Findings documented on 25/04/2022.

TCP is allowed

$ tcpdump -i ens160 port 4500
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens160, link-type EN10MB (Ethernet), capture size 262144 bytes
10:33:44.095050 IP 78.186.234.78.static.ttnet.com.tr.38742 > 85.117.236.245.static.sunucu.com.4500: Flags [S], seq 126331927, win 1480, options [mss 1452], length 0
10:33:44.095101 IP 85.117.236.245.static.sunucu.com.4500 > 78.186.234.78.static.ttnet.com.tr.38742: Flags [R.], seq 0, ack 126331928, win 0, length 0

SSH is blocked.
Proxy queries over SOCKS or HTTP is blocked.

HTTP/HTTPS Connections

TLS Inspection Certificate

HTTP Proxy at port 80/443

UDP is allowed

$ tcpdump -i ens160 port 4500
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens160, link-type EN10MB (Ethernet), capture size 262144 bytes
10:21:44.671065 IP 78.186.234.78.static.ttnet.com.tr.38560 > 85.117.236.245.static.sunucu.com.ipsec-nat-t: [|isakmp]

Any protocol using UDP on port 53 and 123 is allowed.
ESP (IPSec) over UDP is allowed.
QUIC is allowed.
OpenVPN works on ports other than 1194 as it cannot be distinguished.
WireGuard is blocked.
Cloudflare WARP works as it does not use wg(8) to configure the tunnel. Therefore, the packets do not include the WireGuard header for handshake and data transport.
- When connecting to WARP, Cloudflare WARP app passes some information over HTTPS. Since there’s TLS inspection on the network, it won’t be able to connect because the TLS certificate is of the attacker. The certificate created by the government needs to be installed as a root certificate to be able to connect to WARP. As a workaround, one could connect to WARP over another network (cellular, etc.) where there’s no TLS inspection. Then, switch to MEB network to keep the connection.