[pfx] Re: Postfix site via HTTPS

Eugene R via Postfix-users <[email protected]>
Newsgroups gmane.mail.postfix.user
Message-ID <[email protected]>
Hello,

I am not sure this is roscomnadzor's fault because it happens from 
different networks in different countries. And Postfix is the only site 
where it happens, among the ones I accessed in recent weeks.

 From tcpdump, looks like no reply to TLS Client Hello is received

> No.    Time    Source    Destination Protocol    Length    Info    
> srcport    dstport
> 22    20.373087    5.x.x.x    95.216.145.1    TCP    74    30569 → 443 
> [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=64 SACK_PERM TSval=1130704237 
> TSecr=0    30569    443
> 23    20.428994    95.216.145.1    5.x.x.x    TCP    74    443 → 30569 
> [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1460 SACK_PERM 
> TSval=2990867572 TSecr=1130704237 WS=512    443    30569
> 24    20.429058    5.x.x.x    95.216.145.1    TCP    66    30569 → 443 
> [ACK] Seq=1 Ack=1 Win=65728 Len=0 TSval=1130704295 TSecr=2990867572    
> 30569    443
> 25    20.432861    5.x.x.x    95.216.145.1    TLSv1    583 Client 
> Hello (SNI=www.postfix.org)    30569    443
> 26    20.835416    5.x.x.x    95.216.145.1    TCP    583    [TCP 
> Retransmission] 30569 → 443 [PSH, ACK] Seq=1 Ack=1 Win=65728 Len=517 
> TSval=1130704697 TSecr=2990867572    30569    443
> 27    21.397558    5.x.x.x    95.216.145.1    TCP    583    [TCP 
> Retransmission] 30569 → 443 [PSH, ACK] Seq=1 Ack=1 Win=65728 Len=517 
> TSval=1130705257 TSecr=2990867572    30569    443
> 28    22.311764    5.x.x.x    95.216.145.1    TCP    583    [TCP 
> Retransmission] 30569 → 443 [PSH, ACK] Seq=1 Ack=1 Win=65728 Len=517 
> TSval=1130706177 TSecr=2990867572    30569    443
> 29    23.951837    5.x.x.x    95.216.145.1    TCP    583    [TCP 
> Retransmission] 30569 → 443 [PSH, ACK] Seq=1 Ack=1 Win=65728 Len=517 
> TSval=1130707817 TSecr=2990867572    30569    443
> 30    27.031803    5.x.x.x    95.216.145.1    TCP    583    [TCP 
> Retransmission] 30569 → 443 [PSH, ACK] Seq=1 Ack=1 Win=65728 Len=517 
> TSval=1130710897 TSecr=2990867572    30569    443
> 31    32.991729    5.x.x.x    95.216.145.1    TCP    583    [TCP 
> Retransmission] 30569 → 443 [PSH, ACK] Seq=1 Ack=1 Win=65728 Len=517 
> TSval=1130716857 TSecr=2990867572    30569    443
> 32    44.711680    5.x.x.x    95.216.145.1    TCP    583    [TCP 
> Retransmission] 30569 → 443 [PSH, ACK] Seq=1 Ack=1 Win=65728 Len=517 
> TSval=1130728577 TSecr=2990867572    30569    443
> 33    67.951636    5.x.x.x    95.216.145.1    TCP    583    [TCP 
> Retransmission] 30569 → 443 [PSH, ACK] Seq=1 Ack=1 Win=65728 Len=517 
> TSval=1130751817 TSecr=2990867572    30569    443
> 34    80.493489    95.216.145.1    5.x.x.x    TCP    66    443 → 30569 
> [FIN, ACK] Seq=1 Ack=1 Win=65536 Len=0 TSval=2990927636 
> TSecr=1130704295    443    30569
> 35    80.493539    5.x.x.x    95.216.145.1    TCP    66    30569 → 443 
> [ACK] Seq=518 Ack=2 Win=65728 Len=0 TSval=1130764357 
> TSecr=2990927636    30569    443
> 36    80.494532    5.x.x.x    95.216.145.1    TLSv1    73 Alert 
> (Level: Fatal, Description: Decode Error)    30569    443

For comparison, this is Telegram (t.me) accessed from the same system

> No.    Time    Source    Destination Protocol    Length    Info    
> srcport    dstport
> 1    0.000000    5.x.x.x    149.154.167.99    TCP    74    44337 → 443 
> [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=64 SACK_PERM TSval=3555323993 
> TSecr=0    44337    443
> 2    0.001345    149.154.167.99    5.x.x.x    TCP    74    443 → 44337 
> [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1240 SACK_PERM 
> TSval=593343437 TSecr=3555323993 WS=1024    443    44337
> 3    0.001625    5.x.x.x    149.154.167.99    TCP    66    44337 → 443 
> [ACK] Seq=1 Ack=1 Win=65728 Len=0 TSval=3555323993 TSecr=593343437    
> 44337    443
> 4    0.005288    5.x.x.x    149.154.167.99    TLSv1.3    583 Client 
> Hello (SNI=t.me)    44337    443
> 5    0.006236    149.154.167.99    5.x.x.x    TCP    66    443 → 44337 
> [ACK] Seq=1 Ack=518 Win=67584 Len=0 TSval=593343442 
> TSecr=3555323993    443    44337
> 6    0.006643    149.154.167.99    5.x.x.x    TLSv1.3    1294 Server 
> Hello, Change Cipher Spec, Application Data    443 44337
> 7    0.006651    149.154.167.99    5.x.x.x    TCP    1294    443 → 
> 44337 [ACK] Seq=1229 Ack=518 Win=67584 Len=1228 TSval=593343443 
> TSecr=3555323993 [TCP PDU reassembled in 10] 443    44337
> 8    0.006659    5.x.x.x    149.154.167.99    TCP    66    44337 → 443 
> [ACK] Seq=518 Ack=2457 Win=63296 Len=0 TSval=3555323993 
> TSecr=593343443    44337    443
> 9    0.006666    149.154.167.99    5.x.x.x    TCP    1294    443 → 
> 44337 [ACK] Seq=2457 Ack=518 Win=67584 Len=1228 TSval=593343443 
> TSecr=3555323993 [TCP PDU reassembled in 10] 443    44337
> 10    0.006685    149.154.167.99    5.x.x.x    TLSv1.3    478 
> Application Data    443    44337

Eugene

On 20.04.2026 14:10, Michael Tokarev via Postfix-users wrote:
> On 19.04.2026 16:00, Eugene R via Postfix-users wrote:
>> Hello,
>>
>> Me and some other people have problems with accessing www.postfix.org 
>> in normal (HTTPS) way. Non-HTTPS version http://www.postfix.org works 
>> fine while https fails to connect and timeouts.
>>
>> What might be wrong?
>
>
> This is roskomnadzor's censorship and ruining the internet in a single
> country.  They block certain https patterns in a hope to block telegram
> and vpns which tries to act "like" regular https, and they block certain
> protocols for certain addresses completely.
>
> It's rather interesting you haven't faced this earlier.  A lot of places
> doesn't work from ru netspace even if the resource itself isn't/shouldn't
> be blocked directly.  For example, wget https doesn't work in many places
> because it "looks like" telegram mtproxy (or, rather, it does not look
> like a regular well-known "whitelisted" browser), I can't git push to
> gitlab (for the same reason), etc.
>
> Thanks,
>
> /mjt
>
> _______________________________________________
> Postfix-users mailing list -- [email protected]
> To unsubscribe send an email to [email protected]
_______________________________________________
Postfix-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.