中国河南省地区的运营商似乎对IPV6没有那么强的审查力度/The operators in Henan Province, China, seem to have less stringent censorship regarding IPV6.

[ThEWiZaRd0fBsoD]

如题，我在中国河南省（使用的ISP：中国联通）居住。

当我在IPV6网络上连接obfs4 IAT-MODE=0的网桥时，这些网桥全部都可以正常连接。但反之切换到IPV4会立即失败。

类似的，我也直接使用Shadowsocks Stream加密，也不会遭到封锁。

我想知道这是否只是某个省份的个例，还是说在其他省份也可以复现？

As mentioned, I live in Henan Province, China (ISP used: China Unicom).

When I connect to obfs4 bridges with IAT-MODE=0 on an IPV6 network, all these bridges connect normally. However, switching to IPV4 fails immediately.

Similarly, I can also use Shadowsocks Stream encryption directly without being blocked.

I would like to know if this is just a case in a specific province or if it can be replicated in other provinces as well.

[wkrp]

Are you using the same bridge line (网桥地址) on both networks? The bridge line contains either an IPv4 or an IPv6 address. If you use an IPv4 bridge line on a network that supports IPv6, you will still connect to the bridge using IPv4. So it may not be IPv6 support, but some other characteristic of the network that makes the bridge accessible.

Maybe one of the networks is a wired network and the other is a mobile network? That can make a difference.

If you have configured multiple bridge lines, a mix of IPv4 and IPv6, then it is possible that the IPv6 bridge lines start working when you are on a network that supports IPv6.

我想知道这是否只是某个省份的个例，还是说在其他省份也可以复现？
I would like to know if this is just a case in a specific province or if it can be replicated in other provinces as well.

There are reports of different levels of blocking in Henan province. Usually, they say that Henan is more restrictive.

• TLS record fragmentation, DPYProxy #308 (comment)
  河南GFW能阻断servername位于第一个clienthello分片的TLS握手
  Henan GFW can block servername located in the first clienthello fragment of the TLS handshake
• The blocking of 1.1.1.1 in China, starting from 2023-10-01 #295 (comment)
  My location is Henan , but the RST I received is not from Henan GFW's censorship equipment.
• RST injection of 1.1.1.1:443 in China, 2023-09-05 to 2023-09-20 #285 (comment)
  比如，@5e2t 发现他那里（河南）访问某些域名会收到 4 个 RST，其中一个 RST 与众不同：河南新上的SNI/HOST黑名单墙 XTLS/Xray-core#2426 (comment)
  For example, @5e2t found that he was getting 4 RSTs for accessing certain domains there (Henan), one of which was different: 河南新上的SNI/HOST黑名单墙 XTLS/Xray-core#2426 (comment)

[ThEWiZaRd0fBsoD]

Are you using the same bridge line (网桥地址) on both networks? The bridge line contains either an IPv4 or an IPv6 address. If you use an IPv4 bridge line on a network that supports IPv6, you will still connect to the bridge using IPv4. So it may not be IPv6 support, but some other characteristic of the network that makes the bridge accessible.

Maybe one of the networks is a wired network and the other is a mobile network? That can make a difference.

If you have configured multiple bridge lines, a mix of IPv4 and IPv6, then it is possible that the IPv6 bridge lines start working when you are on a network that supports IPv6.

不，我仅仅使用了一个IPV6地址的obfs4网桥，以下是Tor日志。

No, I only used an obfs4 bridge with an IPV6 address. Below are the Tor logs.

2024-11-08 00:48:34.080 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
2024-11-08 00:48:34.095 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
2024-11-08 00:48:54.986 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
2024-11-08 00:48:54.986 [NOTICE] Switching to guard context "default" (was using "bridges")
2024-11-08 00:48:59.830 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
2024-11-08 00:48:59.830 [NOTICE] Switching to guard context "bridges" (was using "default")
2024-11-08 00:49:00.312 [NOTICE] Opening Socks listener on 127.0.0.1:9150
2024-11-08 00:49:00.312 [NOTICE] Opened Socks listener connection (ready) on 127.0.0.1:9150
2024-11-08 00:49:00.312 [NOTICE] Application request when we haven't used client functionality lately. Optimistically trying known bridges again.
2024-11-08 00:49:01.502 [NOTICE] Bridge 'Edited' has both an IPv4 and an IPv6 address.  Will prefer using its IPv6 address ([Edited]:51880) based on the configured Bridge address.
2024-11-08 00:49:01.502 [NOTICE] Bootstrapped 1% (conn_pt): Connecting to pluggable transport
2024-11-08 00:49:01.503 [WARN] Only one bridge (transport: 'obfs4') is configured. You should have at least two for conflux, for any transport that is not 'snowflake'.
2024-11-08 00:49:01.503 [NOTICE] Bootstrapped 2% (conn_done_pt): Connected to pluggable transport
2024-11-08 00:49:02.462 [NOTICE] Bootstrapped 10% (conn_done): Connected to a relay
2024-11-08 00:49:02.837 [NOTICE] Bootstrapped 14% (handshake): Handshaking with a relay
2024-11-08 00:49:03.211 [NOTICE] Bootstrapped 15% (handshake_done): Handshake with a relay done
2024-11-08 00:49:03.211 [NOTICE] Bootstrapped 75% (enough_dirinfo): Loaded enough directory info to build circuits
2024-11-08 00:49:03.213 [NOTICE] Bootstrapped 90% (ap_handshake_done): Handshake finished with a relay to build circuits
2024-11-08 00:49:03.214 [NOTICE] Bootstrapped 95% (circuit_create): Establishing a Tor circuit
2024-11-08 00:49:04.250 [NOTICE] Bridge 'Edited' has both an IPv4 and an IPv6 address.  Will prefer using its IPv6 address ([Edited]:51880) based on the configured Bridge address.
2024-11-08 00:49:04.251 [NOTICE] new bridge descriptor 'Edited' (fresh): $Edited~BrookRameev2 [Edited] at Edited and [Edited]
2024-11-08 00:49:05.292 [NOTICE] Bootstrapped 100% (done): Done

所有tor中继的IPv6地址都没有被GFW封禁。
河南的省墙不以网络层的IP为阻断依据。

None of the IPv6 addresses of tor relays are blocked by the GFW.
The Henan provincial firewall does not block based on network layer IPs.

一个tor中继出现在 tor中继列表一个小时以后就会被GFW封禁IPv4地址，但是tor中继的IPv6地址无论过去多久都不会被GFW封禁。

An IPv4 address of a tor relay will be blocked by the GFW after an hour, but the IPv6 address of the Tor relay will never be blocked by the GFW, no matter how long it has been.

[ThEWiZaRd0fBsoD]

所有tor中继的IPv6地址都没有被GFW封禁。 河南的省墙不以网络层的IP为阻断依据。

很不幸的，我在江苏时，在江苏省地区如果用IPV6 obfs4网桥，会立即被封锁（无论哪个运营商）。

我认为这可能是河南省的流量分析设备没有得到更新的缘故，但我向我的同学（他在河南省地区的运营商工作）询问时，他只是含糊不清地告诉我“我们在中国移动的内部会议上把这个叫做‘防洪’“。

而且我收到了很有趣的报告：

Unfortunately, when I was in Jiangsu, if I used the IPV6 obfs4 bridge in the Jiangsu Province area, I would be blocked immediately (regardless of which operator).

I think this may be because the traffic analysis equipment in Henan Province has not been updated, but when I asked my classmate (who works for an operator in the Henan Province area), he just vaguely told me, “We call this ‘flood control’ at China Mobile's internal meetings.”

And I received an interesting report:

It's really not strong, I moved my home broadband to IPv6, and I can even access the cdn through port 80
The cdn can be switched from v6 to v4

河南的省墙也不管全随机数流量。

Henan's provincial wall also does not restrict fully random traffic.

[ThEWiZaRd0fBsoD]

河南的省墙也不管全随机数流量。

Henan's provincial wall also does not restrict fully random traffic.

如果在IPV4下，这不成立（我使用Shadowsocks AEAD-2022和obfs4 iat-mode=0、1、2进行了一次测试，以Linode在一天之内给我发了最少四封关于实例被删除/开启的邮件为代价）。

我在这里的测试方法是：连接到某种反审查隧道后，立即传输最少30GB数据来试探河南省运营商的审查设备（的反应）。

如果你有兴趣我可以在这里贴一份录像，我对河南省的这些行为感到诧异（他们为什么会忽略这么大的漏洞？）。

This does not hold true under IPV4 (I tested with Shadowsocks AEAD-2022 and obfs4 iat-mode=0, 1, 2, at the cost of Linode sending me at least four emails a day about instances being deleted/started).

My test method here is to immediately transfer at least 30GB of data after connecting to a certain anti-censorship tunnel to test the (reaction of) the Henan provincial operator's censorship equipment.

If you are interested, I can post a video here. I was surprised by these actions by Henan Province (why would they ignore such a big loophole?).

河南的省墙也不管全随机数流量。

如果在IPV4下，这不成立（我使用Shadowsocks AEAD-2022和obfs4 iat-mode=0、1、2进行了一次测试，以Linode在一天之内给我发了最少四封关于实例被删除/开启的邮件为代价）。

我在这里的测试方法是：连接到某种反审查隧道后，立即传输最少30GB数据来试探河南省运营商的审查设备（的反应）。

如果你有兴趣我可以在这里贴一份录像，我对河南省的这些行为感到诧异（他们为什么会忽略这么大的漏洞？）。

有些工作是出口GFW的事情，省墙不需要完成所有工作。比如封禁IP，目前没有看到省墙有物理意义上封禁IP的能力(空路由)

Some work is the egress GFW's job, and the provincial wall does not need to do all the work. For example, IP blocking: currently, I don't see the provincial wall having the ability to block IPs in the physical sense (null routing).

[ThEWiZaRd0fBsoD]

河南的省墙也不管全随机数流量。

如果在IPV4下，这不成立（我使用Shadowsocks AEAD-2022和obfs4 iat-mode=0、1、2进行了一次测试，以Linode在一天之内给我发了最少四封关于实例被删除/开启的邮件为代价）。
我在这里的测试方法是：连接到某种反审查隧道后，立即传输最少30GB数据来试探河南省运营商的审查设备（的反应）。
如果你有兴趣我可以在这里贴一份录像，我对河南省的这些行为感到诧异（他们为什么会忽略这么大的漏洞？）。

有些工作是出口GFW的事情，省墙不需要完成所有工作。比如封禁IP，目前没有看到省墙有物理意义上封禁IP的能力(空路由)

你说得对，我觉得可能我过于在意我家用的ISP的了（）

（如果你觉得我说话方式很奇怪，呃，我患有自闭症且因此拿到了精神残疾证书，请见谅）

You're right, I think I might be too concerned about my home ISP. ( )

(If you think I sound strange, well, I have autism and a mental disability certificate, so please forgive me.)

河南的省墙也不管全随机数流量。

如果在IPV4下，这不成立（我使用Shadowsocks AEAD-2022和obfs4 iat-mode=0、1、2进行了一次测试，以Linode在一天之内给我发了最少四封关于实例被删除/开启的邮件为代价）。
我在这里的测试方法是：连接到某种反审查隧道后，立即传输最少30GB数据来试探河南省运营商的审查设备（的反应）。
如果你有兴趣我可以在这里贴一份录像，我对河南省的这些行为感到诧异（他们为什么会忽略这么大的漏洞？）。

有些工作是出口GFW的事情，省墙不需要完成所有工作。比如封禁IP，目前没有看到省墙有物理意义上封禁IP的能力(空路由)

你说得对，我觉得可能我过于在意我家用的ISP的了（）

（如果你觉得我说话方式很奇怪，呃，我患有自闭症且因此拿到了精神残疾证书，请见谅）

啊 没事，我也是个ADHD(

Ah, that's okay, I'm also ADHD. (

[ThEWiZaRd0fBsoD]

啊 没事，我也是个ADHD(

太好了，病友局（ASD+ADHD）

回归话题：类似的，如果在IPV6下用Shadowsocks AEAD-2022和obfs4 iat模式任意，甚至直接用Stream加密，那甚至都不会被运营商干扰（河南安阳-中国联通）。

然而，我在江苏省（我男朋友家里，运营商：江苏电信、江苏移动、江苏联通）就无法使用这个操作。有趣的事情：在测试obfs4 iat-mode=2时，我男朋友家的宽带突然间无法连通任何非中国大陆IP，就连ping都会全部丢包。

所以我对河南省的运营商审查诧异在于：他们是因为没有资金更换设备、还是说他们连熟悉IPV6的网络工程师都没有，才导致这些行为的吗？

因为类似的情况我真的无法在河南省以外的省份复现，其他地区的运营商IPV6审查强度都比河南省高太多。

Great, fellow patient (ASD+ADHD)

Back to the topic: Similarly, if you use Shadowsocks AEAD-2022 and obfs4 iat mode at will under IPV6, or even directly use Stream encryption, then it will not even be interfered with by the operator (Anyang, Henan Province - China Unicom).

However, I was unable to use this configuration in Jiangsu Province (my boyfriend's home, operators: Jiangsu Telecom, Jiangsu Mobile, Jiangsu Unicom). An interesting thing: when I tested obfs4 iat-mode=2, my boyfriend's home broadband suddenly became unable to connect to any non–Chinese mainland IPs, and even pings would all drop packets.

So I'm surprised by the censorship of operators in Henan Province: is it because they don't have the funds to replace equipment, or is it because they don't even have network engineers familiar with IPV6 that leads to this behavior?

Because I really can't reproduce similar situations in provinces other than Henan Province, and the intensity of IPV6 censorship by operators in other regions is much higher than that in Henan Province.

实际上tor的设计目前不能让IPv6单栈运行，否则如果 可以 以IPv6单栈连接tor守卫中继的话，那么都可以不要obfs网桥都能正常连入tor网络了。

至于现在能用IPv6连接obfs网桥，大概是obfs网桥目前可以用单栈IPv6来连接，而 tor守卫中继（入口中继）铁定是不能用单栈IPv6去连接的。

In fact, the design of the Tor network currently does not allow it to run with an IPv6-only stack. Otherwise, if it were possible to connect to the Tor guard relay with an IPv6-only stack, then it would be possible to connect to the Tor network without an obfs bridge.

As for being able to connect to an obfs bridge using IPv6, it is probably because the obfs bridge can currently be connected using an IPv6-only stack, while the Tor guard relay (entry relay) definitely cannot be connected using an IPv6-only stack.

啊 没事，我也是个ADHD(

太好了，病友局（ASD+ADHD）

回归话题：类似的，如果在IPV6下用Shadowsocks AEAD-2022和obfs4 iat模式任意，甚至直接用Stream加密，那甚至都不会被运营商干扰（河南安阳-中国联通）。

然而，我在江苏省（我男朋友家里，运营商：江苏电信、江苏移动、江苏联通）就无法使用这个操作。

所以我对河南省的运营商审查诧异在于：他们是因为没有资金更换设备、还是说他们连熟悉IPV6的网络工程师都没有，才导致这些行为的吗？

因为类似的情况我真的无法在河南省以外的省份复现，其他地区的运营商IPV6审查强度都比河南省高太多。

所以江苏省的省墙应当是在干扰/审查/阻断 全随机数流量。但是我在河南，完全不了解江苏的情况，因此我的结论是根据你说的事实进行的猜测。

Therefore, the provincial wall of Jiangsu Province should be interfering with/censoring/blocking fully random traffic. However, I am in Henan and have no knowledge of the situation in Jiangsu, so my conclusion is a guess based on the facts you have stated.

啊 没事，我也是个ADHD(

太好了，病友局（ASD+ADHD）

回归话题：类似的，如果在IPV6下用Shadowsocks AEAD-2022和obfs4 iat模式任意，甚至直接用Stream加密，那甚至都不会被运营商干扰（河南安阳-中国联通）。

然而，我在江苏省（我男朋友家里，运营商：江苏电信、江苏移动、江苏联通）就无法使用这个操作。有趣的事情：在测试obfs4 iat-mode=2时，我男朋友家的宽带突然间无法连通任何非中国大陆IP，就连ping都会全部丢包。

所以我对河南省的运营商审查诧异在于：他们是因为没有资金更换设备、还是说他们连熟悉IPV6的网络工程师都没有，才导致这些行为的吗？

因为类似的情况我真的无法在河南省以外的省份复现，其他地区的运营商IPV6审查强度都比河南省高太多。

省墙应当主要审查的是应用层内容，网络层是v4还是v6并不重要。
河南省墙在阻断SNI/HOST时对v4 v6流量一视同仁。
至于那些v4会被阻断，但v6不会被阻断的流量，是出口GFW的行为。

The provincial firewall should mainly review the application layer content, and it does not matter whether the network layer is v4 or v6.
The Henan provincial firewall treats v4 and v6 traffic equally when blocking SNI/HOST.
As for the traffic that will be blocked for v4 but not for v6, it is the responsibility of the egress GFW.