Iran's censor deploys a two-stage blocking response within 24 hours of domain exposure: DNS hijacking that resolves blocked domains to 10.10.34.34, combined with RST floods when clients connect directly to Cloudflare IPs using the blocked SNI. Both mechanisms activate independently, so DNS-resistant clients are still terminated at the TCP layer.

As of June 2026, Iranian DPI blocking timescales are: CDN-fronted VLESS+WebSocket domains blocked within 24 hours; SSH dynamic port forwarding server IPs blocked within 8 hours; Reality and WireGuard connections blocked immediately (seconds) after handshake completion. This graduated timeline suggests separate fast-path (handshake-pattern) and slow-path (domain reputation / traffic accumulation) detection pipelines operating in parallel.

Issue body — combined observations evaluation

Iran's DPI blocks VLESS/WS traffic routed through Cloudflare CDN in full-strict TLS mode with regularly rotated clean Cloudflare IPs, demonstrating that CDN-fronted traffic is not opaque to the censor and that IP-layer evasion (using clean CDN IPs) is insufficient when the SNI is fingerprinted.

Description detection

Iran's DPI infrastructure performs full TCP reassembly and stateful inspection on the fly, nullifying TCP fragmentation (10–30 byte fragments with 10–20ms delays) applied to VLESS+WebSocket behind Cloudflare CDN in full-strict mode. Domains are blocked within 24 hours despite the CDN layer and rotation of clean Cloudflare IPs. Fragmentation was applied to the first 5 packets and verified correct on the client side with tcpdump; the setup used port 443 with a randomized WebSocket path.

Issue body — Description / The Issue detection

The Reality protocol triggers immediate RST flood responses from Iranian ISP infrastructure at the completion of the TLS handshake, suggesting Iranian DPI has developed a fingerprint or active-probe response specifically targeting Reality's TLS handshake forwarding mechanism as of June 2026.

Issue body — Other Observations §2 detection

Domains on VLESS+WebSocket behind Cloudflare are blocked in Iran even when they have no configured DNS A record and the root domain was never used — indicating Iran blocklists domain names extracted from SNI in reassembled TCP streams rather than requiring prior DNS query evidence.

Issue body — The Issue detection

Iranian DPI exhibits stateful connection tracking with 'cooling-off' enforcement periods on flagged flows and is synchronized across multiple ISPs, suggesting centralized or coordinated blocking infrastructure. Port 443 receives particularly aggressive inspection, and the DPI performs behavioral analysis of upload/download traffic ratios to identify proxy usage, enabling SSH-based proxy server IPs to be fully blocked within 8 hours.

Issue body and thread summary (Jun 10, 2026) detection

Community members propose a two-hop architecture as a potential mitigation for Iran's current DPI upgrade: a first-hop server inside Iran's whitelisted datacenter ranges (where outbound traffic faces lighter inspection) proxying to a foreign exit node, with Reality masquerading as a legitimate Iranian organization's domain. The architecture's effectiveness under active TCP reassembly and handshake probing is explicitly unverified.

Issue body — Description defense

WireGuard connections are blackholed by Iranian infrastructure immediately after the initial WireGuard handshake completes — clients stop receiving server packets — indicating the Iranian DPI identifies WireGuard by its distinct UDP handshake pattern and applies IP-level blocking at that point.

Issue body — Other Observations §3 detection

Neither China nor Iran directly block ECH ClientHello messages; instead both effectively prevent ECH by censoring encrypted DNS resolvers. China blocks Cloudflare's DoH/DoT resolver (mozilla.cloudflare-dns.com) via SNI-based blocking in TLS and QUIC, causing residual censorship of up to 360 and 180 seconds respectively. Iran blocks both Cloudflare and NextDNS DoH hostnames via DNS block-page injection, TLS TCP RST, and HTTP block pages. Iran cannot analyze QUIC, so DoQ is uncensored and enables ECH in Iran. China's NextDNS IP blackholing affected only one of two resolved IPs, leaving an uncensored path.

2025-niere-encrypted §5, Table 1, Figure 5 dns-poisoningsni-blockingrst-injectionhttp3-quic-block

Over one month, 54K measurements from 1.7K ASes in 164 countries detected I2P blocking in exactly five countries: China (DNS poisoning of homepage and 3 of 10 reseed servers), Iran (TCP RST injection with HTTP 403 on mirror site), Oman and Qatar (SNI-based blocking of HTTPS homepage plus TCP injection with block-page redirect on HTTP mirror), and Kuwait (TCP injection on mirror site at AS47589 only). All other tested countries left I2P fully reachable.

2019-hoang-measuring §5, Table 2 dns-poisoningsni-blockingrst-injectionpacket-injection

Article 19 documents that Iran's National Information Network (NIN / SHOMA) was designed with explicit reference to China's Great Firewall as a model, with institutional mirroring: Iran's Supreme Council of Cyberspace parallels China's Cyberspace Administration of China, and both governments share a "cyber sovereignty" doctrine used to justify domestic content controls and cross-border technology transfer. The report frames Iran's filtering infrastructure as deliberately architected to replicate GFW capabilities, not as an independently developed system.

2026-article19-tightening-the-net §2, §3 dpisni-blockingdns-poisoningip-blockingbgp-hijackthrottling

CensorLess vanilla mode costs $0.27/month for a single proxy processing 6.76 GB of traffic monthly, a 97.1% reduction (34.4×) over SpotProxy's optimal single-NIC configuration ($9.28/month). The private mode, which adds a t4g.micro EC2 VPS for end-to-end encryption via SOCKS, costs $3.41/month — still 63.3% cheaper than SpotProxy's cheapest option. Costs remain below $3.50/day even when scaling to 300 proxies.

2026-kang-censorless-serverless §6.3, Figure 6 ip-blockingsni-blockingdns-poisoning

All major browsers (Firefox, Chromium) issue an unencrypted DNS-over-UDP query to resolve their configured DoH resolver's domain before initiating any encrypted DNS session. In Iran, nearly all tested DoH resolver domains are directly censored at the DNS layer (returning block-page IPs), which renders browser-native encrypted DNS ineffective regardless of whether the underlying encrypted protocol would otherwise succeed. Additionally, browsers always include the SNI extension in TLS handshakes with DNS resolvers even though no tested resolver requires it. The bootstrap query resolves the DoH server's own domain (for example doh.opendns.com) in cleartext, so an in-path censor can poison it before any encrypted session exists.

2026-lange-towards §7 dns-poisoningsni-blocking

DPYProxy-DNS's automated probe-and-select mode identified a working DNS circumvention in an average of 13.78 seconds (median 12.90s) in China and 12.32 seconds (median 8.28s) in Iran across 100 runs each; best-case startup was 0.32s (China) and 0.47s (Iran) when the first-tried combination succeeded, while worst-case exceeded 30.72s in China and 58.16s in Iran due to the slow Last Response mode (3s fixed wait per attempt) being selected early in the randomized probe order.

2026-lange-towards §6.3 dns-poisoningsni-blockingip-blocking