Post deleted by jchamier

In reply to a post by Appy:

It's up and running, but it's an nntp service not a website

Strange to run a secure NNTP through 443, normally services use 563, or just overlay TLS on 119.

Having used an ISP for years that used transparent proxies (and then gave up), I know that anything over 443 that isn't HTTP protocol can inadvertently get blocked.

If you are using Smarty, try a Three SIM. If you are on Three, then ditch them and try Vodafone, O2 or EE instead.

They only support nntp over 443 for "compatibility" for when your ISP blocks 563. However, it gives us a unique opportunity to test 443 vs 563.

In reply to a post by Appy:

They only support nntp over 443 for "compatibility" for when your ISP blocks 563. However, it gives us a unique opportunity to test 443 vs 563.

Its not necessarily a good test, as transparent proxies are common in corporates.

I've run OpenVPN in HTTPS mode through a transparent proxy before now

Deffo no corporate proxy here

I have deleted my previous post, as it was pointed out to me by a good friend that my recommendation suggested I was ignorant that nntp was a protocol just like the more ones that I'm familiar with.

I did realise that but didn't think that through deeply enough. In particular, I was ignorant of its purpose and implementation.

My apologies.

However I do recall many years ago some ISPs blocking usenet feeds. AIUI for the same reason as parental controls were introduced.

Might it be possible that when they inexplicably set parental filters on your connection they also set up a similar block on nntp access?

In reply to a post by RobertoS:

However I do recall many years ago some ISPs blocking usenet feeds. AIUI for the same reason as parental controls were introduced.

Many ISPs shut down their own usenet service, but NNTP is not only used for usenet. There are plenty of private NNTP servers used for discussion. Many ISPs stopped supporting usenet as the binary groups were mostly being used for piracy and terabytes of data an hour were being posted.

Might it be possible that when they inexplicably set parental filters on your connection they also set up a similar block on nntp access?

They've not blocked NNTP, they're stopped NNTP over the secure web port (443) working. I gather NNTP works over the default unencrypted port 119.

You're mixing up NNTP with a test the poster is trying to determine if the ISP is using a transparent proxy that is faulty (or overloaded)

You're mixing up NNTP with a test the poster is trying to determine if the ISP is using a transparent proxy that is faulty (or overloaded)

Yes exactly. Forget NNTP - it works fine. I'm simply opening a secure connection on port 563 & port 443 to the same server running the same software. Port 563 succeeds every time and port 443 fails sometimes, hence my deduction that something within Three is interfering with port 443 traffic. If it were just this one server, then I'd assume there was a problem with this one server but it seems to affect any secure site I try.

In reply to a post by Appy:

Yes exactly. Forget NNTP - it works fine. I'm simply opening a secure connection on port 563 & port 443 to the same server running the same software. Port 563 succeeds every time and port 443 fails sometimes, hence my deduction that something within Three is interfering with port 443 traffic. If it were just this one server, then I'd assume there was a problem with this one server but it seems to affect any secure site I try.

In theory if you do that to an HTTPS page (e.g. https://www.google.com) you should get an alert from the browser, as you can't recreate the certificate from the original page. Essentially a "Man-in-the-middle" attack. Corporates can do this as they manage the computer, but ISP's normally can't, or they get lots of helpdesk tickets.

They're not actually "accepting" the connection and pretending to be the far end because, as you say, that would be very visible. I think all they're doing is inspecting the IP address that you're connecting to and also the "server name indication" in the SSL Hello request. I guess this service is overloaded which is why we're seeing problems.

I've asked Three to turn off the parental controls but this service is probably still inspecting my traffic. There'll still be some sites that I'm not allowed to connect to. https://en.wikipedia.org/wiki/Web_blocking_in_the_Un...