Iran's censorship infrastructure employs IP-list blocking of major media CDNs (Instagram, YouTube, Facebook) that remains effective against VLESS+TLS users on domestic VPS endpoints. Telegram's accessibility—because it is reachable directly by IP without domain resolution—confirms that the IP blocklist targets CDN address ranges specifically rather than applying blanket traffic inspection.

Community analysis of the Iran VLESS+TLS failure identified DNS poisoning as a primary root cause: domain-based resolution for services like Instagram, YouTube, and Facebook was disrupted even when traffic transited a VLESS+TLS tunnel from a domestic VPS, bypassing the transport-layer obfuscation entirely.

Issue thread (abstract) detection

This primary-source community report documents that Iran's censorship is multi-layered: VLESS+TLS successfully evades transport-protocol detection but is defeated simultaneously by DNS poisoning and CDN IP-list blocking. A circumvention tool that addresses only one layer (transport obfuscation) is insufficient for consistent access in Iran.

Issue thread (abstract) evaluation

Iran's censorship against VLESS+TLS users on domestic VPS infrastructure is selective by destination type: Telegram, which is accessed by IP, remained reachable, while Instagram, YouTube, and Facebook were blocked or partially inaccessible. This indicates blocking operates at the destination-IP/domain layer independently of the transport protocol.

Issue thread (abstract) detection

Configuring client-side DNS settings within V2rayNG resolves the DNS poisoning component of Iran's multi-layer censorship when using VLESS+TLS from a domestic VPS. This workaround routes DNS queries through the tunnel rather than the local, poisoned resolver, restoring domain resolution for blocked services.

Issue thread (abstract) defense

The June 2025 Iran shutdown—carried out during the Iran-Israel war beginning ~June 19—did not use BGP route withdrawals as in 2019. Instead, authorities applied service-level restrictions at the national border: DNS poisoning of foreign destinations, protocol whitelisting permitting only pre-approved domestic services, and DPI to block circumvention-tool traffic. Iran's international traffic fell roughly 90% while the country's BGP routes remained advertised, making the shutdown invisible to BGP-based monitoring systems. OONI measurement volume, which totalled 121,333 in June 2025, collapsed to under 200 submissions on June 19-20.

2025-iran-shutdown-measurement Executive Summary / §2 dpidns-poisoningport-blockingip-blocking

TSG's Context-Based Detector (CBD) evaluates circumvention tool signatures across JA3/JA4 TLS fingerprints, SSL certificate issuer fields, UDP payload length, first-packet byte patterns, server IP ranges, and FQDN matches, often combining multiple conditions with logical AND. Of 29 VPN and circumvention tool signatures logged in the VPN Signature File Update Log (March–November 2024), 21 carry risk level 5 (the maximum), indicating aggressive prioritization of blocking major tools including ExpressVPN, NordVPN, Tor Browser, and Psiphon.

2026-ablove-technical-analysis-geedge §4.1, §4.1.2, Table 3, Table 4 dpitls-fingerprinttraffic-shapeip-blockingsni-blocking

Internal Jira tickets reveal that Psiphon lacked obvious protocol signatures, forcing censors to fall back to IP-based blocking of Psiphon3 client IPs combined with a 'whitelist protection mechanism' that allows traffic when the destination SNI matches a popular domain—an explicit collateral-damage tradeoff documented in the Confluence file 'GTN498 The collateral damage analysis of Psiphon3 Blocking.' A ticket from the Ethiopia (E21) deployment shows customers complaining that the VPN deny policy inadvertently blocked non-VPN applications.

2026-ablove-technical-analysis-geedge §4.1.2, Figure 2, Figure 3 ip-blockingsni-blocking

IPv6 does not inherently worsen fingerprinting privacy: dual-stack complete sites are measurably harder to fingerprint via IPv6 (45%) than IPv4 (56%), contrary to community fears. The key driver is not the protocol but hosting provider behavior—Cloudflare, Google, and Fastly co-locate large clusters of domains behind a small set of shared IPv6 addresses, creating structured similarity clusters that reduce classifier separability, while Amazon allocates domains across vast unique IPv6 prefixes, increasing fingerprintability.

2026-ahmad-more-space-less §7.1, §6.1, §6.2 website-fingerprintip-blocking

Across three testers all on MTS, whitelist behavior varied by network segment in ways that could not be explained by protocol configuration alone; the operator has zero confirmed data for MegaFon, Beeline, or T2 under whitelist conditions. The open question of whether whitelist policy (site+IP list) is centrally issued by the Ministry of Digital Development while implementation differs per carrier remains unresolved, making cross-carrier generalization of any circumvention finding unreliable.

2026-amigocarra-bypassing-russian-federation-s Issue body — questions 1 and 2 ip-blockingsni-blocking

During apparent whitelist-activation periods on MTS mobile LTE, the affected user experienced a complete network blackout in which even explicitly whitelisted resources (gosuslugi.ru) were inaccessible — behavior inconsistent with a standard default-deny CIDR+SNI whitelist, which should pass approved destinations unconditionally. The operator concludes this may represent a stricter enforcement variant, a SIM-specific restriction, or a mechanism entirely separate from the documented whitelist architecture.

2026-amigocarra-bypassing-russian-federation-s Issue body — main mystery paragraph ip-blockingsni-blocking