[pfx] Re: Postfix site via HTTPS
Eugene R via Postfix-users <[email protected]>
| Newsgroups | gmane.mail.postfix.user |
|---|---|
| Message-ID | <[email protected]> |
Hello, I am not sure this is roscomnadzor's fault because it happens from different networks in different countries. And Postfix is the only site where it happens, among the ones I accessed in recent weeks. From tcpdump, looks like no reply to TLS Client Hello is received > No. Time Source Destination Protocol Length Info > srcport dstport > 22 20.373087 5.x.x.x 95.216.145.1 TCP 74 30569 → 443 > [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=64 SACK_PERM TSval=1130704237 > TSecr=0 30569 443 > 23 20.428994 95.216.145.1 5.x.x.x TCP 74 443 → 30569 > [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1460 SACK_PERM > TSval=2990867572 TSecr=1130704237 WS=512 443 30569 > 24 20.429058 5.x.x.x 95.216.145.1 TCP 66 30569 → 443 > [ACK] Seq=1 Ack=1 Win=65728 Len=0 TSval=1130704295 TSecr=2990867572 > 30569 443 > 25 20.432861 5.x.x.x 95.216.145.1 TLSv1 583 Client > Hello (SNI=www.postfix.org) 30569 443 > 26 20.835416 5.x.x.x 95.216.145.1 TCP 583 [TCP > Retransmission] 30569 → 443 [PSH, ACK] Seq=1 Ack=1 Win=65728 Len=517 > TSval=1130704697 TSecr=2990867572 30569 443 > 27 21.397558 5.x.x.x 95.216.145.1 TCP 583 [TCP > Retransmission] 30569 → 443 [PSH, ACK] Seq=1 Ack=1 Win=65728 Len=517 > TSval=1130705257 TSecr=2990867572 30569 443 > 28 22.311764 5.x.x.x 95.216.145.1 TCP 583 [TCP > Retransmission] 30569 → 443 [PSH, ACK] Seq=1 Ack=1 Win=65728 Len=517 > TSval=1130706177 TSecr=2990867572 30569 443 > 29 23.951837 5.x.x.x 95.216.145.1 TCP 583 [TCP > Retransmission] 30569 → 443 [PSH, ACK] Seq=1 Ack=1 Win=65728 Len=517 > TSval=1130707817 TSecr=2990867572 30569 443 > 30 27.031803 5.x.x.x 95.216.145.1 TCP 583 [TCP > Retransmission] 30569 → 443 [PSH, ACK] Seq=1 Ack=1 Win=65728 Len=517 > TSval=1130710897 TSecr=2990867572 30569 443 > 31 32.991729 5.x.x.x 95.216.145.1 TCP 583 [TCP > Retransmission] 30569 → 443 [PSH, ACK] Seq=1 Ack=1 Win=65728 Len=517 > TSval=1130716857 TSecr=2990867572 30569 443 > 32 44.711680 5.x.x.x 95.216.145.1 TCP 583 [TCP > Retransmission] 30569 → 443 [PSH, ACK] Seq=1 Ack=1 Win=65728 Len=517 > TSval=1130728577 TSecr=2990867572 30569 443 > 33 67.951636 5.x.x.x 95.216.145.1 TCP 583 [TCP > Retransmission] 30569 → 443 [PSH, ACK] Seq=1 Ack=1 Win=65728 Len=517 > TSval=1130751817 TSecr=2990867572 30569 443 > 34 80.493489 95.216.145.1 5.x.x.x TCP 66 443 → 30569 > [FIN, ACK] Seq=1 Ack=1 Win=65536 Len=0 TSval=2990927636 > TSecr=1130704295 443 30569 > 35 80.493539 5.x.x.x 95.216.145.1 TCP 66 30569 → 443 > [ACK] Seq=518 Ack=2 Win=65728 Len=0 TSval=1130764357 > TSecr=2990927636 30569 443 > 36 80.494532 5.x.x.x 95.216.145.1 TLSv1 73 Alert > (Level: Fatal, Description: Decode Error) 30569 443 For comparison, this is Telegram (t.me) accessed from the same system > No. Time Source Destination Protocol Length Info > srcport dstport > 1 0.000000 5.x.x.x 149.154.167.99 TCP 74 44337 → 443 > [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=64 SACK_PERM TSval=3555323993 > TSecr=0 44337 443 > 2 0.001345 149.154.167.99 5.x.x.x TCP 74 443 → 44337 > [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1240 SACK_PERM > TSval=593343437 TSecr=3555323993 WS=1024 443 44337 > 3 0.001625 5.x.x.x 149.154.167.99 TCP 66 44337 → 443 > [ACK] Seq=1 Ack=1 Win=65728 Len=0 TSval=3555323993 TSecr=593343437 > 44337 443 > 4 0.005288 5.x.x.x 149.154.167.99 TLSv1.3 583 Client > Hello (SNI=t.me) 44337 443 > 5 0.006236 149.154.167.99 5.x.x.x TCP 66 443 → 44337 > [ACK] Seq=1 Ack=518 Win=67584 Len=0 TSval=593343442 > TSecr=3555323993 443 44337 > 6 0.006643 149.154.167.99 5.x.x.x TLSv1.3 1294 Server > Hello, Change Cipher Spec, Application Data 443 44337 > 7 0.006651 149.154.167.99 5.x.x.x TCP 1294 443 → > 44337 [ACK] Seq=1229 Ack=518 Win=67584 Len=1228 TSval=593343443 > TSecr=3555323993 [TCP PDU reassembled in 10] 443 44337 > 8 0.006659 5.x.x.x 149.154.167.99 TCP 66 44337 → 443 > [ACK] Seq=518 Ack=2457 Win=63296 Len=0 TSval=3555323993 > TSecr=593343443 44337 443 > 9 0.006666 149.154.167.99 5.x.x.x TCP 1294 443 → > 44337 [ACK] Seq=2457 Ack=518 Win=67584 Len=1228 TSval=593343443 > TSecr=3555323993 [TCP PDU reassembled in 10] 443 44337 > 10 0.006685 149.154.167.99 5.x.x.x TLSv1.3 478 > Application Data 443 44337 Eugene On 20.04.2026 14:10, Michael Tokarev via Postfix-users wrote: > On 19.04.2026 16:00, Eugene R via Postfix-users wrote: >> Hello, >> >> Me and some other people have problems with accessing www.postfix.org >> in normal (HTTPS) way. Non-HTTPS version http://www.postfix.org works >> fine while https fails to connect and timeouts. >> >> What might be wrong? > > > This is roskomnadzor's censorship and ruining the internet in a single > country. They block certain https patterns in a hope to block telegram > and vpns which tries to act "like" regular https, and they block certain > protocols for certain addresses completely. > > It's rather interesting you haven't faced this earlier. A lot of places > doesn't work from ru netspace even if the resource itself isn't/shouldn't > be blocked directly. For example, wget https doesn't work in many places > because it "looks like" telegram mtproxy (or, rather, it does not look > like a regular well-known "whitelisted" browser), I can't git push to > gitlab (for the same reason), etc. > > Thanks, > > /mjt > > _______________________________________________ > Postfix-users mailing list -- [email protected] > To unsubscribe send an email to [email protected] _______________________________________________ Postfix-users mailing list -- [email protected] To unsubscribe send an email to [email protected]