I got side tracked for the last 3 days to assess the Great Firewall of Iran (GFI).

TL;DR
The Internet is easily censored. The neo-liberals got their arses kicked. The big players like Google/Apple/AWS are partly to blame. China runs the GFI as a service.

The GFI uses Deep Packet Inspection (DPI) on all international peering points. In addition the local operators (telco & DSL) use their own Firewall but most of them are static and badly configured. Some use DPI.

The GFI is port number agnostic and changing the port number of a service will not yield success.

The GFI consists of three parts:

1. All blacklisted domains resolve to 10.0.34.35
2. An active component constantly scans Iran's internal network for 'hostile' services (like open Socks5 proxies).
3. IP addresses are rarely fully blocked. Instead, the TCP 3-way handshake won't complete (the syn-ack is dropped).

The GFI seems to operate differently almost every day - from severe disruption to barely any disruption.

The most severe disruption is when the regime turns off all cell towers and all local Internet. They just pull the plug and it's game over for any neo-liberal smart-arse that thinks V2ray/Tor/Shadowsocks is the solution.

All Free Internet is blocked from all Mobile Phones and DSL connections between 4pm and 12pm (it's OFF). During these hours only VPSs inside of Iran can (sometimes) access the Free Internet. There are V2Ray/Shadowsocks/etc relays on VPSs inside of Iran. They last hours or a few days before getting blocked by the GFI (and then taken down by the local VPS provider).

At the moment the Free Internet is mostly only accessible to geeks and those who can tunnel out using various protocols and tricks. Those geeks are the least concerned (but a bravado for their enthusiasm).

The worst affected are the ordinary citizens. The GFI blocks them effectively. Many people (and mostly women) depend on the Free Internet for work. The illegal regime of Iran uses the GFI as a form of blackmail - to run them out of money (and by that out of their independency).

On bad days:

• Tor is blocked (since day 1).
• Wireguard/OpenVpn is blocked (since day 1)
• V2ray/Vmess/Shadowsocks/... are either permanently blocked or blocked as soon as the IP Address of the EXIT node becomes known.
• The DPI blocks on TLS's cleartext SNI.
• Any outbound traffic is blocked after 1k-4k is transmitted upstream.
• Any website that offers VPN solutions is blocked (ProtonVPN, Mullvad, NordVPN, ..). Those who already had the software before the GFI can not use the software (most apps require to register an account or make an API call to a WebRTC - which is blocked).
• Cloudflare is blocked (including DoH/DoT/DoQ).
• Docker is sometimes blocked.
• Google Play and App Store are blocked.
• Some operators use a whitelist and block all other websites.

The most blocking local operator is IR-MCI (aka HamrahAvval). They seem to be regime lovers.

The users of Iran can not get to the software that would help them to circumvent the GFI. This is mostly a failing of Google/Apple and the big players: It is no longer (easily) possible to copy software from one device to another (or when the network is down).

China is involved. Connecting to any random port number from the outside world on any server inside of Iran (passing the GFI) is almost always followed by a port probe on that specific port from an IP address belonging to China.

The filtering on TLS by SNI is embarrassing. TLS is not secure until the SNI is encrypted. I was there at the IETF-88 (9 years ago) and part of the TLS-Working group when Eric Rescorla famously said that encrypted SNI is no priority and that the big players like Google/Apple/Facebook/AWS all want speed (lower RTT) over security. We tried hard to convince the players but got shut down.

The GFI extends to SMS and OTP. The users (if they get Internet) can not log in to their accounts or sign up to new services (WhatsApp/Signal/VPN/..): Many services rely on 2FA by SMS/OTP. Those SMS/OTP messages are dropped by the Mobile Operators. 2FA becomes a DoS. Checkmate.

Recommendation:

1. The big players (Google/Apple) to implement a feature that allows users to share apps with friends (via Bluetooth) when the network is down.
2. VPN Providers to make their apps work when above mentioned restrictions are in place.
3. A mesh-like networking method is needed (using local wifi or Bluetooth) when the main network goes down.
4. Encrypted SNI needs to happen without fallback to non-encrypted SNI.
5. Exemption from sanctions to get Starlink and other equipment into the country.
6. "How to stage a rebellion effectively" should be part of the school's syllabus. In the decades to come the knowledge to rebel against oppression and tyranny will be more useful to our children than knowing about Nietzsche or why Bonobo Apes are so happy.
7. Does China breach sanctions by providing the GFI as a service?
8. Iran signed the Universal Declaration of Human Rights. May the UN comment on why Iran is allowed to disregard it and what that means for the integrity of the UN if members can pick and choose at will.

Thank you to all the courageous people of Iran who provided me with access to various servers and DSL systems. You are the true heroes.

Stay safe and read our IT Security and Privacy for the rebellions around the world.

THC operates a variety of EXIT nodes and Proxy Services in Iran. We need help. Join us on Telegram.

Addition: After writing this article I got asked about the most reliable way to circumvent the GFI. A relay host inside of Iran is needed (Iran-Relay) and an EXIT node outside of Iran (EU-EXIT). The Iran-User and the EU-EXIT node both need to connect TO the Iran-Relay (connecting from the Iran-Relay TO EU-EXIT is sometimes blocked). Iran-User and EU-EXIT "meet" at the Iran-Relay. Iran-User TO Iran-Relay traffic needs to be obfuscated (v2ray/shadowsocks/ssh is effective). EU-EXIT to Iran-Relay needs to be less obfuscate (SSH works just fine). No software needs to run on the Iran-Relay to give Iran-Relay admin plausible deniability. No IP must be logged. This is the setup that THC is providing.