江苏移动家用宽带部分服务器可能被运营商SNI阻断

[handsomeOTTO]

我用家庭宽带访问映射到frp-shy.com的网页时, 使用http直接跳转江苏反诈网, 使用https无法访问, 使用DNS解析后的ip可以正常访问, 疑似SNI 阻断, 个人敏感信息已替换

http访问

$ curl -v http://frp-shy.com:PORT/
* Host frp-shy.com:PORT was resolved.
* IPv6: (none)
* IPv4: 117.147.231.244
*   Trying 117.147.231.244:PORT...
* Connected to frp-shy.com (117.147.231.244) port PORT
* using HTTP/1.x
> GET / HTTP/1.1
> Host: frp-shy.com:PORT
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 302 Moved Temporarily
< Connection: close
< Content-Length: 0
< Server: Apache-Coyote/1.1
< Location: http://www.js96110.com.cn/
<
* shutting down connection #0

https访问

$ curl -v https://frp-shy.com:PORT/
* Host frp-shy.com:PORT was resolved.
* IPv6: (none)
* IPv4: 117.147.231.244
*   Trying 117.147.231.244:PORT...
* schannel: disabled automatic use of client certificate
* ALPN: curl offers http/1.1
* Recv failure: Connection was reset
* schannel: failed to receive handshake, SSL/TLS connection failed
* closing connection #0
curl: (35) Recv failure: Connection was reset

ip访问

$ curl -vk https://117.147.231.244:PORT
*   Trying 117.147.231.244:PORT...
* schannel: disabled automatic use of client certificate
* schannel: using IP address, SNI is not supported by OS.
* ALPN: curl offers http/1.1
* ALPN: server accepted http/1.1
* Connected to 117.147.231.244 (117.147.231.244) port PORT
* using HTTP/1.x
> GET / HTTP/1.1
> Host: 117.147.231.244:PORT
> Accept: */*
>
* Request completely sent off
* schannel: remote party requests renegotiation
* schannel: renegotiating SSL/TLS connection
* schannel: SSL/TLS connection renegotiated
* schannel: remote party requests renegotiation
* schannel: renegotiating SSL/TLS connection
* schannel: SSL/TLS connection renegotiated
< HTTP/1.1 302 Found
< Server: nginx
< Date: Thu, 09 Oct 2025 02:25:45 GMT
< Transfer-Encoding: chunked
< Connection: keep-alive
< Keep-Alive: timeout=20
< Location: web/index.html
<
* Connection #0 to host 117.147.231.244 left intact

替换SNI访问

$ curl -vk --resolve test.com:PORT:117.147.231.244 https://test.com:PORT/
* Added test.com:PORT:117.147.231.244 to DNS cache
* Hostname test.com was found in DNS cache
*   Trying 117.147.231.244:PORT...
* schannel: disabled automatic use of client certificate
* ALPN: curl offers http/1.1
* ALPN: server accepted http/1.1
* Connected to test.com (117.147.231.244) port PORT
* using HTTP/1.x
> GET / HTTP/1.1
> Host: test.com:PORT
> Accept: */*
>
* Request completely sent off
* schannel: remote party requests renegotiation
* schannel: renegotiating SSL/TLS connection
* schannel: SSL/TLS connection renegotiated
* schannel: remote party requests renegotiation
* schannel: renegotiating SSL/TLS connection
* schannel: SSL/TLS connection renegotiated
< HTTP/1.1 302 Found
< Server: nginx
< Date: Thu, 09 Oct 2025 02:22:19 GMT
< Transfer-Encoding: chunked
< Connection: keep-alive
< Keep-Alive: timeout=20
< Location: web/index.html
<
* Connection #0 to host test.com left intact

[natfrp-bot]

这个是江苏地区的反诈拦截，我们处理不了，您可以致电当地反诈中心咨询

建议设置子域绑定并通过分配的子域名进行访问，这样应该能解决