National Blocking Patterns: How Countries Try to Filter Tor
When Russian internet providers began cutting off Tor on 1 December 2021, it looked like routine housekeeping on a national blocklist. Within a week, Roskomnadzor had blacklisted torproject.org itself. The episode became a textbook case of how states attack anonymity networks, and of why such attacks so rarely finish the job.
The censor's toolkit
Governments that target Tor rely on layers rather than a single switch. Relays and directory authorities get blacklisted by IP, domains are poisoned or seized, and traffic is inspected for protocol fingerprints. Researchers documented this full spectrum back in 2013, from crude address lists to hybrid systems pairing deep packet inspection with active probing (Winter and Lindskog, FOCI 2013). Each layer catches different users. IP blacklists are cheap and blunt, while DPI demands expensive hardware and careful engineering.Deep packet inspection reads the handshake
DPI examines traffic patterns instead of just addresses. Measurements from inside China show DPI boxes recognizing signatures in Tor's TLS handshake almost immediately after a client connects, then flagging the destination for follow-up action (Winter et al., How China Is Blocking Tor). A connection does not need to complete before it is condemned. Pluggable transports such as obfs4 respond by disguising traffic as random bytes. Censors have adapted by developing heuristics that target fully encrypted protocols in general, not Tor alone.Active probing hunts the bridges
Bridges were designed to be unfindable, because they never appear in the public consensus. China answered with active scanners that probe suspected addresses using multiple protocols; if a server answers like Tor, its IP is quickly blacklisted (Dunna, O'Brien and Gill, FOCI 2018). The same study found blocked relays typically stay blacklisted for about twelve hours before being re-scanned. That rhythm matters enormously. A bridge that briefly stops speaking Tor can quietly return to service.Russia 2021: an incomplete block
Russia's move was more conventional. From 1 December 2021, several major ISPs began IP-blocking Tor infrastructure, and Reuters reported the regulator's claim that the service enabled access to illegal content (Reuters). Days later, torproject.org itself entered the official registry."We will need many more bridges to keep Russians online," the Tor Project wrote as the block spread.OONI data showed the block was patchy: of more than 65 tested networks, only around 15 showed clear signs of Tor blocking, and direct connections kept working elsewhere (OONI). Default obfs4 and Snowflake bridges failed on some ISPs though, which pushed Russian users toward private, unlisted bridges (Tor Project).
Iran's recurring waves
Iran has blocked Tor repeatedly since at least 2012, with each wave of unrest bringing tighter filtering. OONI measurements found Iranian networks blocking the bridges portal and Tor Project subdomains even while some individual bridges still connected (OONI, 2017). The cycle repeats: protest, user surge, protocol-level blocks, then adaptation as new transports arrive. During the 2022 protests over Mahsa Amini's death, daily Iranian Tor users spiked into the hundreds of thousands before filtering largely caught up.What actually works
No state has eliminated Tor outright, and the reasons are instructive.- Private, unlisted bridges defeat IP blacklists until their addresses leak.
- Snowflake scatters entry points across rotating volunteer IPs, making lists pointless.
- WebTunnel wraps traffic in ordinary-looking HTTPS, blunting both DPI and probing.