Nym report on Iran's recent Internet blackouts (June 2025)

In light of the recent attacks on Iran, many community members have been asking whether NymVPN currently works in Iran. This report is an effort from Nym’s censorship resistance team to clarify Nym’s diagnoses the status of Internet connectivity in Iran which has been affecting tens of millions of people, why NymVPN may not work there currently, and what we’re doing to address it.

Context: Internet blackouts in Iran

In the past week, Iran has experienced some of the most significant Internet blackouts since 2019 following military strikes on their territory and retaliatory strikes in the region. These Internet outages have affected millions of users across the country and made it extremely difficult to access global internet services, especially through mobile networks. In what follows, we summarize what the Nym team has analyzed about the Internet access in Iran, how the authorities are enforcing these shutdowns, and importantly, what methods of circumvention still have a chance of working going forward.

Why the Iran internet shutdown matters

Internet shutdowns are not new in Iran: similar tactics were used during major protests in 2009, 2013, 2019, and continue till today. But what’s happening now shows that the Iranian government has become more sophisticated by combining IP-based blocking, protocol filtering, bandwidth throttling, and targeted network outages in a flexible and reactive way.

Doug Madory (also on Bluesky) on Twitter / X

What happened? (Beginning 17 June 2025)

Major mobile and fixed-line networks in Iran began going completely offline or restricting connections to domestic-only traffic. This includes many of the country’s largest consumer internet providers:

• MCI Traffic from AS197207

• Irancell (MTN) Traffic from AS44244

• Aria Shatel Traffic from AS31549

• Iran Telecom (TCI) Traffic from AS58224

The outages have been reported across major cities like Tehran, Shiraz, Mashhad, and likely others.

This pattern of blackouts appears to coincide with significant security incidents inside the country. But regardless of the reasons, the technical impact is severe and widespread.

How is the blackout being enforced?

The infrastructure of Iranian censorship infrastructure is believed to be implemented in multiple layers:

• DPI boxes installed and managed by the ISPs themselves by mandate. These are usually purchased independently an so are less consistent in terms of DPI strategies.

• DPI boxes installed at large ISPs which are administrated by a "central command" in the Communication Regulatory Authority. The ISPs have reportedly little to no insight or interaction with these other than ensuring they are installed.

• DPI boxes installed at the internet exchange points, especially Tehran IX. This allows censorship measures to be applied to traffic transiting networks internal to the country (i.e., domestic traffic) even if they never interact with the international network links.

• DPI boxes in the few internationally linked networks. If you look at a map of the BGP associations of networks in Iran, almost everything funnels through AS48159 – Telecommunications Infrastructure Company (TIC)

From the technical side, the shutdowns are being implemented using a combination of aggressive measures:

IP blocking of hosting providers

Popular VPS providers commonly used for hosting VPNs — including Hetzner, DigitalOcean, Linode, and others — have had large portions of their IP space blocked. There seem to be small exceptions to this for critical infrastructure that is hosted on international cloud infrastructure.

"The usual" SNI and DNS blocking

The existing infrastructure was leveraged to apply extended block-lists of online services.

Protocol-level blocking

Almost all UDP-based protocols have been disabled across major networks. This includes:

• WireGuard and AmneziaWG

• QUIC

• WebRTC

• OpenVPN

The only notable exception is UDP port 53, used for DNS (Domain Name System) queries. As seen in previous shutdowns, this is likely intentional to avoid breaking internal network dependencies.

Connection throttling

Even when connections are possible, bandwidth is being severely throttled, making services slow or unreliable.

Targeted shutdowns of data centers

Entire networks and data centers have been taken offline at times, sometimes for hours.

Frequent Mobile Blackouts

Mobile networks, including MCI and Irancell, have gone fully offline or domestic-only multiple times over the last few days, often in response to specific events.

What was working?

As of 19–21 June 2025

In a more advanced state of concern, the country went to the most extreme “offline“ state that we have seen, very closely resembling the 2019 shutdowns. Consumer access to the international internet was effectively cut:

• users only had access to services hosted in domestic data centers;

• and both mobile and fixed line networks effectively shut all links to international networks with a few exceptions.

DNS

In most networks international DNS traffic was still allowed as DNS is a complex system that can cause cascading failures. It seems that disabling this protocol was more risky than others from a functional standpoint so access was left open.

Google search

According to reports, some limited access to google search remained available as the government intended for citizens to access domestic Internet. However, they seemed to understand that users don’t access the Internet via domain names, but rather by service discovery on search engines (which helps to avoid issues like phishing).

As of 21–25 June 2025

Censorship returned to a state similar to the 17–28 June where mobile networks still saw significantly reduced access in both protocols and bandwidth. Meanwhile, fixed line networks improved in access with direct protocols like SSH and websockets. This is presumably to get domestic data centers back into full operational capacity.

What is working now? (As of 25 June 2025)

Many networks have returned to the state of blocking that they presented before the initial attacks on Jun 17, 2025 meaning that while many sites / services are blocked by DPI mechanisms VPNs with decent circumvention capabilities are working in significantly restored capacity. It also seems that the extra throttling has been reduced / removed. Some sites / services have been named by the government as receiving continued / heightened attention (i.e. whatsapp) which may be removed in time.

What can you do?

While reliable circumvention is hard during blackouts of this scale, here are a few general tips:

• Find satellite connectivity: Tools that access satellite internet like Starlink and Toosheh

• Try peer-to-peer networks: Tools like Matrix and Delta Chat that had pre-existing deployments / user-bases in IR in place before blocking started and relied only on domestic infrastructure (i.e. no APIs hosted in international servers) reportedly worked even through severe periods of disconnection.

• Diversify your tools: Don’t rely on a single VPN or app. Use a mix, but expect that many will stop working at times.

• Look for trusted circumvention projects: Projects like Psiphon or other specialized VPNs often share updated connection methods during blackouts.

Stay informed, but be cautious: Follow technical communities or trusted groups for updates, but always be mindful of your security and privacy.

So does NymVPN work in Iran?

The Nym team has seen a 387% increase in demand for NymVPN since the start of hostilities. But does NymVPN work in Iran?

Unfortunately, NymVPN was caught by protocol level restrictions making it unreliable as a circumvention tool in this instance.

While NymVPN works well as an anonymity tool at the moment (and we are working to improve the resistance to network censorship), the protocol level blocking that most networks enabled early on prevented NymVPN from functioning as a reliable circumvention tool.

We are currently implementing countermeasures in our circumvention road-map in preparation for events like this. Unfortunately that engineering work takes time and the features necessary were not ready for this blocking event.

This underlines the importance of integrating those censorship resistance features and we are working to progress that time-line to help users stay connected while keeping them as private as possible.

Stay safe, stay informed. If you have updated technical information to share, please contribute to trusted communities working on censorship circumvention.