Reachability

The client-eye checks run on the panel's server, which is not inside the country where your users are, so they cannot see a block there. Three sources look from inside one country (Russia by default) instead: Globalping, the block lists and the TSPU probe. Each is an integration of its own and off by default. The panel combines what they see into one verdict per node, keeps a week of it, and raises an alert when a node stops opening.

In the admin#

Reachability is a section of its own in the menu, right after Health (on a phone, under More). Everyone who can open Health can open it; the sources and the country are the owner's, and changing a source asks for a fresh confirmation.

• Header: the country the sources look from; the owner picks it here. The country (default RU) is one shared setting that every source looks from. The block lists and the TSPU probe exist for Russia only.
• Summary: how many nodes are reachable, TCP blocked, unreachable, listed (in a block list, not checked live) or without data, in the colours and marks of Health. With every source off it says so instead and points to the sources.
• Nodes: for each node its verdict now, with the same tooltip as on Health, then a line per source (Globalping, Lists, Probe): what that source says now and a lane of its verdicts over 7 days. A lane is a strip of segments coloured by verdict; hover or focus a segment to see its verdict and when it started and ended, and move along a lane with the arrow keys. A source that is off is dimmed and its lanes are empty. On a screen narrower than 1280 pixels each node is a card with the lanes under its verdict.
• Recent events: the country_blocked alerts of the last 7 days, open and closed, each a link to the alert on Health → Alerts.
• Sources: the cards of Globalping, the block lists and the TSPU probe.

Health → Checks still shows the verdict as its last column, From Russia (a row per node on a phone), and the node page as a row of its client-eye checks. Both are hidden while every source is off, and their titles lead to this section. The API has the week as CountryReachabilityService.GetReachabilityHistory: at most 7 days, readable like GetChecks by every role and by API tokens.

Globalping#

The first source asks probes inside the country (home and mobile networks first) to ping every online node and to open TCP connections to its ports, and compares the answers. It uses Globalping, a free network of probes. Switching it on sends the IPv4 address of each online node to Globalping and to nobody else.

• Where: the Globalping card in Reachability → Sources.
• Settings (owner only): on or off, the interval in minutes (default 15, at least 10) and an optional token, which is write-only and raises the free limit from 250 to 500 tests an hour. Test reads Globalping's rate-limit endpoint and sends no address. Disconnect switches the integration off and forgets the token.
• Off means off. With the integration off no round starts and nothing is sent. A round in flight is cancelled when you switch it off. Stored results stay for 7 days, but the API stops returning them.
• What is asked. Three probes (two when the budget needs it) take part in every round. Each node gets an ICMP ping of its address and a TCP ping of each TCP port of its active profiles (VLESS, and the HTTPS site of Hysteria2). A node with only UDP profiles gets the ICMP ping alone: Globalping has no UDP test.
• Control. Every round the same probes also open TCP 443 to a large site that is never blocked in that country (ya.ru for RU). A probe that cannot reach it is thrown away for that round. With fewer than two valid probes the verdict is unknown.
• Verdict per node. ok: TCP connects from at least half of the valid probes (ICMP for a node without TCP ports). tcp_blocked: ICMP answers from at least half, but TCP fails from all of them: the connection requests are dropped while the address is not. blocked: nothing passes. unknown: too few probes, a limit, an error, a timeout, or a split picture that proves nothing.
• Budget. A round costs (1 control + for each node 1 + its TCP ports) x probes tests. If the rounds of an hour would use more than 80 % of the limit, the probes go down to two, and if that is still too much the interval is stretched (the panel logs it once). On a rate limit the round is unknown and the next one waits until the limit resets.
• Both editions. The VPS panel looks every 30 seconds whether a round is due; the Cloudflare edition does it from its once-a-minute cron.

Block lists#

The second source of the country check: the panel compares the IPv4 address of every active node with public lists of blocked addresses. The lists are downloaded to the panel and compared there, so no node address leaves the panel. It is an integration of its own, off by default, and works for Russia only: with another country selected the card says so and nothing is downloaded.

• Where: the Block lists card in Reachability → Sources. Its verdicts join the node's verdict there, in the From Russia column and in the node row.
• The lists. ipsum.lst from antifilter.download, the RKN registry summed up to /24 subnets, with antifilter.network as the mirror when the main address does not answer. community.lst, addresses the community found blocked. cdn-ip-ranges, the ranges of CDN and hosting providers: it only names the subnet a node sits in ("Hetzner subnet, DE") and never makes a verdict. IPv6 addresses are not checked.
• Schedule. Every 6 hours the panel refreshes the lists with a conditional request (an unchanged list costs a 304) and compares every node again; a new node is compared at once. The lists are kept in memory only. When no list can be downloaded, the next try is in 15 minutes. Test does it now and reports the date of the lists, the number of prefixes and CDN ranges, how many nodes are listed, and whether the mirror answered. Disconnect switches it off and also deletes the downloaded lists and every stored result.
• listed never opens an alert. A node whose address is in a list and that no live source has checked shows listed, in yellow: in the registry, not checked live. The registry says the address is written down, not that its traffic is dropped, and a list alone would raise alerts for every node in a crowded subnet. A live verdict from Globalping always wins; the lists then add their detail to its tooltip.
• Off means off. With the source off nothing is downloaded, neither on schedule nor by Test, and Health shows nothing from it. Stored results stay hidden until they expire after 7 days.

TSPU probe#

The third source of the country check, and the one that tests the TCP ports of your nodes from inside the country with your own hardware. One of your nodes in the country, the probe node, finds the box of the national DPI (the TSPU) on its own path and then sends TCP SYN packets with a limited TTL to the other nodes: when the packets die silently at that box and no router behind it answers, the port is blocked. The method is the one of tspu-check and cheburcheck; the node agent re-implements it and uses none of their code. It is an integration of its own, off by default, and works for Russia only: with another country selected the card says so and nothing is sent.

• Where: the TSPU probe card in Reachability → Sources. Its verdicts join the node's verdict there, in the From Russia column and in the node row; the tooltip names the probe node and the hop where the box sits (dpi_hop).
• Settings (owner only; changing them asks for a fresh confirmation): on or off, the probe node and the interval (default 120 minutes, at least 30). The picker lists the nodes in the selected country first. A node can be the probe node when it is online and its agent declares country-probe/1; an older agent has to be updated first. Nothing runs until a probe node is chosen.
• A data-centre view. The probe node sits in a data centre, so it sees the filtering of its own uplink, not what a person on a home or mobile network sees. Its verdicts carry the confidence dc_only, and the home and mobile probes of Globalping (eyeball) outrank it.
• How it joins the verdict. For each node the newest run counts as a live verdict: every tested port blocked, or some blocked and none open, is tcp_blocked; any open port makes it ok. When Globalping and the probe node agree, the verdict keeps the better confidence. When they disagree, the worse verdict is shown with the confidence conflict (better a false alarm than a miss), and the tooltip says what each of them saw. A run older than three intervals no longer counts. The block lists stay detail only.
• What is sent. Commands to the probe node, over its agent link. The probe node then sends SYN packets to the addresses of your other online nodes (the TCP ports of their enabled profiles, 443 first; never to itself) and to two fixed addresses of the country: a control that is never blocked (Yandex) and a reference that the TSPU always drops, which is how the box is found. The references are built into the panel; when the first cannot place the box, the panel tries the next one. No node address goes to a third party.
• No extra privileges. The probe is an ordinary TCP connection attempt with a limited TTL, so the node agent keeps its hardened service: no raw sockets, no CAP_NET_RAW. It relies on the kernel handing the answers of routers to the connecting socket. That was tested on one kernel (Linux 6.6) only; watch the first run on a node with an older one, which ends as no_dpi_hop or failed if the kernel does not cooperate.
• Only TCP. UDP is not tested. A Hysteria2 or AWG node is judged by the TCP ports of its other profiles (VLESS, the HTTPS site of Hysteria2); a node with only UDP profiles and no site gets no verdict from this source.
• Schedule. Every interval the panel sends the probe node a few commands in a row (6 to 8 pairs of host and port each; a blocked pair is checked again alone, so one command can take two minutes) and stores each answer as it arrives. The next run is due when the newest stored row is older than the interval, so restarting the panel does not start one. A busy probe node is asked again after 5 minutes; an offline probe node, or an agent without country-probe/1, skips the round. Test runs it now (at most once a minute; it can take a few minutes) and shows the status and the verdict of each node.
• Status of the last run. ok. control_failed: the control address is blocked behind the box on the probe node's network, so the method does not apply there and no verdict is made. no_dpi_hop: the box could not be placed, no reference worked. busy. failed: no answer, an agent that is too old, or a lost link.
• Off means off. With the source off no command is sent, neither on schedule nor by Test, and Health shows nothing from it. Stored rows stay hidden for 7 days. Disconnect switches it off and deletes the stored rows and the settings (the probe node, the interval, the last run).
• Not on the Cloudflare edition yet. A run takes minutes and the scheduled jobs of that edition have seconds, so the card says the source is unavailable there and nothing runs (see Not available in this edition yet).

The alert#

The alert country_blocked opens after two rounds in a row with blocked or tcp_blocked, and closes after two rounds with ok; unknown rounds change nothing. With the TSPU probe on, a round is a Globalping round or a run of the probe node, each combined with the newest result of the other; a node that only the probe node sees gets a round per run. A block list never counts. The alert and its Telegram message say which sources saw the block (globalping, tspu) and how sure the verdict is (eyeball, dc_only, or conflict when the two disagree).