Strange behavior on ip.gs (Received HTTP/0.9)

[mymirai-nikki]

Background story: I can't communicate with certain CIDR block, probably blocked by firewall.

So we setup a tunnel over HTTP(S/TLS) protocol, the flow in general look like this: my host -> socks tunnel -> ssh -> firewalled host -> proxychains-windows -> socks tunnel -> my host -> free internet.

and the weird thing is the anomaly in this output:

user@firewalled_host MSYS ~/proxychain_win32
# ./proxychains_win32_x64d.exe -f ./proxychains.conf curl -sv4 ip.gs
[D] 2025/09/18 21:31:25 Argv[3] = curl
[D] 2025/09/18 21:31:25 Argv[4] = -sv4
[D] 2025/09/18 21:31:25 Argv[5] = ip.gs
[I] 2025/09/18 21:31:25 Configuration file: ./proxychains.conf
[PID 7264] [I] 2025/09/18 21:31:25 Ws2_32.dll connect(344 127.0.0.1:31056 16) DIRECT
* Host ip.gs:80 was resolved.
* IPv6: (none)
* IPv4: 224.178.133.122
*   Trying 224.178.133.122:80...
[PID 7264] [I] 2025/09/18 21:31:25 <> localhost:1080
[PID 7264] [I] 2025/09/18 21:31:25 Ws2_32.dll connect(372 224.178.133.122:80 16) -> ip.gs:80 PROXY
* Connected to ip.gs (224.178.133.122) port 80
* using HTTP/1.x
> GET / HTTP/1.1
> Host: ip.gs
> User-Agent: curl/8.14.1
> Accept: */*
>
* Received HTTP/0.9 when not allowed
* closing connection #0
[I] 2025/09/18 21:31:25 All Windows descendant process exited.
[I] 2025/09/18 21:31:25 Master exiting

user@firewalled_host MSYS ~/proxychain_win32
# ./proxychains_win32_x64d.exe -f ./proxychains.conf curl --http0.9 -sv4 ip.gs
[D] 2025/09/18 21:32:30 Argv[3] = curl
[D] 2025/09/18 21:32:30 Argv[4] = --http0.9
[D] 2025/09/18 21:32:30 Argv[5] = -sv4
[D] 2025/09/18 21:32:30 Argv[6] = ip.gs
[I] 2025/09/18 21:32:30 Configuration file: ./proxychains.conf
[PID10960] [I] 2025/09/18 21:32:30 Ws2_32.dll connect(388 127.0.0.1:31067 16) DIRECT
* Host ip.gs:80 was resolved.
* IPv6: (none)
* IPv4: 224.178.133.122
*   Trying 224.178.133.122:80...
[PID10960] [W] 2025/09/18 21:32:36 select() timeout
[PID10960] [W] 2025/09/18 21:32:36 Ws2_32.dll connect(400 224.178.133.122:80 16) -> ip.gs:80 PROXY ret: -1, wsa last error: This operation returned because the timeout period expired.(1460)
* Immediate connect fail for 224.178.133.122: This operation returned because the timeout period expired.
* Failed to connect to ip.gs port 80 after 4 ms: Could not connect to server
* closing connection #0
[I] 2025/09/18 21:32:36 All Windows descendant process exited.
[I] 2025/09/18 21:32:36 Master exiting

user@firewalled_host MSYS ~/proxychain_win32
#  curl -4 -v -x socks5://127.0.0.1:1080 ip.gs
*   Trying 127.0.0.1:1080...
* Connected to 127.0.0.1 (127.0.0.1) port 1080
* Host ip.gs:80 was resolved.
* IPv6: (none)
* IPv4: 172.67.160.28, 104.21.14.176
* SOCKS5 connect to 172.67.160.28:80 (locally resolved)
* SOCKS5 request granted.
* Connected to 127.0.0.1 (127.0.0.1) port 1080
> GET / HTTP/1.1
> Host: ip.gs
> User-Agent: curl/8.5.0
> Accept: */*
>
< HTTP/1.1 200 OK
(REDACTED)
* Connection #0 to host 127.0.0.1 left intact

Why I received HTTP/0.9 only when I use proxychains-windows? and allowing HTTP/0.9 with --http0.9 just triggering timeout.

The socks server I ran on my host is from dante sockd, is it somehow related to that?

sockd.conf:

logoutput: stderr

internal.protocol: ipv4 ipv6
internal: lo port = 1080

external: <interface_name>
external.rotation: route

socksmethod: none

clientmethod: none

client pass {
    from: 0/0 to: 0/0
    log: connect disconnect
}

socks pass {
	from: 0/0 to: 0/0
	log: connect disconnect
	protocol: tcp udp
}

[mymirai-nikki]

Another strange behavior (the resolved address is a private address, this only happened when using proxychain):

# ./proxychains_win32_x64d.exe -f ./proxychains.conf curl -v "https://pkgs.tailscale.com/stable/?mode=json&os=windows"
[D] 2025/09/19 13:15:45 Argv[3] = curl
[D] 2025/09/19 13:15:45 Argv[4] = -v
[D] 2025/09/19 13:15:45 Argv[5] = https://pkgs.tailscale.com/stable/?mode=json&os=windows
[I] 2025/09/19 13:15:45 Configuration file: ./proxychains.conf
[PID 7956] [I] 2025/09/19 13:15:45 Ws2_32.dll connect(380 127.0.0.1:18027 16) DIRECT
* Host pkgs.tailscale.com:443 was resolved.
* IPv6: (none)
* IPv4: 224.124.44.246
*   Trying 224.124.44.246:443...
[PID 7956] [I] 2025/09/19 13:15:45 <> localhost:1080
[PID 7956] [I] 2025/09/19 13:15:45 Ws2_32.dll connect(404 224.124.44.246:443 16) -> pkgs.tailscale.com:443 PROXY
* schannel: disabled automatic use of client certificate
* ALPN: curl offers http/1.1
* schannel: next InitializeSecurityContext failed: SEC_E_INVALID_TOKEN (0x80090308) - The token supplied to the function is invalid
* closing connection #0
curl: (35) schannel: next InitializeSecurityContext failed: SEC_E_INVALID_TOKEN (0x80090308) - The token supplied to the function is invalid
[I] 2025/09/19 13:15:45 All Windows descendant process exited.
[I] 2025/09/19 13:15:45 Master exiting

# curl -v -x socks5://127.0.0.1:1080 "https://pkgs.tailscale.com/stable/?mode=json&os=windows"
*   Trying 127.0.0.1:1080...
* Connected to 127.0.0.1 (127.0.0.1) port 1080
* Host pkgs.tailscale.com:443 was resolved.
* IPv6: 2607:f740:f::d19
* IPv4: 199.38.181.239
* SOCKS5 connect to 199.38.181.239:443 (locally resolved)
* SOCKS5 request granted.
* Connected to 127.0.0.1 (127.0.0.1) port 1080
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /usr/ssl/certs/ca-bundle.crt
*  CApath: none
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / x25519 / id-ecPublicKey
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=pkgs.tailscale.com
*  start date: Sep  8 22:45:07 2025 GMT
*  expire date: Dec  7 22:45:06 2025 GMT
*  subjectAltName: host "pkgs.tailscale.com" matched cert's "pkgs.tailscale.com"
*  issuer: C=US; O=Let's Encrypt; CN=E7
*  SSL certificate verify ok.
*   Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 2: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://pkgs.tailscale.com/stable/?mode=json&os=windows
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: pkgs.tailscale.com]
* [HTTP/2] [1] [:path: /stable/?mode=json&os=windows]
* [HTTP/2] [1] [user-agent: curl/8.5.0]
* [HTTP/2] [1] [accept: */*]
> GET /stable/?mode=json&os=windows HTTP/2
> Host: pkgs.tailscale.com
> User-Agent: curl/8.5.0
> Accept: */*
>
< HTTP/2 200
< content-security-policy: base-uri 'self'; block-all-mixed-content; default-src 'self'; form-action 'self'; frame-ancestors 'none';
< content-type: application/json
< cross-origin-opener-policy: same-origin
< referer-policy: same-origin
< set-cookie: _gorilla_csrf=MTc1ODI2MjU5OXxJbFJ0T1dWNlVFRlBZMkpyVkVSTlIyMW1kRXBRU2pkTGJ5dDFVVVpSYTFaT1pqRjNOSGgzZW01dWMxazlJZ289fLGDppsfC_1CQkWrGxZGl2CEU7oqO38utj0c8eAgKZno; Expires=Fri, 19 Sep 2025 18:16:39 GMT; Max-Age=43200; HttpOnly; Secure; SameSite=Strict
< strict-transport-security: max-age=31536000
< vary: Cookie
< x-content-type-options: nosniff
< content-length: 529
< date: Fri, 19 Sep 2025 06:16:39 GMT
<
{
        "Exes": [
                "tailscale-setup-1.88.1.exe",
                "tailscale-setup-full-1.88.1.exe"
        ],
        "ExesVersion": "1.88.1",
        "MSIs": {
                "amd64": "tailscale-setup-1.88.1-amd64.msi",
                "arm64": "tailscale-setup-1.88.1-arm64.msi",
                "x86": "tailscale-setup-1.88.1-x86.msi"
        },
        "MSIsVersion": "1.88.1",
        "Version": "1.88.1",
        "Installer": {
                "amd64.exe": "tailscale-setup-full-1.88.1.exe",
                "amd64.msi": "tailscale-setup-1.88.1-amd64.msi",
                "arm64.msi": "tailscale-setup-1.88.1-arm64.msi",
                "x86.msi": "tailscale-setup-1.88.1-x86.msi"
        }
}
* Connection #0 to host 127.0.0.1 left intact

[mymirai-nikki]

although in the end I ended up forced the DNS resolution with hard-coded IP in hosts file.

and it seems fix this strange behavior.

[shunf4]

IP 224.* serves as an fake IP which proxychains recognizes and maps into the domain name passed to the proxy. If 224.* is problematic for you, consider changing it with remote_dns_subnet or remote_dns_subnet_cidr_v4 in configuration file.

[mymirai-nikki]

IP 224.* serves as an fake IP which proxychains recognizes and maps into the domain name passed to the proxy. If 224.* is problematic for you, consider changing it with remote_dns_subnet or remote_dns_subnet_cidr_v4 in configuration file.

I'm not very good at reading the source code, what is the purpose of having fake IP that maps into the domain name passed to the proxy?