VPN for Iran: what works when VPNs are filtered

Iran filters traffic centrally, at the national gateways and inside provider networks. What users run into:

• Blocking by name and address. DNS answers are tampered with, TLS connections are blocked by the site name they announce, and addresses of known VPN servers are blocked.
• Protocol recognition. Common VPN protocols such as OpenVPN and WireGuard are identified and blocked or slowed.
• UDP and QUIC trouble. UDP-based traffic is often degraded, so UDP transports can fail even when web browsing works.
• Shutdowns. During unrest, connections abroad have been cut or heavily limited for days while domestic services kept working.

How strict the filter is changes over time and between mobile and fixed networks. No transport works in every situation, which is why ProofKit gives you several and makes switching between them cheap.

1. VLESS Reality on a direct route. The connection looks like an HTTPS visit to a well-known website, and a server that is probed without the right key answers like that website.
2. XHTTP, if Reality connects but gets cut after a while. It sends the same traffic as many ordinary-looking web requests.
3. Another exit, if one server stops answering. Each exit is a separate server with its own address.
4. Hysteria2, only if UDP works on your network. It is fast on lossy links, but where UDP is blocked it will not connect.
5. olcRTC, as an extra option to test. It works only while the video service it rides is reachable from your network.

A 2-hop route starts at an entry node inside the country and continues abroad over a tunnel between two nodes. It helps where connections abroad are throttled but domestic ones are not, and only when the entry node really is inside your country.

Routes from Iran are direct unless an entry node inside Iran is listed in the marketplace, which shows the entry countries for every exit.

Direct routes carry every transport the exit offers and cost only the exit’s price plus the 20% network fee. olcRTC traffic is the exception: from 20 November 2026 it has one network-wide price per GB, read when the traffic moves.

olcRTC carries your traffic inside a video call on a major video-conferencing service, so an observer sees a call rather than a VPN connection. The exit node joins the same call and sends your traffic to the internet from its own address. It carries UDP, so calls and games work, but it is slower than the other transports.

Whether it helps from Iran depends on whether that video service is reachable from your network at the time. Treat it as an option to test, not as the answer. It needs an olcRTC-capable client, such as the open-source Ghostlane. How olcRTC works.

1. Create an account with an email address, or open the ProofKit bot in Telegram. A TON wallet is only needed to add funds.
2. Top up with TON from your wallet with TonConnect, or send a transfer to the escrow contract with the comment deposit from the wallet linked to your account.
3. Connect to an exit in the marketplace. Every connection becomes a server line in your app, and a line costs nothing until traffic flows through it.
4. Add your subscription link to your app once; it keeps the list up to date. In the dashboard, set Transports in subscription to All: the list for Happ, Hiddify and V2RayNG starts with Reality only. App guides: Hiddify, V2RayNG, help center.

• An exit’s address gets blocked. Switch to another exit; the marketplace lists each one with its uptime.
• UDP is blocked. Hysteria2 will not connect; use Reality or XHTTP, which run over TCP.
• Connections abroad are cut. During a full international shutdown no VPN works, ProofKit included.
• Your balance reaches zero. Sessions close automatically; top up and your lines work again.

Rules on VPN use differ by country and change often. Check what applies where you are.