A few minutes ago, there was a terror attack on a nightclub in Istanbul/Turkey(Thoughts and prayers to the victims and families), usually, the Government limits most of the communications apps traffic and they already block the most popular VPN services.

However, this time they blocked the Telegram App traffic, so I started my own VPN connection (OpenVPN), still nothing and every other app and the rest of the internet connection works normally, maybe there a problem with server, started my paid VPN connection, nothing, another one, still nothing, different internet provider, no traffic what so ever to the Telegram and the rest of the traffic going in/out normal.

Is there any method to target an encrypted traffic that is inside VPN tunnel?

  • 1
    Excuse the obvious question, but the VPN servers you were connecting to were definitely in a region with unrestricted Internet, correct? – tlng05 Jan 1 '17 at 5:20
  • yeah, I tried personal server in USA , paid VPN (Private Tunnel ) both Germany and US servers – moamen Jan 2 '17 at 4:41

In theory one could use heuristics to guess the kind of traffic. A typical example is flow analysis where one analysis the size, direction and timing of transferred data because various protocols and applications show different behavior in this regard. But unless one has lots of statistics about the various applications the chance of guessing wrong is high. Also, such traffic filtering is not cheap and I don't think that Turkey has already reached the capabilities of filtering like for example Chinas Great Firewall.

It's more likely that the filtering is targeting VPN in general or is targeting traffic which does not pass through the VPN. Technologies like OpenVPN can be easily detected and blocked by typical ports used or by the format of the exchanged data. But if other applications work through the same VPN it is not likely that the VPN itself is the target because even if it would be possible to detect specific applications it is probably impossible to filter only their traffic from the VPN without affecting the other traffic.

Thus if other applications still work over the VPN it is more likely that you are affected by filters of non-VPN traffic. This can happen if your VPN is not properly setup to include all traffic. Typical problems are that DNS lookups are not done through the VPN or that the VPN only includes IPv4 traffic and IPv6 is sent without VPN. In this case it is possible to target specific application by making their DNS names resolve to the wrong side or by filtering their IPv6 traffic. Also, DNS lookups are cached and it might be that you've tried to use the application without VPN first and that even after switching to VPN it still uses the previous and wrong result of the DNS lookup to reach the server. And even if your DNS lookups are done though the VPN you are affected by DNS based blocks if you still use the ISP's DNS server instead of switching to an alternative DNS server.

And since you've got your IP address and initial routes from your ISP it is maybe possible that the ISP is not only pushing a default route but several specific routes too via DHCP and that these routes are more specific than the routes setup by the VPN. This way traffic for specific networks would not pass through the VPN because it has a more specific route directly to the ISP. This technique of using more specific routes is typically used by the VPN itself but also by attack tools like Poisontap.

  • Many thanks all , appreciate the help by the way, I forgot to mention that both desktop and mobile version had the same , in both platform (Windows , IPhone) I tried different VPNs and only the telegram traffic was blocked, Facebbok, Whatsapp , browser traffic were working fine – moamen Jan 2 '17 at 4:52
  • 1
    @moamen: in this case I would suggest that you were still using the DNS server by the ISP through the VPN or that the VPN was not properly setup to actually include all traffic. But unfortunately your question is too rare of technical details of your setup. – Steffen Ullrich Jan 2 '17 at 5:58

If the VPN connection is properly setup such that all data goes through it is not possible to block specific apps since there is no way to know what data is sent through the VPN connection.

Without further details I would, from the top of my head, guess one of these things happened:

  • The DNS lookups didn't go through the VPN and were thus blocked.
  • The VPN server is in (or compromised by, unlikely but not impossible) Turkey and the connection between them and Telegram was blocked

As noted by @Kolob in the comment, it is possible to take actions based on traffic patterns, but in the specific case of Telegram I very highly doubt that it would give rise to that kind of patterns since the volumes are rather small not to different to a lot of other protocols.

  • 1
    They can block based on how much bandwidth you're using. In the case of a VPN, if you were using bit torrent and they can't see for sure that is what you are doing, but they could see you're moving a great deal of encrypted traffic. – Kolob Canyon Jan 1 '17 at 5:16
  • 1
    Yes, however in the case of Telegram I highly doubt that this applies. Strictly speaking you are not wrong, I'll add a paragraph about this. – Zeta Two Jan 1 '17 at 5:18
  • 1
    I agree with you, in his case there wouldn't be enough bandwidth being used to raise an eyebrow. I had no idea governments blocked VPN's, (didn't know that was possible to enforce) – Kolob Canyon Jan 1 '17 at 5:20
  • 1
    It really is very easy to block VPN's and many enterprises and some ISP's do it regularly. It can be made harder by using a VPN that works over port 443 which is hard to block as it is used by HTTPS. But even then, any filter that does packet inspection will be able to detect the difference between general HTTPS traffic and VPN traffic. – Julian Knight Jan 1 '17 at 14:38
  • 1
    @JulianKnight yes, blocking the whole VPN connection is no problem but that's obviously not the case since OP says that other apps works fine, just not Telegram. – Zeta Two Jan 1 '17 at 16:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.