Raw UDP P2P gaming traffic was detected and blocked within 1–2 hours. Hysteria 2 port-hopping delayed blocking but the entire server IP was eventually blacklisted once enough ports were consumed. The reporter identified udp2raw + WireGuard (with udpspeeder for packet loss compensation) as the most stable high-performance solution.

CDN-based proxy protocols avoid permanent IP-level GFW blocking but suffer from instability. IPLC ('no wall crossing') leased lines are stable and fast but expensive and subject to periodic administrative disconnection by the Chinese communications regulator.

Comment by @RPRX, Nov 18 2024 evaluation

Hysteria 2 (QUIC-based proxy) suffered past large-scale GFW blocking events but was broadly functional as of late 2024. Aggressive packet sending causes VPS providers and ISPs—not the GFW itself—to apply rate limits, adding a second failure mode beyond censor detection.

Comment by @RPRX, Nov 18 2024 evaluation

REALITY ('certificate stealing') had produced no large-scale GFW blocking reports as of November 2024, per Xray-core developer @RPRX. Its operational downside is lower throughput compared to aggressive packet-dispatch protocols like Hysteria 2.

Comment by @RPRX, Nov 18 2024 evaluation

XTLS Vision has never triggered large-scale GFW blocking; one user reports 2.5+ years of uninterrupted use. Developers acknowledge that Vision without Seed produces fixed, distinguishable traffic characteristics and are developing 'Vision Seed' to introduce per-session randomization.

Comments by @RPRX and @terada46, Nov 18–20 2024 evaluation

The June 2025 Iran shutdown—carried out during the Iran-Israel war beginning ~June 19—did not use BGP route withdrawals as in 2019. Instead, authorities applied service-level restrictions at the national border: DNS poisoning of foreign destinations, protocol whitelisting permitting only pre-approved domestic services, and DPI to block circumvention-tool traffic. Iran's international traffic fell roughly 90% while the country's BGP routes remained advertised, making the shutdown invisible to BGP-based monitoring systems. OONI measurement volume, which totalled 121,333 in June 2025, collapsed to under 200 submissions on June 19-20.

2025-iran-shutdown-measurement Executive Summary / §2 dpidns-poisoningport-blockingip-blocking

Russia's Roskomnadzor confirmed in February 2026 that it had blocked 469 VPN services used to bypass censorship. Starting December 2025, Russia began blocking the three most commonly used VPN protocols, and from 2025 onward began imposing penalties for promoting VPN services.

2026-anon-2026-27-vpn §5 (Human Rights Watch section) port-blockingdpiip-blocking

Table 1 of the survey documents that by 2013–2014 censors were deploying simultaneous blocking across BGP, DNS, IP/port filtering, TCP disruption, TLS, and application-layer keyword filtering. No single detection tool in the survey covers all six layers; the most comprehensive, OONI (2012), covers DNS, IP/port, TCP, TLS, keyword, and HTTP but notes only partial BGP coverage.

2015-aceto-internet Table 1 bgp-hijackdns-poisoningport-blockingip-blockingrst-injectiontls-fingerprintkeyword-filteringdpi

The paper presents a systematic taxonomy of blocking criteria across ISO/OSI layers: circumstance-based (addresses including sender/receiver/kind/physical location; timing including send time, receive time, duration, frequency; data-transfer properties; services including protocols, names, addresses) and content-based (file type/MIME, statistical detection of encrypted or compressed data, pattern matching for keywords or phrases, and website fingerprinting via request-count/byte-volume signatures).

2004-k-psell-achieve §4, Appendix A dpiip-blockingport-blockingtraffic-shapekeyword-filtering

During the June 2025 shutdown, Iranian authorities blocked international One-Time Password (OTP) SMS delivery, preventing new sign-ins to foreign secure-messaging platforms and VPN services. This forced users toward government-approved domestic platforms that lack security and privacy protections. The blockade of OTPs effectively weaponized account-recovery flows as a secondary shutdown layer, disproportionately affecting users who needed to activate new circumvention tools during the crisis.

2025-iran-shutdown-measurement §Human Rights Implications port-blockingdpikeyword-filtering

TSG's Context-Based Detector (CBD) evaluates circumvention tool signatures across JA3/JA4 TLS fingerprints, SSL certificate issuer fields, UDP payload length, first-packet byte patterns, server IP ranges, and FQDN matches, often combining multiple conditions with logical AND. Of 29 VPN and circumvention tool signatures logged in the VPN Signature File Update Log (March–November 2024), 21 carry risk level 5 (the maximum), indicating aggressive prioritization of blocking major tools including ExpressVPN, NordVPN, Tor Browser, and Psiphon.

2026-ablove-technical-analysis-geedge §4.1, §4.1.2, Table 3, Table 4 dpitls-fingerprinttraffic-shapeip-blockingsni-blocking