During Iran's June 2025 shutdown, early reports indicated TCP connections were broadly blocked while UDP-based proxies (Telegram MTProto over UDP) could still establish sessions, suggesting the initial blocking rule targeted TCP at the transport layer rather than applying protocol-agnostic packet filtering.

Iranian censors actively detected and blocked circumvention proxies in real time during the June 2025 shutdown: MTProto proxies, v2ray tunnels (VLESS and VMESS variants), and Tor bridges using both Snowflake and obfs4 all experienced mixed or degraded success as proxies were identified and blocked.

Abstract / community testing thread detection

The June 2025 Iran shutdown lasted 10 days (June 17–26) and generated real-time community measurement via IODA and crowdsourced circumvention testing, establishing this event as primary-source documentation of simultaneous carrier-level BGP suppression and application-layer proxy blocking—a dual-layer shutdown strategy distinct from typical content-level filtering.

Issue metadata / abstract evaluation

Iran implemented a near-complete internet shutdown from June 17–26, 2025 using selective IP-based whitelisting: api.github.com and api.google.com remained accessible while the general internet was blocked. IODA measurements confirmed that ASes 44244 (IranCell) and 57218 (RighTel)—the two largest mobile carriers—were nearly unreachable for the duration.

Issue body / abstract deployment

The June 2025 Iran shutdown—carried out during the Iran-Israel war beginning ~June 19—did not use BGP route withdrawals as in 2019. Instead, authorities applied service-level restrictions at the national border: DNS poisoning of foreign destinations, protocol whitelisting permitting only pre-approved domestic services, and DPI to block circumvention-tool traffic. Iran's international traffic fell roughly 90% while the country's BGP routes remained advertised, making the shutdown invisible to BGP-based monitoring systems. OONI measurement volume, which totalled 121,333 in June 2025, collapsed to under 200 submissions on June 19-20.

2025-iran-shutdown-measurement Executive Summary / §2 dpidns-poisoningport-blockingip-blocking

During the June 2025 shutdown, Iranian authorities blocked international One-Time Password (OTP) SMS delivery, preventing new sign-ins to foreign secure-messaging platforms and VPN services. This forced users toward government-approved domestic platforms that lack security and privacy protections. The blockade of OTPs effectively weaponized account-recovery flows as a secondary shutdown layer, disproportionately affecting users who needed to activate new circumvention tools during the crisis.

2025-iran-shutdown-measurement §Human Rights Implications port-blockingdpikeyword-filtering

Russia's Roskomnadzor confirmed in February 2026 that it had blocked 469 VPN services used to bypass censorship. Starting December 2025, Russia began blocking the three most commonly used VPN protocols, and from 2025 onward began imposing penalties for promoting VPN services.

2026-anon-2026-27-vpn §5 (Human Rights Watch section) port-blockingdpiip-blocking

Russia's TSPU devices began dropping all international QUIC traffic on approximately February 26, 2022, coinciding with the full-scale invasion of Ukraine. The filter identified QUIC flows by requiring the first UDP packet destined to port 443 to be at least 1001 bytes and contain the 4-byte QUIC version 1 header (0x00000001); QUIC traffic from Russia to Cloudflare dropped 46% within days. The TSPU maintained 420-second state on the 4-tuple and applied residual censorship to all subsequent packets.

2026-heitmann-russia-s-early-introduction §2.2 http3-quic-blockdpiport-blocking

Iranian DPI exhibits stateful connection tracking with 'cooling-off' enforcement periods on flagged flows and is synchronized across multiple ISPs, suggesting centralized or coordinated blocking infrastructure. Port 443 receives particularly aggressive inspection, and the DPI performs behavioral analysis of upload/download traffic ratios to identify proxy usage, enabling SSH-based proxy server IPs to be fully blocked within 8 hours.

2026-pooribitwise-iran-advanced-dpi Issue body and thread summary (Jun 10, 2026) dpiport-blockingtraffic-shapeml-classifier

VPN search demand in Iran spiked approximately 707% during the June 2025 stealth blackout, as measured by Top10VPN analytics, making it one of the highest-documented circumvention-demand spikes associated with a single shutdown event. Despite this demand, many VPN connections failed because the protocol whitelist eliminated non-HTTPS tunneling methods and HTTP-level filters could detect known VPN signatures on port 443.

2025-aryapour-stealth-blackout §1, §5 dpiport-blockingtraffic-shape