VPN Technology and Providers

A Virtual Private Network (VPN) is a fundamental tool for digital privacy and censorship circumvention, particularly in restrictive environments like Iran. By extending your local network through an encrypted tunnel to a server in a different location, a VPN hides your traffic from your Internet Service Provider (ISP) and masks your IP address from the websites you visit.

How VPNs Work

Normally, when you connect to the internet, your traffic flows from your device to your ISP, and then to the destination server. Your ISP can see which domains you request, and the destination server sees your IP address (which reveals your approximate physical location and identity).

A VPN introduces an intermediary server:

1. Encryption: Your device encrypts your data before it leaves your network.
2. Tunneling: This encrypted data passes through your ISP (who only sees indecipherable data going to a VPN server).
3. Decryption & Forwarding: The VPN server decrypts your data and forwards it to the internet.
4. Return Path: The process is reversed for incoming data.

Privacy vs. Anonymity

It is crucial to understand the distinction between privacy and anonymity:

• Privacy: A VPN protects your data from being snooped on by your ISP or local network spies (e.g., on public Wi-Fi). It shifts the trust from your ISP to the VPN provider.
• Anonymity: A VPN does not make you anonymous. The VPN provider knows your real IP address. If you require high-level anonymity (e.g., to hide from a state actor with subpoena power over the VPN), you should use Tor.

Use Cases for Iranian Users

1. Censorship Circumvention

The primary use case in Iran is bypassing the "Great Firewall." By routing traffic to a server in a country with free internet, users can access blocked services like Telegram, Twitter/X, and YouTube.

Warning: Standard VPN protocols (OpenVPN, WireGuard) are often blocked by Deep Packet Inspection (DPI) in Iran. You typically need Obfuscation (Stealth) technologies to disguise VPN traffic as regular HTTPS traffic.

2. Protection from Surveillance

Iranian ISPs monitor user activity and log metadata. A VPN encrypts this traffic, preventing the ISP from seeing which sites you visit or intercepting unencrypted communications.

3. Public Wi-Fi Security

When using untrusted networks (cafes, airports), a VPN prevents attackers on the same network from intercepting your data (Man-in-the-Middle attacks).

Risks and Limitations

Trusting the Provider

Using a VPN means you are trusting the provider with all your internet traffic. A malicious or compromised VPN provider can log your activity, inject ads, or sell your data.

• "No Logs" Claims: Many providers claim "no logs" but cannot prove it. Look for providers with independent security audits and court-proven histories.
• Ownership: Avoid VPNs owned by opaque companies or those based in jurisdictions that cooperate with the Iranian regime.

The "Free VPN" Trap

Avoid free VPN services. Running a VPN infrastructure costs money. If the service is free, they are likely monetizing by:

• Selling your browsing data to advertisers.
• Injecting malware or tracking cookies.
• Acting as a honeypot for surveillance.

Critical Warning: Never use domestic Iranian VPNs (often sold with "legal" permits). These are state-controlled and provide zero privacy; they merely act as a monitored gateway to the internet.

Selection Criteria

When choosing a VPN for use in Iran, prioritize the following:

1. Jurisdiction: The company should be based in a privacy-friendly country (e.g., Switzerland, Sweden, Iceland) outside the "14 Eyes" intelligence-sharing alliance.
2. Proven No-Logs Policy: The provider must not store connection timestamps, IP addresses, or traffic logs. Ideally, this should be verified by third-party audits.
3. Obfuscation (Stealth): Essential for bypassing DPI. Look for features like Shadowsocks, V2Ray, Obfsproxy, or proprietary "Stealth" modes.
4. Payment Methods: Support for anonymous payments (Cash, Monero) is preferable to protect your financial identity.
5. Kill Switch: A feature that cuts your internet connection if the VPN drops, preventing your real IP from leaking.

Recommended Providers

Based on privacy audits, transparency, and resistance to censorship, we recommend the following providers. Note that the situation in Iran is fluid; a provider working today may be blocked tomorrow.

1. Mullvad VPN

• Jurisdiction: Sweden.
• Privacy: No email required (account number only). Accepts Cash and Monero.
• Censorship Resistance:
  • Supports Shadowsocks and V2Ray bridges (via app settings) to bypass blocking.
  • UDP-over-TCP obfuscation.
• Pros: Highly transparent, flat pricing, strong audit history.
• Cons: Port forwarding recently removed (affects some P2P).

2. IVPN

• Jurisdiction: Gibraltar.
• Privacy: No email required. Accepts Cash and Monero.
• Censorship Resistance:
  • V2Ray obfuscation integrated into clients.
  • VMess over QUIC/TCP to mimic regular web traffic.
• Pros: Open-source apps, regular audits, ethical marketing.
• Cons: Higher price point, no free tier.

3. Proton VPN

• Jurisdiction: Switzerland.
• Privacy: Strong legal protections. Free tier available (limited speed/servers).
• Censorship Resistance:
  • Stealth Protocol: Encapsulates traffic in TLS to look like generic HTTPS.
  • Alternative Routing: App finds unblocked paths to login servers.
• Pros: Easy to use, trusted developer (creators of Proton Mail), free version is usable for basic access.
• Cons: Premium required for full speeds and features.

Technical Configuration for Safety

Protocols

• WireGuard: Modern, fast, and secure. However, its distinct traffic fingerprint is easily blocked in Iran. Use it only inside an obfuscated tunnel (e.g., Shadowsocks).
• OpenVPN (TCP): Slower but harder to distinguish from regular HTTPS traffic, especially on port 443.
• Stealth/Obfuscated: Always enable this in Iran to avoid DPI blocking.

Kill Switch

Always enable the Kill Switch (or "Block connections without VPN") in your settings. This ensures that if the VPN disconnects momentarily, your real Iranian IP address is not exposed to the website or service you are using.

DNS Leak Protection

Ensure your VPN client handles all DNS requests. If your DNS requests leak outside the tunnel, your ISP can see exactly what websites you are visiting, even if the content is encrypted. You can test for leaks at dnsleaktest.com.

Advanced: VPN + Tor

For maximum anonymity (e.g., whistleblowing), you can combine VPN and Tor.

• Recommended: Connect to VPN first, then open Tor Browser (VPN -> Tor).
  • Benefit: Your ISP sees only VPN traffic (hiding the fact that you are using Tor). Tor sees only the VPN IP (hiding your real IP from the Tor entry node).
• Not Recommended: Connecting to Tor first, then VPN. This provides little benefit and compromises Tor's anonymity protections.

Summary Checklist