SNI spoofing — sending a whitelisted domain (e.g., yandex.ru) in the ClientHello while connecting to a non-whitelisted IP — did not bypass the block: any SNI value worked when connecting to a whitelisted IP, but no SNI value worked when connecting to a non-whitelisted VPS IP. This confirms the enforcement is IP-based rather than SNI-based, and SNI spoofing provides no circumvention value in this regime.

Non-whitelisted DNS resolvers — including 1.1.1.1, 9.9.9.9, and Yandex DNS — were blocked with ICMP also blocked, while Beeline's own UDP DNS and Google's 8.8.8.8 remained accessible and non-hijacked (verified via Akamai WHOIS). This selective resolver blocking constrains which DNS infrastructure circumvention tools can use for bootstrap.

Issue body (its0ka, Sep 7 2025) detection

Beeline mobile users in certain Russian regions observed complete IP-based whitelisting: non-whitelisted IPs were unreachable at the ICMP level (traceroutes returned empty), TCP SYN packets were delivered but TLS ClientHello was silently dropped, and any domain resolving to a non-whitelisted IP was inaccessible regardless of SNI value. Only a curated set of IPs (primarily .gov.ru domains plus selected commercial sites) remained reachable.

Issue body (its0ka, Sep 7 2025) deployment

The whitelist enforcement drops TLS ClientHello packets to non-whitelisted destination IPs while still accepting the TCP SYN, meaning the block occurs at or after the TCP handshake completes but before application-layer data is processed. This behavior is consistent with TSPU-level in-path interception rather than BGP null-routing.

Issue body (its0ka, Sep 7 2025) detection

Stunnel tunneling achieved temporary circumvention before being blocked, and the enforcement was observed consistently across Beeline and Tele2 in affected regions, suggesting centralized TSPU-level implementation rather than per-ISP configuration. The whitelist appeared in September 2025 following a period of mobile-network shutdowns in some Russian regions or cities.

Comments (Ximerixx, someone2037492034, Sep 2025) deployment

Article 19 documents that Iran's National Information Network (NIN / SHOMA) was designed with explicit reference to China's Great Firewall as a model, with institutional mirroring: Iran's Supreme Council of Cyberspace parallels China's Cyberspace Administration of China, and both governments share a "cyber sovereignty" doctrine used to justify domestic content controls and cross-border technology transfer. The report frames Iran's filtering infrastructure as deliberately architected to replicate GFW capabilities, not as an independently developed system.

2026-article19-tightening-the-net §2, §3 dpisni-blockingdns-poisoningip-blockingbgp-hijackthrottling

CensorLess vanilla mode costs $0.27/month for a single proxy processing 6.76 GB of traffic monthly, a 97.1% reduction (34.4×) over SpotProxy's optimal single-NIC configuration ($9.28/month). The private mode, which adds a t4g.micro EC2 VPS for end-to-end encryption via SOCKS, costs $3.41/month — still 63.3% cheaper than SpotProxy's cheapest option. Costs remain below $3.50/day even when scaling to 300 proxies.

2026-kang-censorless-serverless §6.3, Figure 6 ip-blockingsni-blockingdns-poisoning

DPYProxy-DNS's automated probe-and-select mode identified a working DNS circumvention in an average of 13.78 seconds (median 12.90s) in China and 12.32 seconds (median 8.28s) in Iran across 100 runs each; best-case startup was 0.32s (China) and 0.47s (Iran) when the first-tried combination succeeded, while worst-case exceeded 30.72s in China and 58.16s in Iran due to the slow Last Response mode (3s fixed wait per attempt) being selected early in the randomized probe order.

2026-lange-towards §6.3 dns-poisoningsni-blockingip-blocking

DNS censorship of encrypted protocols is inconsistent in both China and Iran. In China, Yandex resolvers are censored only when the SNI extension is present; omitting SNI bypasses censorship for these resolvers. In Iran, DoH requires SNI omission for Quad9, Google, Adguard, CleanBrowsing, and NextDNS resolvers, but works with SNI for Yandex and Cisco resolvers. These inconsistencies suggest resolvers have been accidentally missed by censors, highlighting the value of automated tools that trial all resolver-mode combinations rather than hard-coding a single strategy. The support evaluation found 47 resolvers supporting DoH, 16 supporting DoH3, and only 8 supporting DoQ out of ~65 tested.

2026-lange-towards §6.2, Table 2 dns-poisoningsni-blockingip-blocking

DPYProxy-DNS tested 8 circumvention modes against DNS censorship from vantage points in Iran (AS201295, Mashhad) and China (AS4837, China Unicom). In Iran, DoQ was entirely uncensored even with the SNI extension present; DoH3 worked for all Cloudflare and NextDNS resolvers. Iran's censor operates in-path (not on-path like the GFW), making the "Last Response" mode (wait 3s for the last UDP reply) ineffective in Iran but highly effective in China. Auto-mode averaged 12.32s (median 8.28s) in Iran and 13.78s (median 12.90s) in China to discover a working combination. Most DoT and DoH resolvers also work once the SNI extension is omitted. Because Iran's censor is in-path rather than on-path, the GFW-style last-response technique fails entirely there: the original query never reaches the real resolver.

2026-lange-towards §6.2, §6.3 dns-poisoningsni-blockingip-blocking

Before the May 26 restoration, Iran's inbound allowlist granted near-full access (100%) to university ASes (e.g., Shahid Beheshti University AS56765, Iran University of Medical Sciences AS47981) while major residential ISPs had <2% pass rates, demonstrating that the Iranian allowlist enforces differentiated access by institution type rather than a uniform policy. Additionally, roughly half of allowlisted IPs experienced no SNI filtering at all, while the other half faced domain-specific RSTs, suggesting non-uniform application-layer policies even among privileged addresses.

2026-lunarcanvas-swift-look-into §4.1.2 and §4.2 ip-blockingsni-blocking