Filtering has several layers

Opening a site takes several steps in a row: your device asks DNS for the site’s address, connects to that IP, sends the site’s name at the start of the encrypted connection, and then asks for the page. Filtering can interfere at any of these steps, and one site may be blocked at several layers at once.

• DNS tampering: the provider’s DNS server answers with an internal address such as 10.10.34.34, 10.10.34.35 or 10.10.34.36, which serves the filter page, instead of the site’s real address.
• SNI-based blocking: at the start of an HTTPS connection the site name is usually sent unencrypted. The provider’s equipment reads it and drops or resets the connection, even when you have the right address.
• IP blocking: connections to the site’s address itself are refused or go unanswered, whatever name you send.
• Throttling: the site opens, but so slowly or unreliably that it is useless in practice. This layer is harder to see in a single test than the others.

What helps against each layer

Each tool only works on its own layer, which is why changing DNS sometimes fixes access and sometimes does nothing.

• Against DNS tampering: an encrypted resolver (DoH or DoT) stops the answer being changed on the way, but does nothing about SNI or IP blocking.
• Against SNI reading: ECH encrypts the site name at the start of the connection. It only works when both the browser and the site (or its CDN) support it, and because its key arrives through DNS, it cannot start when the DNS answer is tampered with, which is why browsers use it together with encrypted DNS. Providers can also block ECH itself.
• Against IP blocking: only routing the traffic through another server helps, that is a VPN or a proxy. Those can be blocked too.

Is my site filtered? (for site owners)

1. Enter the site on CheckNet’s “Is it blocked?” page. By default it is checked from probes inside Iran and outside it.
2. Look at each network’s DNS answer. An address from 10.10.34.34 to 10.10.34.36 means the domain is filtered at the DNS layer.
3. If CheckNet says Globalping refused the HTTP check because the address is private (“Private IP ranges are not allowed”), that network’s DNS returned an internal address: the same DNS tampering.
4. If DNS is correct but the connection is refused or reset, SNI or IP blocking is likely. A redirect to the block page settles it.
5. Compare with the results from outside the country. If the site fails there too, the problem is the site itself, not filtering.
6. Read the OONI section: volunteers tested the same site over the last 30 days from home and mobile connections, which is closer to what ordinary users see.

Results can differ between operators (MCI, Irancell, Rightel, data centres such as ArvanCloud) and from one day to the next. Check several times and from several networks, and do not treat one result as final.

Why CheckNet can differ from your phone

Globalping probes mostly run in data centres, and data-centre connections are not always filtered the same way as home or mobile internet; sometimes less strictly, sometimes more. That is why the OONI measurements sit next to the Globalping results. If the two disagree, filtering probably differs by network type or operator.