Russia's TSPU devices switched from broad QUIC blocking to SNI-dependent QUIC censorship between May 2022 and July 2023—at least nine months before the GFW introduced SNI-based QUIC censorship, which was previously considered the first of its kind. This transition was discussed only on Russian-language forums (ntc.party) and went unnoticed by the international research community for approximately three years.

Russia's TSPU devices began dropping all international QUIC traffic on approximately February 26, 2022, coinciding with the full-scale invasion of Ukraine. The filter identified QUIC flows by requiring the first UDP packet destined to port 443 to be at least 1001 bytes and contain the 4-byte QUIC version 1 header (0x00000001); QUIC traffic from Russia to Cloudflare dropped 46% within days. The TSPU maintained 420-second state on the 4-tuple and applied residual censorship to all subsequent packets.

§2.2 detection

Testing the Tranco Top 100k domain list from Russian vantage points shows that all 2,644 domains blocked over TLS SNI are also blocked over QUIC SNI, and domains accessible via TLS are accessible via QUIC—indicating the TSPU maintains a unified SNI blocklist across protocols. Additionally, 31 domain patterns including discord.com exhibit 'residual clearance': QUIC connections to those domains are not censored when immediately preceded by non-censored data on the same 4-tuple; 22 domains are only blocked on port 443.

§3, Table 3 evaluation

Reproducing Zohaib et al.'s 10-payload QUIC parser test suite against Russian TSPU devices reveals that the Russian QUIC parser differs meaningfully from the GFW: payload 8 (PING and PADDING frames inserted before the Crypto frame), which circumvents the GFW, does not bypass Russian censorship. Payload 10 (QUICv2) bypasses both censors. Payload 9 (ECH with outer SNI cloudflare-ech.com) is blocked by Russia; payload 3 (version bytes 0x00000002 with invalid MAC) is blocked by both.

Appendix B, Table 2 evaluation

As measured from three Russian vantage points in March–April 2026, TSPU devices decrypt QUIC Initial packets, locate the SNI extension in the embedded TLS handshake, and drop packets with forbidden domains plus all subsequent packets on the 4-tuple for 420 seconds (timer resets on each packet). Censorship is unidirectional (outgoing only), covers all destination ports up to 65535 at Saint Petersburg and Novosibirsk (Moscow exempts 22% of system ports 1–1023), and targets only QUICv1—QUICv2 passes uncensored at all vantage points.

§3 detection

QUICstep successfully circumvents the GFW's QUIC SNI censorship (active since April 2024) in live testing. Using an Alibaba VM in mainland China as client and an AWS instance in North Virginia as server, a native QUIC client was blocked after several fetches of youtube.com SNI, while QUICstep consistently succeeded across 50 consecutive fetches. 7 tiktokcdn.com subdomains that were QUIC-SNI blocked were also reliably accessible via QUICstep. The approach routes only QUIC long-header (handshake) packets through a WireGuard tunnel; all subsequent short-header (data) packets travel the native path.

2026-lee-quicstep §4.3.2, §3.2.3 http3-quic-blocksni-blockingdpi

In April 2024 the GFW began decrypting QUIC Initial packets at scale and blocking connections by domain rather than by IP address, targeting the exact transport layer that modern moving-target circumvention systems rely on for session continuity. Because blocking a registrable domain costs the censor essentially zero collateral (unlike blocking a hyperscaler IP range), the censor's optimal Stackelberg budget split allocates f* = 0.97 of its discovery budget to the domain channel once the defender runs n ≥ 2 endpoints (§8.10, Figure 7). GFWatch measurements show hundreds of thousands of domains persistently blocked.

2026-maiti-block-a-mole-sustainability-frontier §1, §3, §6, §8.10, Figure 7 http3-quic-blockdpisni-blocking

Neither China nor Iran directly block ECH ClientHello messages; instead both effectively prevent ECH by censoring encrypted DNS resolvers. China blocks Cloudflare's DoH/DoT resolver (mozilla.cloudflare-dns.com) via SNI-based blocking in TLS and QUIC, causing residual censorship of up to 360 and 180 seconds respectively. Iran blocks both Cloudflare and NextDNS DoH hostnames via DNS block-page injection, TLS TCP RST, and HTTP block pages. Iran cannot analyze QUIC, so DoQ is uncensored and enables ECH in Iran. China's NextDNS IP blackholing affected only one of two resolved IPs, leaving an uncensored path.

2025-niere-encrypted §5, Table 1, Figure 5 dns-poisoningsni-blockingrst-injectionhttp3-quic-block

Since April 7, 2024, the GFW decrypts every QUIC client Initial packet at China's national border and blocks connections whose TLS ClientHello SNI matches a QUIC-specific blocklist. Blocking takes the form of dropping all subsequent UDP packets sharing the same (src-IP, dst-IP, dst-port) 3-tuple for 180 seconds—with no RST injection. The GFW applies a source-port heuristic: packets with src-port ≤ dst-port are not inspected, capturing >92% of real QUIC client Initials while processing only ~30% of all UDP traffic. The QUIC blocklist contains 58,207 unique FQDNs (Tranco, Oct 2024– Jan 2025), approximately 60% of the DNS blocklist in size; 33% of blocked FQDNs do not actually support QUIC, suggesting the list was derived from an existing domain-name blocklist rather than live QUIC service discovery.

2025-zohaib-quic-sni §3 / §3.1 / §3.3 / §4 http3-quic-blockdpisni-blocking

Russia's TSPU ("Средства противодействия угрозам") system is deployed inline at individual ISP edges rather than at centralized internet exchange points, producing substantial per-ISP heterogeneity: some providers apply layer-7 SNI/Host filtering while others rely primarily on IP-prefix blocklists, and QUIC/HTTP3 is blocked at several major providers. Rollout timing and enforcement depth vary measurably across autonomous systems, meaning a single "Russia passes/fails" test fixture systematically underestimates blocking coverage.

2024-xue-tspu-russia §4–§5 sni-blockingdpihttp3-quic-blockip-blocking

In China (AS45090), HTTP/3 over QUIC has a lower overall failure rate (27.1%) than HTTPS over TCP (37.3%), but hosts that time out during the TCP handshake (TCP-hs-to, indicating IP blocking) always also fail over QUIC — while hosts blocked via TLS-hs-to or conn-reset (SNI-based methods) nearly always succeed over QUIC.

2021-elmenhorst-web §5.1, Table 1, Figure 3a ip-blockingsni-blockinghttp3-quic-block