During the 2026 Iranian internet shutdown, nearly all IP addresses were fully blocked; a small subset of Cloudflare IPs completed TCP three-way handshakes (SYN-ACK returned) but DPI terminated sessions before any data transfer, confirming that the primary enforcement mechanism was payload-level DPI rather than IP-layer blocking alone.

For non-whitelisted SNIs connecting to allowed Cloudflare IPs, Iran's DPI enforced a strict 6-packet limit per connection, sufficient only to load a webpage but not to sustain any tunnel; connections bearing a whitelisted SNI were unrestricted. Outside DNS providers were blocked within one to two weeks and replaced with a local DNS infrastructure that operated at a maximum of ~100 KB/s with connections dropping at approximately the one-minute mark.

Issue body deployment

Iran implemented a per-connection packet quota tied to SNI whitelisting: connections whose SNI was not on the approved list were classified as 'grey' and hard-limited to exactly 6 packets before DPI terminated the session. Connections presenting a whitelisted SNI were passed without a packet cap.

Issue body (SNI whitelisting paragraph) detection

DNS tunneling operated for 'at most a week or two' before Iran blocked all external DNS resolvers and forced traffic to local DNS providers. The local DNS infrastructure was effectively unusable as a tunneling substrate: maximum throughput was ~100 kb/s and connections were reliably severed around the 1-minute mark.

Issue body (DNS paragraph) evaluation

After approximately four days, Iran placed Cloudflare IP ranges behind a NAT that performed full TCP reassembly with strict checksum and sequence-number validation; any packet with an incorrect checksum or out-of-window sequence number caused immediate connection teardown, eliminating both TTL-spoofing and sequence-desynchronization bypasses.

Issue body deployment

During full Iranian blackouts, WebRTC and all UDP/QUIC traffic were completely blocked. DNS-over-QUIC (DoQ) could complete a handshake but the censor severed the connection after a single post-handshake data packet, rendering it unusable for tunneling.

Issue body (WebRTC/UDP paragraph) detection

Two TCP-layer SNI-spoofing techniques briefly circumvented Iran's DPI for approximately four days: (1) sending a fake ClientHello with a TTL too low to reach the server but high enough to pass the censor, and (2) sending a fake ClientHello at a future TCP sequence number that the server would ignore but the stateless DPI would accept. Both were defeated once Iran placed Cloudflare IPs behind a stateful NAT that validated checksums and sequence numbers. Iran's SNI whitelist permitted only specific domains, hcaptcha.com among them.

Issue body (SNI spoofing methods paragraph) defense

The June 2025 Iran shutdown—carried out during the Iran-Israel war beginning ~June 19—did not use BGP route withdrawals as in 2019. Instead, authorities applied service-level restrictions at the national border: DNS poisoning of foreign destinations, protocol whitelisting permitting only pre-approved domestic services, and DPI to block circumvention-tool traffic. Iran's international traffic fell roughly 90% while the country's BGP routes remained advertised, making the shutdown invisible to BGP-based monitoring systems. OONI measurement volume, which totalled 121,333 in June 2025, collapsed to under 200 submissions on June 19-20.

2025-iran-shutdown-measurement Executive Summary / §2 dpidns-poisoningport-blockingip-blocking

LetsVPN (快连) announced termination of China mainland operations on April 28, 2026, stating the team had attempted adjustments 'almost every hour' for 20 days before concluding the connectivity problem was unsolvable. A follow-up announcement on May 8 declared 'resumption of global standard operations' but explicitly stated it could not guarantee China mainland availability.

2026-anon-2026-27-vpn §3 (快连 / LetsVPN section) ip-blockingdpi

Russia's Roskomnadzor confirmed in February 2026 that it had blocked 469 VPN services used to bypass censorship. Starting December 2025, Russia began blocking the three most commonly used VPN protocols, and from 2025 onward began imposing penalties for promoting VPN services.

2026-anon-2026-27-vpn §5 (Human Rights Watch section) port-blockingdpiip-blocking

In April 2026, Russia nearly completely blocked Telegram, reducing availability without VPN to 5% during the first ten days; Russia's VPN user base was estimated at no less than 40% of the population. Beginning in mid-April, over 20 major Russian websites and platforms (including Gosuslugi, Ozon, Yandex, Sberbank, VK) began restricting access for VPN users, and Russia introduced a whitelist-based service model permitting only state-approved services under certain network restriction states.

2026-anon-2026-27-vpn §4 (俄罗斯 Telegram / OSW section) ip-blockingdpithrottling

LetsVPN's exit is described as part of a broader pattern: a wave of 'airport' (proxy subscription service) outages across multiple providers in April 2026, documented in a companion article titled '2026年四月份各大机场断线详解,' indicating coordinated or systematic GFW blocking affecting the circumvention ecosystem broadly during this period.

2026-anon-letsvpn-vpn §协议写死，特征太明显 (reference to companion article) dpitls-fingerprintip-blocking

The article documents that large-scale 'one-click' commercial VPN providers with static protocol stacks have become effectively non-viable in China, while subscription-based proxy node services using open-source clients (Clash, Shadowrocket) with server-side rapid IP and datacenter switching demonstrate substantially greater resilience to GFW blocking waves.

2026-anon-letsvpn-vpn §为啥傻瓜式一键VPN越来越难活 & §应该怎么选替代方案 dpitls-fingerprintip-blocking