02 │ AS51167  │ Contabo 1         │  Нет  │   SYN DROP   │ TCP SYN timeout          │ 
│ CNT-03 │ AS51167  │ Contabo 1         │  Да   │   DETECTED   │ Read Timeout at 20KB     │ 
│ CNT-04 │ AS51167  │ Contabo 1         │  Да   │   DETECTED   │ Read Timeout at 16KB     │ 
│ CNT-05 │ AS141995 │ Contabo 2         │  Да   │   DETECTED   │ Read Timeout at 20KB     │ 
│ CNT-06 │ AS141995 │ Contabo 2         │  Да   │   DETECTED   │ Read Timeout at 16KB     │ 
│ CNT-07 │ AS141995 │ Contabo 2         │  Да   │   DETECTED   │ Read Timeout at 20KB     │ 
│ DO-01  │ AS14061  │ DigitalOcean 1    │  Да   │      OK      │                          │ 
│ DO-02  │ AS14061  │ DigitalOcean 1    │  Да   │      OK      │                          │ 
│ DO-03  │ AS14061  │ DigitalOcean 1    │  Да   │      OK      │                          │ 
│ DO-04  │ AS14061  │ DigitalOcean 1    │  Да   │      OK      │                          │ 
│ DO-05  │ AS14061  │ DigitalOcean 1    │  Да   │      OK      │                          │ 
│ DO-06  │ AS46652  │ DigitalOcean 2    │  Да   │      OK      │                          │ 
│ DO-07  │ AS46652  │ DigitalOcean 2    │  Да   │      OK      │                          │ 
│ AWS-02 │ AS16509☆ │ AWS 1             │  Нет  │   SYN DROP   │ TCP SYN timeout          │ 
│ AWS-03 │ AS16509☆ │ AWS 1             │  Да   │   DETECTED   │ Read Timeout at 16KB     │ 
│ AWS-04 │ AS14618  │ AWS 2             │  Да   │      OK      │                          │ 
│ AWS-05 │ AS14618  │ AWS 2             │  Да   │      OK      │                          │ 
│ AWS-06 │ AS8987   │ AWS 3             │  Нет  │   TLS DROP   │ TLS Handshake timeout    │ 
│ AWS-07 │ AS8987   │ AWS 3             │  Нет  │   TLS DROP   │ TLS Handshake timeout    │ 
│ CDN-02 │ AS60068  │ CDN77 #1          │  Да   │   DETECTED   │ Read Timeout at 20KB     │ 
│ CDN-03 │ AS60068  │ CDN77 #1          │  Да   │   DETECTED   │ Read Timeout at 16KB     │ 
│ CDN-04 │ AS60068  │ CDN77 #1 HTTP     │  Да   │   DETECTED   │ Read Timeout at 24KB     │ 
│ CDN-05 │ AS212238 │ CDN77 #2          │  Да   │   DETECTED   │ Read Timeout at 20KB     │ 
│ CDN-06 │ AS212238 │ CDN77 #2          │  Да   │   DETECTED   │ Read Timeout at 20KB     │ 
│ CDN-07 │ AS212238 │ CDN77 #2          │  Нет  │   SYN DROP   │ TCP SYN timeout          │ 
│ CF-01  │ AS13335  │ Cloudflare        │  Да   │      OK      │                          │ 
│ CF-02  │ AS13335  │ Cloudflare        │  Да   │      OK      │                          │ 
│ CF-03  │ AS13335  │ Cloudflare        │  Да   │      OK      │                          │ 
│ CF-04  │ AS13335  │ Cloudflare        │  Да   │      OK      │                          │ 
│ CF-05  │ AS13335  │ Cloudflare        │  Да   │      OK      │                          │ 
│ CF-06  │ AS13335  │ Cloudflare        │  Да   │      OK      │                          │ 
│ FST-01 │ AS54113  │ Fastly            │  Да   │      OK      │                          │ 
│ FST-02 │ AS54113  │ Fastly            │  Да   │      OK      │                          │ 
│ FST-03 │ AS54113  │ Fastly GitHub 108 │  Да   │      OK      │                          │ 
│ FST-04 │ AS54113  │ Fastly GitHub 109 │  Да   │      OK      │                          │ 
│ FST-05 │ AS54113  │ Fastly GitHub 110 │  Нет  │   TLS DROP   │ TLS Handshake timeout    │ 
│ FST-06 │ AS54113  │ Fastly GitHub 111 │  Да   │      OK      │                          │ 
│ GCR-01 │ AS199524 │ Gcore 1           │  Нет  │   SYN DROP   │ TCP SYN timeout          │ 
│ GCR-02 │ AS199524 │ Gcore 1           │  Да   │   DETECTED   │ Read Timeout at 20KB     │ 
│ GCR-03 │ AS199524 │ Gcore 1           │  Да   │   DETECTED   │ Read Timeout at 20KB     │ 
│ GCR-04 │ AS199524 │ Gcore 1           │  Да   │   DETECTED   │ Read Timeout at 16KB     │ 
│ GCR-05 │ AS202422 │ Gcore 2           │  Да   │   DETECTED   │ Read Timeout at 16KB     │ 
│ GCR-06 │ AS202422 │ Gcore 2           │  Да   │   DETECTED   │ Read Timeout at 20KB     │ 
│ OVH-01 │ AS16276  │ OVH               │  Нет  │   SYN DROP   │ TCP SYN timeout          │ 
│ OVH-02 │ AS16276  │ OVH               │  Да   │      OK      │                          │ 
│ OVH-03 │ AS16276  │ OVH               │  Нет  │   TLS RST    │ Активный сброс (TCP RST) │ 
│ OVH-04 │ AS16276  │ OVH               │  Да   │      OK      │                          │ 
│ OVH-05 │ AS16276  │ OVH HTTP          │  Да   │      OK      │                          │ 
│ VLT-01 │ AS20473  │ Vultr             │  Да   │      OK      │                          │ 
│ VLT-02 │ AS20473  │ Vultr             │  Да   │      OK      │                          │ 
│ VLT-03 │ AS20473  │ Vultr             │  Да   │      OK      │                          │ 
│ VLT-04 │ AS20473  │ Vultr             │  Да   │      OK      │                          │ 
│ СV-01  │ AS62240  │ Clouvider         │  Да   │   DETECTED   │ Read Timeout at 20KB     │ 
│ CV-02  │ AS62240  │ Clouvider         │  Да   │   DETECTED   │ Read Timeout at 20KB     │ 
│ FT-01  │ AS53667  │ FranTech          │  Да   │      OK      │                          │ 
│ FT-02  │ AS53667  │ FranTech          │  Да   │      OK      │                          │ 
│ GC-01  │ AS396982 │ Google Cloud      │  Да   │      OK      │                          │ 
│ GC-02  │ AS396982 │ Google Cloud      │  Да   │      OK      │                          │ 
│ IM-01  │ AS20860  │ IOMART 1          │  Да   │   DETECTED   │ Read Timeout at 16KB     │ 
│ IM-02  │ AS21130  │ IOMART 2          │  Да   │   DETECTED   │ Read Timeout at 16KB     │ 
│ MBC-01 │ AS8849   │ Melbicom 1        │  Нет  │   SYN DROP   │ TCP SYN timeout          │ 
│ MBC-03 │ AS56630  │ Melbicom 2        │  Да   │   DETECTED   │ Read Timeout at 16KB     │ 
│ CN-01  │ AS51765  │ CreaNova          │  Да   │   DETECTED   │ Read Timeout at 16KB     │ 
│ FRX-01 │ AS48040  │ Fornex            │  Да   │      OK      │                          │ 
│ ME-01  │ AS9009   │ M247 Europe SRL   │  Нет  │   SYN DROP   │ TCP SYN timeout          │ 
│ SCA-01 │ AS58061  │ Scalaxy           │  Да   │   DETECTED   │ Read Timeout at 16KB     │ 
│ ZL-01  │ AS21859  │ Zenlayer          │  Да   │   DETECTED   │ Read Timeout at 20KB     │ 
└────────┴──────────┴───────────────────┴───────┴──────────────┴──────────────────────────┘ 

┌─────────────────────── Итог ───────────────────────┐                                      
│ TCP 16-20KB      √ 57/108 OK  × 32 блок.  (52% ОК) │                                      
└────────────────────────────────────────────────────┘                                      

Проверка завершена.

1 reply

HatabaSS Jul 17, 2026

Вывод https://github.com/Runnin4ik/dpi-detector:

Details

тут есть проблемки, но надо учесть что чекеры дрисня:
Проверка TCP 16-20KB блокировки Целей: 108 | timeout: 8.0s

┌────────┬──────────┬───────────────────┬───────┬───────────┬──────────────────────────────┐
│ ID     │ ASN      │ Провайдер         │ Alive │  Статус   │ Детали                       │
├────────┼──────────┼───────────────────┼───────┼───────────┼──────────────────────────────┤
│ OR-01  │ AS31898  │ Oracle Cloud      │  Нет  │ SYN DROP  │ TCP SYN timeout              │
│ OR-02  │ AS31898  │ Oracle Cloud      │  Да   │    OK     │                              │
│ OR-03  │ AS31898  │ Oracle Cloud      │  Да   │    OK     │                              │
│ OR-04  │ AS31898  │ Oracle Cloud      │  Да   │ PROTO ERR │ Protocol error               │
│ OR-05  │ AS54253  │ Oracle 1 HTTP     │  Да   │    OK     │                              │
│ OR-06  │ AS54253  │ Oracle 1          │  Да   │    OK     │                              │
│ OR-07  │ AS54253  │ Oracle 1          │  Да   │    OK     │                              │
│ OR-09  │ AS1219   │ Oracle 2          │  Нет  │ SYN DROP  │ TCP SYN timeout              │
│ OR-10  │ AS6142   │ Oracle 3          │  Да   │    OK     │                              │
│ OR-11  │ AS6142   │ Oracle 3          │  Да   │    OK     │                              │
│ OR-12  │ AS14544  │ Oracle 4          │  Да   │    OK     │                              │
│ OR-13  │ AS20054  │ Oracle 5          │  Да   │    OK     │                              │
│ AK-01  │ AS20940☆ │ Akamai 1          │  Да   │    OK     │                              │
│ AK-02  │ AS20940☆ │ Akamai 1          │  Да   │    OK     │                              │
│ AK-03  │ AS20940☆ │ Akamai 1 HTTP     │  Да   │    OK     │                              │
│ AK-04  │ AS20940☆ │ Akamai 1          │  Нет  │  TLS RST  │ Активный сброс (TCP RST)     │
│ AK-05  │ AS16625  │ Akamai 2          │  Нет  │ TLS DROP  │ TLS Handshake timeout        │
│ AK-06  │ AS16625  │ Akamai 2          │  Нет  │ TLS DROP  │ TLS Handshake timeout        │
│ AK-07  │ AS12222  │ Akamai 3          │  Да   │    OK     │                              │
│ AK-08  │ AS12222  │ Akamai 3          │  Нет  │ TLS DROP  │ TLS Handshake timeout        │
│ AK-09  │ AS33905  │ Akamai 4          │  Да   │ DETECTED  │ TLS Handshake timeout at 4KB │
│ AK-10  │ AS63949  │ Akamai Cloud      │  Да   │    OK     │                              │
│ AK-11  │ AS63949  │ Akamai Cloud      │  Да   │    OK     │                              │
│ HE-01  │ AS24940☆ │ Hetzner           │  Да   │    OK     │                              │
│ HE-02  │ AS24940☆ │ Hetzner           │  Да   │    OK     │                              │
│ HE-02  │ AS24940☆ │ Hetzner HTTP      │  Да   │    OK     │                              │
│ HE-03  │ AS213230 │ Hetzner Cloud 2   │  Да   │    OK     │                              │
│ HE-04  │ AS213230 │ Hetzner Cloud 2   │  Нет  │ TLS ALERT │ Handshake alert              │
│ HE-05  │ AS212317 │ Hetzner Cloud 3   │  Да   │    OK     │                              │
│ HE-06  │ AS212317 │ Hetzner Cloud 3   │  Да   │    OK     │                              │
│ HE-07  │ AS215859 │ Hetzner Cloud 4   │  Нет  │ SYN DROP  │ TCP SYN timeout              │
│ HE-08  │ AS215859 │ Hetzner Cloud 4   │  Да   │    OK     │                              │
│ SW-01  │ AS12876  │ Scaleway 1        │  Да   │    OK     │                              │
│ SW-02  │ AS12876  │ Scaleway 1        │  Да   │    OK     │                              │
│ SW-03  │ AS12876  │ Scaleway 1        │  Да   │    OK     │                              │
│ SW-04  │ AS12876  │ Scaleway 1 HTTP   │  Да   │    OK     │                              │
│ SW-05  │ AS29447  │ Scaleway 2        │  Да   │    OK     │                              │
│ SW-06  │ AS29447  │ Scaleway 2        │  Да   │    OK     │                              │
│ SW-07  │ AS29447  │ Scaleway 2        │  Нет  │ SYN DROP  │ TCP SYN timeout              │
│ SW-08  │ AS29447  │ Scaleway 2        │  Да   │    OK     │                              │
│ CNT-01 │ AS51167  │ Contabo 1         │  Да   │    OK     │                              │
│ CNT-02 │ AS51167  │ Contabo 1         │  Нет  │ SYN DROP  │ TCP SYN timeout              │
│ CNT-03 │ AS51167  │ Contabo 1         │  Да   │    OK     │                              │
│ CNT-04 │ AS51167  │ Contabo 1         │  Да   │    OK     │                              │
│ CNT-05 │ AS141995 │ Contabo 2         │  Да   │    OK     │                              │
│ CNT-06 │ AS141995 │ Contabo 2         │  Да   │    OK     │                              │
│ CNT-07 │ AS141995 │ Contabo 2         │  Да   │    OK     │                              │
│ DO-01  │ AS14061  │ DigitalOcean 1    │  Да   │    OK     │                              │
│ DO-02  │ AS14061  │ DigitalOcean 1    │  Да   │    OK     │                              │
│ DO-03  │ AS14061  │ DigitalOcean 1    │  Да   │    OK     │                              │
│ DO-04  │ AS14061  │ DigitalOcean 1    │  Да   │    OK     │                              │
│ DO-05  │ AS14061  │ DigitalOcean 1    │  Да   │    OK     │                              │
│ DO-06  │ AS46652  │ DigitalOcean 2    │  Да   │    OK     │                              │
│ DO-07  │ AS46652  │ DigitalOcean 2    │  Да   │    OK     │                              │
│ AWS-02 │ AS16509☆ │ AWS 1             │  Нет  │ SYN DROP  │ TCP SYN timeout              │
│ AWS-03 │ AS16509☆ │ AWS 1             │  Да   │    OK     │                              │
│ AWS-04 │ AS14618  │ AWS 2             │  Да   │    OK     │                              │
│ AWS-05 │ AS14618  │ AWS 2             │  Да   │    OK     │                              │
│ AWS-06 │ AS8987   │ AWS 3             │  Да   │    OK     │                              │
│ AWS-07 │ AS8987   │ AWS 3             │  Да   │    OK     │                              │
│ CDN-02 │ AS60068  │ CDN77 #1          │  Да   │    OK     │                              │
│ CDN-03 │ AS60068  │ CDN77 #1          │  Да   │    OK     │                              │
│ CDN-04 │ AS60068  │ CDN77 #1 HTTP     │  Да   │    OK     │                              │
│ CDN-05 │ AS212238 │ CDN77 #2          │  Да   │    OK     │                              │
│ CDN-06 │ AS212238 │ CDN77 #2          │  Да   │    OK     │                              │
│ CDN-07 │ AS212238 │ CDN77 #2          │  Да   │    OK     │                              │
│ CF-01  │ AS13335  │ Cloudflare        │  Да   │    OK     │                              │
│ CF-02  │ AS13335  │ Cloudflare        │  Да   │    OK     │                              │
│ CF-03  │ AS13335  │ Cloudflare        │  Да   │    OK     │                              │
│ CF-04  │ AS13335  │ Cloudflare        │  Да   │    OK     │                              │
│ CF-05  │ AS13335  │ Cloudflare        │  Да   │    OK     │                              │
│ CF-06  │ AS13335  │ Cloudflare        │  Да   │    OK     │                              │
│ FST-01 │ AS54113  │ Fastly            │  Да   │    OK     │                              │
│ FST-02 │ AS54113  │ Fastly            │  Да   │    OK     │                              │
│ FST-03 │ AS54113  │ Fastly GitHub 108 │  Да   │    OK     │                              │
│ FST-04 │ AS54113  │ Fastly GitHub 109 │  Да   │    OK     │                              │
│ FST-05 │ AS54113  │ Fastly GitHub 110 │  Да   │    OK     │                              │
│ FST-06 │ AS54113  │ Fastly GitHub 111 │  Да   │    OK     │                              │
│ GCR-01 │ AS199524 │ Gcore 1           │  Нет  │ SYN DROP  │ TCP SYN timeout              │
│ GCR-02 │ AS199524 │ Gcore 1           │  Да   │    OK     │                              │
│ GCR-03 │ AS199524 │ Gcore 1           │  Да   │    OK     │                              │
│ GCR-04 │ AS199524 │ Gcore 1           │  Да   │    OK     │                              │
│ GCR-05 │ AS202422 │ Gcore 2           │  Да   │    OK     │                              │
│ GCR-06 │ AS202422 │ Gcore 2           │  Да   │    OK     │                              │
│ OVH-01 │ AS16276  │ OVH               │  Нет  │ SYN DROP  │ TCP SYN timeout              │
│ OVH-02 │ AS16276  │ OVH               │  Да   │    OK     │                              │
│ OVH-03 │ AS16276  │ OVH               │  Нет  │  TLS RST  │ Активный сброс (TCP RST)     │
│ OVH-04 │ AS16276  │ OVH               │  Да   │    OK     │                              │
│ OVH-05 │ AS16276  │ OVH HTTP          │  Да   │    OK     │                              │
│ VLT-01 │ AS20473  │ Vultr             │  Да   │    OK     │                              │
│ VLT-02 │ AS20473  │ Vultr             │  Да   │    OK     │                              │
│ VLT-03 │ AS20473  │ Vultr             │  Да   │    OK     │                              │
│ VLT-04 │ AS20473  │ Vultr             │  Да   │    OK     │                              │
│ СV-01  │ AS62240  │ Clouvider         │  Да   │    OK     │                              │
│ CV-02  │ AS62240  │ Clouvider         │  Да   │    OK     │                              │
│ FT-01  │ AS53667  │ FranTech          │  Да   │    OK     │                              │
│ FT-02  │ AS53667  │ FranTech          │  Да   │    OK     │                              │
│ GC-01  │ AS396982 │ Google Cloud      │  Да   │    OK     │                              │
│ GC-02  │ AS396982 │ Google Cloud      │  Да   │    OK     │                              │
│ IM-01  │ AS20860  │ IOMART 1          │  Да   │    OK     │                              │
│ IM-02  │ AS21130  │ IOMART 2          │  Да   │    OK     │                              │
│ MBC-01 │ AS8849   │ Melbicom 1        │  Нет  │ SYN DROP  │ TCP SYN timeout              │
│ MBC-03 │ AS56630  │ Melbicom 2        │  Да   │    OK     │                              │
│ CN-01  │ AS51765  │ CreaNova          │  Да   │    OK     │                              │
│ FRX-01 │ AS48040  │ Fornex            │  Да   │    OK     │                              │
│ ME-01  │ AS9009   │ M247 Europe SRL   │  Нет  │ SYN DROP  │ TCP SYN timeout              │
│ SCA-01 │ AS58061  │ Scalaxy           │  Да   │    OK     │                              │
│ ZL-01  │ AS21859  │ Zenlayer          │  Да   │    OK     │                              │
└────────┴──────────┴───────────────────┴───────┴───────────┴──────────────────────────────┘

┌────────────────────── Итог ───────────────────────┐
│ TCP 16-20KB      √ 90/108 OK  × 1 блок.  (83% ОК) │
└───────────────────────────────────────────────────┘

Тест был с ip ИЗРАИЛЯ:

HatabaSS · 2026-07-17T14:09:13Z

HatabaSS
Jul 17, 2026

Делюсь своим кфг на openwrt:

--filter-udp=1-65535
--filter-l7=wireguard
--dpi-desync=fake
--dpi-desync-repeats=6
--dpi-desync-fooling=ts
--dpi-desync-any-protocol=1
--dpi-desync-fake-wireguard=/opt/zapret/files/fake/quic_initial_www_google_com.bin
--dpi-desync-fake-unknown-udp=/opt/zapret/files/fake/quic_initial_www_google_com.bin
--dpi-desync-cutoff=n4
--new

--filter-udp=19294-19344,50000-50100 
--filter-l7=discord,stun 
--dpi-desync=fake 
--dpi-desync-fake-discord=/opt/zapret/files/fake/quic_initial_www_google_com.bin
--dpi-desync-fake-stun=/opt/zapret/files/fake/quic_initial_www_google_com.bin
--dpi-desync-repeats=6 
--new 

--filter-tcp=2053,2083,2087,2096,8443 
--hostlist-domains=discord.media 
--dpi-desync=fake 
--dpi-desync-repeats=6 
--dpi-desync-fooling=ts 
--dpi-desync-fake-tls=/opt/zapret/files/fake/tls_clienthello_www_google_com.bin
--new 

--filter-tcp=80,443 
--hostlist=/opt/zapret/ipset/zapret-hosts-google.txt
--ip-id=zero 
--dpi-desync=fake,multisplit 
--dpi-desync-split-seqovl=681 
--dpi-desync-split-pos=1 
--dpi-desync-fooling=ts 
--dpi-desync-repeats=8
--dpi-desync-split-seqovl-pattern=/opt/zapret/files/fake/tls_clienthello_www_google_com.bin
--dpi-desync-fake-tls=/opt/zapret/files/fake/tls_clienthello_www_google_com.bin
--new 

--filter-tcp=1-65535
--hostlist-exclude=/opt/zapret/ipset/zapret-hosts-user-exclude.txt    
--ipset-exclude=/opt/zapret/ipset/zapret-ip-exclude.txt
--dpi-desync=fake 
--dpi-desync-repeats=3
--dpi-desync-fooling=ts 
--dpi-desync-fake-tls=/opt/zapret/files/fake/stun.bin
--dpi-desync-fake-tls=/opt/zapret/files/fake/tls_clienthello_www_google_com.bin
--dpi-desync-fake-tls=/opt/zapret/files/fake/tls_clienthello_max_ru.bin 
--new 

--filter-udp=1-65535
--hostlist-exclude=/opt/zapret/ipset/zapret-hosts-user-exclude.txt    
--ipset-exclude=/opt/zapret/ipset/zapret-ip-exclude.txt
--dpi-desync=fake
--dpi-desync-repeats=6 
--dpi-desync-fake-quic=/opt/zapret/files/fake/quic_initial_www_google_com.bin

Все устраивает(требуется настройка исключений, скоро скину в отделный diss)

0 replies

SnAnVl · 2026-07-17T14:44:47Z

SnAnVl
Jul 17, 2026

ERR_SSL_PROTOCOL_ERROR

Скорее всего фейк дошёл до сервера и сломал соединение

У вас в Винде включены timestamps?

1 reply

fixator10 Jul 17, 2026
Author

Да

~ λ netsh int tcp show global
Querying active state...

TCP Global Parameters
----------------------------------------------
Receive-Side Scaling State          : enabled
Receive Window Auto-Tuning Level    : normal
Add-On Congestion Control Provider  : default
ECN Capability                      : disabled
RFC 1323 Timestamps                 : enabled
Initial RTO                         : 1000
Receive Segment Coalescing State    : enabled
Non Sack Rtt Resiliency             : disabled
Max SYN Retransmissions             : 4
Fast Open                           : enabled
Fast Open Fallback                  : enabled
HyStart                             : enabled
Proportional Rate Reduction         : enabled
Pacing Profile                      : off

fixator10 · 2026-07-23T22:49:20Z

fixator10
Jul 23, 2026
Author

Пересел на эксперименты

NFQWS_OPT="
--skip --comment 'general (EXP)' --new
--filter-tcp=443 --hostlist=/opt/zapret/ipset/zapret-hosts-google.txt --ip-id=zero --dpi-desync=hostfakesplit --dpi-desync-fooling=ts --dpi-desync-hostfakesplit-mod=host=www.google.com --new
--filter-tcp=80,443,2053,2083,2087,2096,8443 <HOSTLIST> --dpi-desync=fake,multisplit --dpi-desync-split-seqovl=480 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=4 --dpi-desync-split-seqovl-pattern=/opt/zapret/files/fake/stun2.bin --dpi-desync-fake-tls=/opt/zapret/files/fake/tls_clienthello_www_onetrust_com.bin --dpi-desync-fake-http=/opt/zapret/files/fake/tls_clienthello_www_onetrust_com.bin
"
NFQWS_IPSETS_OPT="--dpi-desync=fake,multisplit --dpi-desync-split-seqovl=480 --dpi-desync-split-pos=1 --dpi-desync-fooling=ts --dpi-desync-repeats=4 --dpi-desync-split-seqovl-pattern=/opt/zapret/files/fake/stun2.bin --dpi-desync-fake-tls=/opt/zapret/files/fake/tls_clienthello_www_onetrust_com.bin --dpi-desync-fake-http=/opt/zapret/files/fake/tls_clienthello_www_onetrust_com.bin"
NFQWS_OPT_DESYNC_DISCORD_MEDIA="--dpi-desync=fake --dpi-desync-fake-discord=/opt/zapret/files/fake/quic_initial_steamcommunity_com.bin --dpi-desync-fake-stun=/opt/zapret/files/fake/quic_initial_steamcommunity_com.bin --dpi-desync-repeats=6"
DISCORD_MEDIA_PORT_RANGE="19294-19344,50000-50100"
NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic=/opt/zapret/files/fake/quic_initial_www_google_com.bin"

FF теперь выдаёт nssBadCert, Chrome - "сертификат сервера не является доверенным", затем при попытке загрузки несекьюрно, всё тот же ERR_SSL_PROTOCOL_ERROR

OpenSSL output

Connecting to 131.143.124.72
CONNECTED(000002F0)
Sent TLS Record
Header:
  Version = TLS 1.0 (0x301)
  Content Type = Handshake (22)
  Length = 1547
    ClientHello, Length=1543
      client_version=0x303 (TLS 1.2)
      Random:
        gmt_unix_time=0x58D68241
        random_bytes (len=28): 9C3605A6D95D1D00BBE62C0095B9DAC6F2702F8EB1A8928282C5D3B0
      session_id (len=32): 24B6BD5FC9E68401CA02A74AA3B7CEBFF7195C62A69D2BCAD95E9E25195D6E88
      cipher_suites (len=60)
        {0x13, 0x02} TLS_AES_256_GCM_SHA384
        {0x13, 0x03} TLS_CHACHA20_POLY1305_SHA256
        {0x13, 0x01} TLS_AES_128_GCM_SHA256
        {0xC0, 0x2C} TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
        {0xC0, 0x30} TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        {0x00, 0x9F} TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
        {0xCC, 0xA9} TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
        {0xCC, 0xA8} TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
        {0xCC, 0xAA} TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
        {0xC0, 0x2B} TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        {0xC0, 0x2F} TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        {0x00, 0x9E} TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
        {0xC0, 0x24} TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
        {0xC0, 0x28} TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
        {0x00, 0x6B} TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
        {0xC0, 0x23} TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
        {0xC0, 0x27} TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
        {0x00, 0x67} TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
        {0xC0, 0x0A} TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
        {0xC0, 0x14} TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
        {0x00, 0x39} TLS_DHE_RSA_WITH_AES_256_CBC_SHA
        {0xC0, 0x09} TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
        {0xC0, 0x13} TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
        {0x00, 0x33} TLS_DHE_RSA_WITH_AES_128_CBC_SHA
        {0x00, 0x9D} TLS_RSA_WITH_AES_256_GCM_SHA384
        {0x00, 0x9C} TLS_RSA_WITH_AES_128_GCM_SHA256
        {0x00, 0x3D} TLS_RSA_WITH_AES_256_CBC_SHA256
        {0x00, 0x3C} TLS_RSA_WITH_AES_128_CBC_SHA256
        {0x00, 0x35} TLS_RSA_WITH_AES_256_CBC_SHA
        {0x00, 0x2F} TLS_RSA_WITH_AES_128_CBC_SHA
      compression_methods (len=1)
        No Compression (0x00)
      extensions, length = 1410
        extension_type=renegotiate(65281), length=1
            <EMPTY>
        extension_type=server_name(0), length=17
          0000 - 00 0f 00 00 0c 67 65 6c-62 6f 6f 72 75 2e 63   .....gelbooru.c
          000f - 6f 6d                                          om
        extension_type=ec_point_formats(11), length=4
          uncompressed (0)
          ansiX962_compressed_prime (1)
          ansiX962_compressed_char2 (2)
        extension_type=supported_groups(10), length=18
          X25519MLKEM768 (4588)
          ecdh_x25519 (29)
          secp256r1 (P-256) (23)
          ecdh_x448 (30)
          secp384r1 (P-384) (24)
          secp521r1 (P-521) (25)
          ffdhe2048 (256)
          ffdhe3072 (257)
        extension_type=session_ticket(35), length=0
        extension_type=encrypt_then_mac(22), length=0
        extension_type=extended_master_secret(23), length=0
        extension_type=signature_algorithms(13), length=54
          mldsa65 (0x0905)
          mldsa87 (0x0906)
          mldsa44 (0x0904)
          ecdsa_secp256r1_sha256 (0x0403)
          ecdsa_secp384r1_sha384 (0x0503)
          ecdsa_secp521r1_sha512 (0x0603)
          ed25519 (0x0807)
          ed448 (0x0808)
          ecdsa_brainpoolP256r1tls13_sha256 (0x081a)
          ecdsa_brainpoolP384r1tls13_sha384 (0x081b)
          ecdsa_brainpoolP512r1tls13_sha512 (0x081c)
          rsa_pss_pss_sha256 (0x0809)
          rsa_pss_pss_sha384 (0x080a)
          rsa_pss_pss_sha512 (0x080b)
          rsa_pss_rsae_sha256 (0x0804)
          rsa_pss_rsae_sha384 (0x0805)
          rsa_pss_rsae_sha512 (0x0806)
          rsa_pkcs1_sha256 (0x0401)
          rsa_pkcs1_sha384 (0x0501)
          rsa_pkcs1_sha512 (0x0601)
          ecdsa_sha224 (0x0303)
          rsa_pkcs1_sha224 (0x0301)
          dsa_sha224 (0x0302)
          dsa_sha256 (0x0402)
          dsa_sha384 (0x0502)
          dsa_sha512 (0x0602)
        extension_type=supported_versions(43), length=5
          TLS 1.3 (772)
          TLS 1.2 (771)
        extension_type=psk_key_exchange_modes(45), length=2
          psk_dhe_ke (1)
        extension_type=key_share(51), length=1258
            NamedGroup: X25519MLKEM768 (4588)
            key_exchange:  (len=1216): 177515FAA314C4FC0928F104F9512308A1110AA7AEC7EA1BD8AC56BE79A7C52A4B91046A0BD6509B37302E7C47B61085DCF42A0D024C00D16DFE080832F61174E4CBEA16A06760A5B4A34A7EE2787529BB61F9A2FCDB41C6417B6FC8B6C3B1815488BA2E23775BE822C99B091390C578651172351236C96904BB9018374007E83B737284893C989884B0A6A204210518AC00CC1BF01160D1830E9C15C176355AB83EBEF92B8BB3A8C5610902441075D234B42683D8BA96D2D770020A50AB916558800682430C2C987F16617EFB378D2C210CD13169BC25525204C064CB8BDE4CCA95C6B7003D6D74B3AA031A477338B0BB8665BC7B114D14B45250CCA3D4184D332895E3B0F7D7CBA7C8222A8A2556F354A4240CC536BF9FB617A5808DCC3ABDAD322ABAE664266CC950942D031300B33113FB8B8A3FD24C54170B232B69E9E421658116B49A37378CADC4327667CC3CC908A595F25D3381667B4AAA9C07B547211DB8368333EC4F2DE95365A87F1C3CC348D424B2375A27F1B3958A89D472884F017BFAE734821848A3030D5E4C8F96044169A54DED704BD33A423BC4A6CAF48AC272310C1756C2210C64B1A8BCC26EC9548BCCA86B1296AFAAC2CDCB24AE7597A8B2A78C84CB77669293922135E6D8BA02E96935E90994496964A7AFFE0A451AB3164CC9753AAB03D7136122A7AE9C225BD956C6E8E79854BB0C1D7546DBFC105B6C1BA85B57137A4CD3643E02836AE6858DC700BF4380508512299EB642F5B35AD8EAC2EED62CF0390443A0AF3B4565BFAA79D71500C88A9C915AB995744B21EA04EA4395E81A78EFB79ECD88060F728EF7049F7F710FE0C1189F90C506A5684EA62361B00D681A0B419C1FC6D7C37C780EACC79D9A7CAF84A93DEB91C340A1969C94AD96FAAADB26CF32E192A6E2854AA2AF6FC22D6FC25BFBE834E1537057463EED2C8D91B1C83DCB10EED7163103AABBD0B9209B0EDE61540CFCB8B372C1282B8B6565016926087697AD6B320DE6186D7146BA398A48D14C318F428C38070767A13DCE5601FF324B83A58779680FF967226877CECF889F69A72F6C4ACA1E375FADC9946A5896EC44882DC4ABC3363E3CEC602802930A093909325FFD76568687CF4ED2BE5548803D2852E4C31944C0293276A5D28344A3C96C7CA77D88630DCE645F139CB37DA851CD804BB1B07B2D01BFD8FC53219ACE8BF86FE1676BC2474EFE31CDEE2A67E2798D6F725ABBA37B938659A7808510D852261A600BE41BB2E0228AAB6E01866299D5229DAC499F864516D360A9315303B3A10F88C06D89CC04902690931540F5CD66D03F3B379B26820B8E0358EFD302F399941B536B02F23103A4875F5A29263A348B953B576960D07555F8E9AF727B704BEB45085C5F4BE4715773BAA099AE2BFBC3660C54D007531B3B7B616138B49756DA948A8BA0B844E283237ACD93B52C3AF9154C0826431A1247A18432060C58DA82A7435FA716BC4695CFED516688AACB3C742E9A4A8C471853A51021A58AA9A0103B149517176295F4298B2FFBB3AC1990ABB68455EC20694990D6A639034A9C905B32B022CE3A838FDE54059712C0CFD082DED15E5F797C1959C65769A5746B0CD42B7E61C142FB7C6061D09060ED52216D0F203137879009A6D4BDECAB6BBAA5E8397E2FE2C6BB170348B2E0DCA4F4DB0CA17925F806F905744B85D8884CD642662B4F
            NamedGroup: ecdh_x25519 (29)
            key_exchange:  (len=32): 42130E1BAC187E022584CBEC39DFB9D29042012B481C93E53DB41C1FD418AF42
        extension_type=compress_certificate(27), length=3
          zlib (1)

Received TLS Record
Header:
  Version = TLS 1.2 (0x303)
  Content Type = Handshake (22)
  Length = 84
    ServerHello, Length=80
      server_version=0x303 (TLS 1.2)
      Random:
        gmt_unix_time=0xAD29BA82
        random_bytes (len=28): A94E83016808749446B564226403E28A7254B366154E9E5908B30E8E
      session_id (len=0):
      cipher_suite {0xC0, 0x30} TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
      compression_method: No Compression (0x00)
      extensions, length = 40
        extension_type=renegotiate(65281), length=1
            <EMPTY>
        extension_type=server_name(0), length=0
        extension_type=ec_point_formats(11), length=4
          uncompressed (0)
          ansiX962_compressed_prime (1)
          ansiX962_compressed_char2 (2)
        extension_type=session_ticket(35), length=0
        extension_type=application_layer_protocol_negotiation(16), length=11
          http/1.1
        extension_type=extended_master_secret(23), length=0

Sent TLS Record
Header:
  Version = TLS 1.2 (0x303)
  Content Type = Alert (21)
  Length = 2
    Level=fatal(2), description=unsupported extension(110)

88260000:error:0A0000D9:SSL routines:tls_collect_extensions:unsolicited extension:../openssl-3.5.7/ssl/statem/extensions.c:634:
---
no peer certificate available
---
No client certificate CA names sent
Negotiated TLS1.3 group: <NULL>
---
SSL handshake has read 89 bytes and written 1559 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Protocol: TLSv1.3
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

1 reply

fixator10 Jul 23, 2026
Author

Потыкал конкретно виндовые стратегии на винде - все тоже самое

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OpenWRT и SSL_ERROR_RX_RECORD_TOO_LONG/ERR_SSL_PROTOCOL_ERROR #15847

Uh oh!

{{title}}

Uh oh!

Replies: 4 comments 3 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

OpenWRT и SSL_ERROR_RX_RECORD_TOO_LONG/ERR_SSL_PROTOCOL_ERROR #15847

Uh oh!

fixator10 Jul 8, 2026

Replies: 4 comments · 3 replies

Uh oh!

fixator10 Jul 8, 2026 Author

Uh oh!

HatabaSS Jul 17, 2026

Uh oh!

HatabaSS Jul 17, 2026

Uh oh!

SnAnVl Jul 17, 2026

Uh oh!

fixator10 Jul 17, 2026 Author

Uh oh!

fixator10 Jul 23, 2026 Author

Uh oh!

fixator10 Jul 23, 2026 Author

fixator10
Jul 8, 2026

Replies: 4 comments 3 replies

fixator10
Jul 8, 2026
Author

HatabaSS
Jul 17, 2026

SnAnVl
Jul 17, 2026

fixator10 Jul 17, 2026
Author

fixator10
Jul 23, 2026
Author

fixator10 Jul 23, 2026
Author