There is seems like login issues with Bitwarden Android app, a lot reported are from Malaysian with Unifi ISP.
https://community.bitwarden.com/t/login-pro...ndroid/60958/20

Use vaultwarden instead?

The "fix" just enable http2, which is currently not affected by cloudflare's block. However it does not guarantee it won't get blocked in the future.
The main problem is the app don't play nicely with Cloudflare Turnstile. It also have some not so standard behavior such as no-cache GET request. It's a standard practice to use POST for such thing.

From a consumer point of view, I say it's more important to have alternative. Maybe additionally use KeePass and sync with your cloud account? At least you have 2 password managers.
Even if you don't sync both password managers often, losing some access is still much better than losing all access.

Keepass has a benefit of being open source, on device and free. At least nobody can kick you out.

Did tm crap out on some international sites earlier? Kept getting time out

Which VPN is suitable and cheap ? I mean as cheap as rm10 per month ?

A bit of update after checking with laptop.
It seems nothing is wrong...

I ran the same nmap scan using my Amazon EC2 instance in Oregon, US.
Same result.

...

Can you post your traceroute to tailscale.com?
What if you use https in curl? Does it work?
If you have IPv6, try -6 instead of -4 to see if it works.

Can't say much about efficiency but they're certainly punctual. Right on the last day of July.

Finally got my FSU +100Mbps free download speed upgrade.

DPN-FX3060V 2.5Gbps still in box. Use back old Huawei for now.

The last time TM did this, both DoH and DoT were blocked too.

DNS is actually the easiest to block. Just listen to all connection to port 53 or 853, add those endpoint to DNS blocklist.
I assure you within a week all open resolver will be permanently banned.

Using the method I described, all endpoint will be dead, including root server. It is the same method China used.

443 is harder to whack but since all open resolver has port 53, 443 and 853 on the same IP, they just need to whack 53 and 853. 443 will be whacked indirectly because the whole IP is in the DNS blocklist.

Of course you can bypass this by putting a CDN in front of your favorite DoH. Since CDN do not have 53 and 853 open, and they are on shared IP, it is not possible to block them. Using CDN also means you have a unique domain name and they cannot whack you solely based on SNI filtering.

If you use HTTP3 (QUIC), the SNI is "encrypted" with a key sent together in the Hello packet too. The censor will then have to do the extra work of extracting the key to decrypt the SNI. At least to my knowledge China and India all drop QUIC packet as a workaround.

The only trouble is you need a working resolver to bootstrap your domain-fronted DoH. You can ride on the ISP resolver for this one.

Your setup is robust and it will continue to work especially if you use Cloudflare Proxied DNS, Cloudflare Tunnel, AWS CloudFront or Akamai. Try not to use DNS.mydomain.com because it seems obvious during bootstrap.

Just make sure you perform certificate validation so the censor cannot MITM you to discover /dns-query.

EDIT:
You can further protect against active probe from the censor by using signed URL.
At least on AWS CloudFront it can be done:
https://docs.aws.amazon.com/AmazonCloudFron...igned-urls.html

How much it cost you for the setup monthly?
Will it cheaper than VPN $5 per month and save all the hassle?

I think since he already has a domain, he must also have something already running. So the cost is free. It is just additional path configuration in nginx and whatever software behind the scene.

Even if you do not have a domain, do not have any cloud instance, you can still create a CloudFront Distribution and Amazon will assign you something like dxxxxxxxxxxxxx.cloudfront.net.
1TB egress per month is free. USD $0.02/GB for origin request. Let's say you use 5GB of DNS request traffic per month, it is only USD $0.10 per month. I never heard of any home user with 5GB per month of DNS request. DNS response is free and covered under 1TB quota.

I think the free 10 millions request per month is more than enough for DNS requests.

I thought you're using VPS + domain coz you mention about unbound, and if i'm not mistaken unbound is actually unencrypted so the ISP still can eavesdrop your unbound queries unless you setup your unbound in foreign country VPS and then DoH back to your devices.

Thanks for your tutorials above, it really help me a lot. 
I'll try to set it up.

Anyone on 800mbps still haven't receive free upgrade to 1gbps? I complained to MCMC but still no change.

out of curiosity, dnscrypt is blocked too I presume?