Unlike the Great Firewall of China, Iran's SNI-triggered blocking produces no residual interference: after a TCP RST caused by a sensitive SNI, subsequent connections from the same source IP using benign or randomly generated SNIs proceed normally without additional disruption. This behavior was observed consistently before and after the May 26, 2026 partial restoration.

Iran's source-IP allowlist severely restricted outbound access before the May 26, 2026 partial restoration: only ~0.017% (~2,000 of 11,766,454 spoofed Iranian IPs) could reach destinations outside Iran. After restoration, reachable IPs increased nearly fourfold to ~0.07% (~8,000), with most newly reachable addresses originating from Noyan Abr Arvan Co. (ASN 202468), indicating expansion rather than removal of the allowlist.

§4.1.1 evaluation

Before the May 26 restoration, Iran's inbound allowlist granted near-full access (100%) to university ASes (e.g., Shahid Beheshti University AS56765, Iran University of Medical Sciences AS47981) while major residential ISPs had <2% pass rates, demonstrating that the Iranian allowlist enforces differentiated access by institution type rather than a uniform policy. Additionally, roughly half of allowlisted IPs experienced no SNI filtering at all, while the other half faced domain-specific RSTs, suggesting non-uniform application-layer policies even among privileged addresses.

§4.1.2 and §4.2 deployment

Inbound access to Iran remains heavily restricted even after the May 26 restoration: only ~2.8% of tested global /24 blocks (~400,000 of 14,461,944 representative IPs) could reach the Iran vantage point, compared to over 70% for comparable hosts outside Iran — more than 25× lower reachability — demonstrating that Iran enforces allowlist-based destination-IP filtering on inbound traffic as well as outbound.

§4.1.3 evaluation

Iran layers SNI-based domain blocking on top of its IP allowlist: even source IPs permitted by the allowlist trigger TCP RSTs when a TLS ClientHello contains a sensitive SNI value. Randomly generated, non-existent domain names pass through without triggering resets, confirming the blocking operates as a domain-name blocklist rather than a generic TLS fingerprinting rule. Blocking behavior was highly consistent, with 97.4% of (source IP, SNI) pairs producing identical outcomes across three test repetitions.

§4.2 detection

Iran's SNI filtering is applied inconsistently across allowlisted users: among 737 tested allowlisted IP addresses, approximately half experienced no SNI filtering at all and could reach destinations even using previously-reported blocked domains. For IPs subject to filtering, 49.9% of requests containing hrw.org and 50.2% containing tiktok.com triggered RSTs, while only 0.5% of requests with youtube.com were blocked — suggesting differential access policies tied to specific domains and user classes even within the allowlisted population.

§4.2 detection

As of June 2026, Iranian DPI blocking timescales are: CDN-fronted VLESS+WebSocket domains blocked within 24 hours; SSH dynamic port forwarding server IPs blocked within 8 hours; Reality and WireGuard connections blocked immediately (seconds) after handshake completion. This graduated timeline suggests separate fast-path (handshake-pattern) and slow-path (domain reputation / traffic accumulation) detection pipelines operating in parallel.

2026-pooribitwise-iran-advanced-dpi Issue body — combined observations dpisni-blockingip-blockingrst-injectiondns-poisoning

Iran's censor deploys a two-stage blocking response within 24 hours of domain exposure: DNS hijacking that resolves blocked domains to 10.10.34.34, combined with RST floods when clients connect directly to Cloudflare IPs using the blocked SNI. Both mechanisms activate independently, so DNS-resistant clients are still terminated at the TCP layer.

2026-pooribitwise-iran-advanced-dpi Issue body — The Issue dns-poisoningrst-injectionsni-blocking

TLS connections to blocked services (instagram.com, telegram.org) were terminated by TCP RST immediately after the client's ClientHello, before any certificate exchange, confirming SNI-based DPI that reads the plaintext SNI extension and aborts the handshake. HTTP filtering additionally matched Host headers and URL keywords case-sensitively, with injected HTTP 403 pages or TCP RST responses, and case-change evasions were sometimes effective.

2025-aryapour-stealth-blackout §4.2, §4.3 sni-blockingdpirst-injectionkeyword-filtering

Neither China nor Iran directly block ECH ClientHello messages; instead both effectively prevent ECH by censoring encrypted DNS resolvers. China blocks Cloudflare's DoH/DoT resolver (mozilla.cloudflare-dns.com) via SNI-based blocking in TLS and QUIC, causing residual censorship of up to 360 and 180 seconds respectively. Iran blocks both Cloudflare and NextDNS DoH hostnames via DNS block-page injection, TLS TCP RST, and HTTP block pages. Iran cannot analyze QUIC, so DoQ is uncensored and enables ECH in Iran. China's NextDNS IP blackholing affected only one of two resolved IPs, leaving an uncensored path.

2025-niere-encrypted §5, Table 1, Figure 5 dns-poisoningsni-blockingrst-injectionhttp3-quic-block

TSPU devices perform in-line packet manipulation — they can inject RST packets, drop traffic, and throttle connections — rather than routing traffic to an out-of-band sniffer that votes to block. The inline placement means TSPU can act on the first-packet payload and impose latency on all matching flows, not only on those selected by sampling. Blocking decisions are therefore applied with high recall at the ISP edge, and circumvention tools that rely on short observation windows (e.g. only obfuscating the first N bytes) are vulnerable to continued inline inspection of subsequent traffic.

2024-xue-tspu-russia §3–§4 dpirst-injectionthrottlingsni-blocking

Censored Planet measurements of psiphon.ca in AS6697 (Belarus) around the August 2020 Internet shutdown showed that Psiphon was initially blocked via connection timeouts during the shutdown itself, and then—several weeks after the shutdown ended—the censorship mechanism shifted to TCP RST injection. Outcome-typed measurement data made this two-phase mechanism change immediately visible without re-collecting any raw data.

2023-raman-advancing §4.3 rst-injectionsni-blocking