Internet Censorship in Iran

Iran can do something most censors cannot: turn international connectivity off for almost the entire country. That capability changes the problem. A protocol that evades deep packet inspection is useful during filtering. It is irrelevant when the border path has been removed and the domestic network is all that remains.

The system is more centralized than Russia’s. The state-linked carriers and international gateways are the main chokepoints, while the National Information Network (NIN) keeps domestic services running during a cutoff. Around that core, Iran layers DNS poisoning, hostname filtering, protocol whitelisting, traffic shaping and a tiered access model that gives approved users a cleaner path.

The useful question is still which layer is stopping the connection. A shutdown, a DNS lie, a TLS reset, a UDP restriction and a slow path all look like “the internet is down” to a user. They require different responses.

Current situation#

Iran’s filtering is built around central gateways and a domestic network. The National Information Network (NIN) is a separate domestic network that keeps local banking, government services and many domestic platforms reachable even when international connectivity is cut. When authorities order a shutdown, international traffic can fall to near zero while the NIN remains available. During the 88-day shutdown that began on 28 February, VOA reported that NetBlocks measured national connectivity at roughly 1% of pre-war levels.

The first near-total shutdown began on 8 January during nationwide protests and lasted about three weeks. Service returned unevenly before a second cutoff began on 28 February after US and Israeli strikes. That second shutdown lasted 88 days, or more than 2,000 hours. It was the longest nationwide internet shutdown recorded at the time.

Restoration began on 26 May, but it did not return the network to its pre-January state. Cloudflare measured traffic at 40% of pre-shutdown levels on 27 May. It later peaked near 90% before settling around 59%. FilterWatch argued that capacity figures overstated the recovery: users were connected, but per-device traffic was at its lowest level on record, with artificial latency, unstable TCP, severe UDP restrictions and widespread DNS tampering.

That pattern is the important technical shift. A shutdown is visible as a cliff. The current model is a partial reopening that preserves control through shaping and filtering. The connection exists, but it carries much less useful traffic, and only some destinations work.

A second layer is legal and commercial. The state permits a tiered service, sold as Internet Pro, that routes approved users through less restricted international gateways. It is gateway-based whitelisting tied to white SIM cards and a verification process, not a VPN. There is no user-configurable encryption or tunnel: approved accounts are exempted at the gateway level. The rest of the population faces the filtered path and a black market for tunnels.

Known techniques#

DNS poisoning is the oldest visible layer. Blocked names have historically resolved to 10.10.34.34, an address that serves a block page. A 2025 measurement study of Iran’s address space found 6.8 million IPs affected by DNS poisoning or HTTP blockpage injection and 5.4 million affected by UDP-based disruption. The same study found blanket blocking of entire top-level domains, which overblocked many unrelated sites. To test for DNS interference, check whether a domain resolves to 10.10.34.34 or a known block page rather than assuming a tunnel failure.

TLS filtering is the selective layer. The ClientHello carries the server name in cleartext unless Encrypted Client Hello is in use, and ECH is not a dependable assumption on a filtered network. A middlebox can read the name and reset the connection before content arrives. This is how specific platforms can fail while the rest of the internet remains reachable.

The protocol whitelist is a separate design. A 2020 USENIX study documented a filter that allowed DNS, HTTP and HTTPS while disrupting other protocols. The exact list changes, but the design has the same effect: a tunnel that does not look like an allowed protocol is easier to block than one that does.

UDP is the current weak point for many modern tools. FilterWatch’s June 2026 measurements found severe UDP restrictions and unstable TCP connections after the partial reopening. QUIC runs over UDP, and so do Hysteria2 and many real-time applications. A network that throttles UDP can leave TCP browsing working while making a QUIC-based tunnel unusable.

Traffic shaping is harder to notice than a block. Artificial latency and packet loss degrade a connection without producing a reset. The result is a tunnel that connects but cannot carry a video call or a large download. Official confirmation came on 13 October, when a government spokesperson said agencies sometimes reduce internet speed because of wartime conditions.

The tiered model is the newest layer. White SIM cards and Internet Pro route approved users through gateways with little or no filtering, while ordinary subscribers remain on the restricted path. This is not a technical bypass that anyone can configure. It is an access tier granted through an institution or an application process.

Satellite access sits outside the terrestrial path, and Iran treats it as a security problem. Al Jazeera reported in October that authorities use multiple jammers, spoofed GPS signals, protocol identification and physical patrols against Starlink terminals. Using or possessing a terminal carries a baseline sentence of six months to two years, with longer terms for import and distribution.

Recent events#

8 January 2026. A nationwide shutdown began during protests. Traffic fell to near zero, and the domestic network remained available for approved services. Service returned unevenly later in January before the second shutdown.

28 February 2026. A second, longer cutoff began after US and Israeli strikes. It lasted 88 days and more than 2,000 hours. Cloudflare and NetBlocks recorded near-total loss of international connectivity.

10 May 2026. CNN reported that Internet Pro and white SIM cards were providing a two-tier system. Approved users could reach the global internet through less restricted gateways while ordinary users remained filtered. The programme had been sold through MCI since February.

26 May 2026. Restoration began. Cloudflare measured traffic at 40% of pre-shutdown levels the next day, later peaking near 90% and settling around 59%. FilterWatch reported that actual international traffic was about 60% of the pre-January level by 28 May, with throttling and filtering still in place.

26 August 2026. A new draft Cyberspace Regulation Plan was presented to lawmakers. RFE/RL reported that it would give the Supreme Cyberspace Council control of internet gateways, require ISPs to authenticate users, require foreign platforms to have a physical presence in Iran, and allow fines or licence revocation. The draft omits the earlier bill’s criminalisation of VPN use, but it was not law as of this update.

13 October 2026. A government spokesperson confirmed that some agencies occasionally reduce internet speed, citing wartime conditions. The statement followed weeks of user reports about slow international connections.

14 October 2026. Al Jazeera reported that Iran was escalating its campaign against Starlink, including jamming, GPS spoofing and terminal seizures. Officials described satellite internet as a tool of war and signalled support for a wider tiered-access model.

23 October 2026. MCI and Irancell raised mobile internet, call and SMS tariffs by up to 40%. Irancell also raised fixed internet and fibre prices by the same amount. The increase took effect at midnight, and packages bought before the change keep their original prices until expiry.

Effects on users#

The first distinction is shutdown versus filtering. During a national shutdown, the international path is gone. A VPN, proxy or alternate protocol cannot create a route that the border does not carry. Domestic services on the NIN may still work, which makes the failure look selective rather than total. Test NIN vs global separately to tell them apart.

The second is the layer of filtering. A poisoned DNS answer can be bypassed with encrypted DNS or remote resolution, but the TLS handshake still exposes the destination. An SNI reset can be avoided with a camouflaged tunnel, but a protocol whitelist or UDP restriction can remove the transport. A tunnel that connects is not proof that the path is usable.

The third is throughput. Iran’s post-restoration network can accept connections while making them too slow for video, file transfer or many interactive services. A client may show “connected” while pages time out. Testing a speed test or a large download is more informative than checking the tunnel indicator. Reported percentages differ between sources because some measure capacity while others measure actual per-device traffic.

The fourth is tiered access. A white SIM or Internet Pro account can reach international services that an ordinary SIM cannot. This is gateway-based whitelisting, not a user-configurable VPN. It creates a false impression that the network is working normally for everyone. A configuration that works for one person may fail for another on the same street because the access tier is different.

The fifth is platform-side blocking. Even without a wholesale shutdown, specific platforms can be blocked or disrupted via DNS, SNI or IP filtering. A working tunnel may still fail against a service that refuses VPN traffic or behaves differently, or the platform itself may be filtered on the domestic path.

The sixth is installation and payment friction. App availability, SMS verification, payment methods and rising costs (including the October 2026 tariff increases) can block access to VPN clients or top-ups even if the network path exists. A client installed before travel, with configurations saved offline, is far more useful than a download link that depends on the filtered network.

The seventh is legal risk. Starlink is illegal, and possession or use carries prison sentences. The current draft would require ISPs to authenticate users and foreign platforms to maintain a physical presence in Iran, while an earlier bill would have criminalised VPN use. Technical workarounds do not remove legal exposure.

Relevant protocols#

OpenVPN and WireGuard are poor choices against a protocol whitelist. Both have recognisable handshakes and packet formats, and neither is designed to look like ordinary HTTPS. Obfuscation can change the signature, but it does not change the endpoint address or the fact that a long-lived tunnel carries the traffic.

Shadowsocks and VMess add obfuscation and are widely used in Iran. They can pass some DPI, but a classifier that watches packet sizes, timing and entropy can still separate them from normal browsing. A working client today can fail after a rule update.

VLESS with REALITY addresses SNI filtering and naive probing. VLESS adds no inner TLS layer, and REALITY borrows the handshake of a real site, so a probe sees a genuine certificate. It does not hide the endpoint address, the volume of traffic or the fact that a shutdown has removed the path. The cover site also has to be reachable from the filtered network, which is not guaranteed.

Hysteria2 runs over QUIC and can perform well on lossy links, but Iran’s UDP restrictions make it a fragile default. A TCP-based TLS transport is slower but more likely to survive a network that throttles UDP. The practical answer is usually a TCP fallback, not a single QUIC-only configuration.

Maronix keeps improving its server configuration and setup against these findings, testing deployments on restricted networks and changing the details that stop working instead of treating one reachable setup as permanent.

Practical considerations#

• Install the client and save configurations before you travel. A shutdown can remove access to download pages, app stores, account recovery and payment flows.
• Keep more than one transport and more than one endpoint. A TCP/TLS option and a UDP option cover different failure modes.
• Test UDP separately. A tunnel that works over TCP may fail over QUIC or Hysteria2 when the network throttles UDP.
• Test the actual services you need, not just the tunnel handshake. A connection can open and still be too slow, platform-blocked or filtered to use.
• Check whether a name resolves to 10.10.34.34 or a block page. That identifies DNS interference before you change the tunnel.
• Test the SIM or access tier you will actually use. A white SIM and an ordinary mobile account do not share the same path; Internet Pro is gateway-based whitelisting, not a user VPN.
• Test mobile data and Wi-Fi separately. Behaviour can differ by operator and access tier.
• Test NIN vs global separately. If domestic sites work but global ones don’t, that’s a shutdown/whitelisting boundary, not a broken tunnel.
• Separate throttling from shutdown. A slow connection may mean shaping; no international connectivity means the border path is closed and no client protocol can restore it.
• Treat Starlink as a legal and physical-risk decision, not a normal fallback. Terminals are illegal, jammed and actively searched for.
• Expect shutdowns and friction. App-store access, SMS verification and payments can fail even between shutdowns. This page describes network behaviour, not legal advice.

Atlas articles#

• How Often Do Countries Shut Down the Internet? - shutdowns as a separate layer from filtering
• What Is Internet Censorship? - the five layers behind DNS, SNI and protocol blocking
• What Is Deep Packet Inspection? - how middleboxes classify encrypted traffic
• Why a VPN Can Work Today and Fail Tomorrow - address, protocol, probe and path failures
• What Makes a VPN Resistant to Censorship? - protocol, address, provider, placement, probing and operations
• What Is VLESS? - the proxy core used inside REALITY
• What Is REALITY? - borrowed handshakes and probe resistance
• What Is Hysteria2? - QUIC transport and its trade-offs

Last reviewed October 31, 2026. This article was revised after publication. Corrections and additions are welcome.