Topic
sing-box
LxBox Evolves from VPN Client to Comprehensive Network Traffic Management Ecosystem
Privacy & Surveillance
Six Months After tun0 Leak: Which Android VPN Clients Fixed Server Address Exposure and Which Ignored It
Vulnerabilities & Exploits
sing-box Fork Expands from Desktop VPN Launcher to Android and Router Deployments
OtherConfiguration Drift Silently Breaks Multi-Hop Chains in sing-box Reality Fleet
A post-mortem analysis of a censorship circumvention network using sing-box and Reality revealed that four out of seven nodes were unreachable due to outdated allowlists, even though all monitoring reported green status. The fleet consisted of 14 endpoints across seven machines and four providers, with traffic routed in two hops where entry nodes only knew client identities and exit nodes only knew destinations. White-list rules on entry nodes permitted only five addresses instead of all required relays, causing urltest to silently discard most chains without logging failures. Canary checks, external probes, and the relay-lockdown.sh script all passed because none compared the allowlist against the full signed configuration. Two private paid nodes lacked any route section entirely, exposing them to potential abuse. The issue stemmed from configuration drift over time, with no single person maintaining an overview of the entire system. Automated fixes were implemented with safeguards to prevent fleet-wide lockouts.
Free VPNs Fail Within Days as Russian Filters Detect Tunnels Without Decrypting Traffic
Free VPN services promoted in Telegram now stop working after just a few days, with Instagram Reels freezing, YouTube stalling in endless loading, and Google Gemini returning 403 errors. Modern Russian content filtering systems have advanced beyond simple IP blocking and can identify proxy tunnels through indirect traffic characteristics such as packet sizes, inter-packet intervals, and TLS handshake structures. A common failure pattern involves connections succeeding initially before data transfer abruptly slows or drops after roughly 16 KB, a behavior linked to deep packet inspection recognizing proxy patterns. Users and developers counter these detections with techniques including packet fragmentation, reduced TCP segment sizes, and tools like zapret to desynchronize analyzers while preserving normal server-side flow. Services such as sing-box employ uTLS to better mimic legitimate browser TLS fingerprints, while ShadowTLS v3 and padding methods help mask connections as ordinary HTTPS sessions to allowed resources. Recommended working options include AmneziaVPN, Cloudflare WARP, Red Shield VPN, and self-hosted setups on Xray or sing-box, though some claims around hynet.cloud lack independent verification.
Why Simple VPNs No Longer Suffice Against Advanced DPI Blocking Telegram, Reels and Google AI Studio
Over the past year or two, users have observed that free VPNs and Telegram proxies often stop working after a few days, with Reels freezing, YouTube failing to load, Telegram stuck on Connecting, and Google AI Studio or Gemini returning errors. Modern filtering systems now analyze traffic behavior such as packet sizes, timing intervals, and TLS handshake characteristics rather than decrypting content. Techniques like TCP desynchronization via nfqws, MSS clamping with iptables, uTLS fingerprint emulation in sing-box, and ShadowTLS v3 for borrowing legitimate sessions are being deployed to evade detection. Padding is added to encrypted streams to reduce entropy and frustrate statistical shaping by TSPU systems. Commercial and self-hosted options including hynet.cloud, AmneziaWG, Red Shield VPN, GoodbyeDPI, and Cloudflare WARP each present distinct advantages and limitations when facing evolving network restrictions.