How Did “Free Internet” Tricks Actually Work?

Definition and Mechanics of Zero-Rating in Cellular Networks

Zero-rating is a telecommunication billing architecture where a Mobile Network Operator (MNO) permits subscriber access to specific internet domains, IP addresses, or application services without deducting data usage from the subscriber's purchased quota.

Network operators implement zero-rating by defining traffic classifiers inside the core network architecture, specifically within the Gateway GPRS Support Node (GGSN), Packet Data Network Gateway (PGW), or User Plane Function (UPF) in 5G systems. These classifiers rely on Deep Packet Inspection (DPI) engines to inspect packets and compare their metadata against whitelisted descriptors, including:

• Destination IPv4 and IPv6 subnets
• Domain Name System (DNS) request and response records
• Server Name Indication (SNI) within TLS ClientHello packets
• HTTP Host headers and Uniform Resource Identifiers (URI)
• Access Point Name (APN) routing definitions
• Transport Layer Security (TLS) fingerprint patterns

When a subscriber initiates a data stream, the Policy and Charging Enforcement Function (PCEF) communicates with the Policy and Charging Rules Function (PCRF) and the Online Charging System (OCS) to determine whether the requested data stream matches an active zero-rated charging rule. If a match occurs, the OCS ignores the billing decrement instruction for that specific flow.

The Function of Server Name Indication (SNI) in Deep Packet Inspection

Server Name Indication (SNI) is an extension to the Transport Layer Security (TLS) protocol defined in RFC 6066. It enables a client device to announce the target fully qualified domain name (FQDN) during the initial unencrypted TLS handshake phase, allowing a shared IP host to serve the correct digital certificate.

Because the TLS handshake begins before session encryption is established, the SNI field exists in cleartext within the initial ClientHello frame. MNOs historically configured DPI appliances to extract the SNI field directly from outbound port 443 traffic. If the extracted hostname matched a whitelisted domain, the PCEF categorized the entire TCP connection as exempt from quota consumption.

The architectural vulnerability of this model stems from trusting client-generated metadata without validating whether the underlying IP transport layer aligns with the authoritative IP ranges of that specified domain.

Tunneling Architecture: Encapsulating Payloads via VPN and Proxy Protocols

Virtual Private Network (VPN) protocols and proxy servers do not bypass physical network layers. Instead, they encapsulate arbitrary IP packets or application-layer payloads inside a secondary transport layer established between the mobile client and a remote intermediate server.

When a mobile client initiates an encapsulated tunnel to a proxy server, the cellular operator's DPI observes only the outer wrapper of the connection. If the client manipulates the outer handshake metadata to present the credentials of a zero-rated domain, the MNO classification engine categorizes the entire tunnel stream as zero-rated traffic. Once the tunnel is authenticated, all internal payloads, regardless of destination, flow through the unmetered conduit.

Protocol Exploitation: Xray-Core and V2Ray Transport Configurations

V2Ray and Xray-Core are open-source modular proxy platforms designed for censorship circumvention, network routing, and transport obfuscation. They are not data generation engines; they function as network tunneling intermediaries capable of formatting arbitrary traffic into standardized web protocols such as WebSocket, gRPC, and HTTP/2 over TLS.

These frameworks enabled zero-rating exploitation by allowing precise configuration of the TLS handshake parameters independently of the target IP address. A user could direct a WebSocket connection to a private Virtual Private Server (VPS) while populating the TLS serverName (SNI) with an operator-exempted domain.

{
  "outbounds": [
    {
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "203.0.113.10",
            "port": 443,
            "users": [
              {
                "id": "e4d3c2b1-0000-4000-8000-0123456789ab",
                "encryption": "none"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "ws",
        "security": "tls",
        "tlsSettings": {
          "serverName": "zero-rated-portal.operator.com",
          "allowInsecure": false
        },
        "wsSettings": {
          "path": "/websocket-entry"
        }
      }
    }
  ]
}

In this implementation, the MNO's DPI parser verified only that the initial TLS ClientHello contained zero-rated-portal.operator.com. Because the packet inspection routine did not cross-examine the destination IP 203.0.113.10 against the registered ASN routes for that hostname, the entire data stream was routed through the zero-rated billing profile.

Telecommunication Countermeasures: Multi-Vector Deep Packet Inspection

The persistence of zero-rating bypass exploits led telecom engineering teams to deploy multi-vector traffic classification frameworks. Single-attribute verification models were replaced with multi-tier policy correlation pipelines.

Modern carrier networks validate multiple synchronous conditions prior to classifying a data flow as zero-rated:

Validation Vector 1: SNI = zero-rated-portal.operator.com
Validation Vector 2: Destination IP = 198.51.100.24 (Matches Operator ASN: PASS)
Validation Vector 3: JA4 Fingerprint = Matches Official Mobile Application (PASS)
Validation Vector 4: OCSP / TLS Certificate Chain = Signed by Authorized CA (PASS)
Result: BILLING_BYPASS_AUTHORIZED

Discrepancy Scenario:
Validation Vector 1: SNI = zero-rated-portal.operator.com
Validation Vector 2: Destination IP = 203.0.113.10 (Third-Party Hosting Provider: FAIL)
Result: ROUTE_TO_METERED_BILLING (Or Issue TCP RST)

The adoption of modern transport security standards, including Encrypted ClientHello (ECH), TLS 1.3 encrypted handshakes, and QUIC, has further eliminated reliance on cleartext SNI inspection, requiring carriers to manage zero-rating through strict IP subnet whitelisting and dedicated application API gateways.

Architectural Takeaway: Network Layers and Policy Enforcement Functions

The operation of zero-rating bypass configurations demonstrated the operational divergence between network application data and network control policy.

These historical exploits were not mechanisms of cryptographic compromise or data generation. They were protocol alignment exploits where client-side configuration tools mimicked the semantic attributes expected by telecommunication policy enforcement engines. Once network operators aligned multi-layer verification between the transport, cryptographic, and physical routing layers, the administrative loopholes ceased to function.