I have pretty definitive proof that Iran is doing ip-and-port based filtering of SSL.

Filtering is being done by eg 217.218.154.250. This hop is after my source's ISP. The filtering IPs are owned by ITC, Iran's central telco. It's http://bgp.he.net/AS12880 (h/t to Tor team for that).

Filtering targets all google.com IPs, some but not all torproject.org IPs, probably more. Haven't attempted a broad scan. It's a simple connection drop; filtered connections just time out.

It is not based on SSL handshake signature; testing SSL on nonstandard ports worked successfully, and testing non-SSL on :443 of target IPs was blocked.

I'm not sharing screencaps in order to protect my source, but tests included TCP traceroutes on different IP/port combinations and some simple use of curl.


ETA 2/10: Further testing done. Conclusions:

1. IP-and-port filtering for some IPs
2. SSL protocol filtering on standard ports for targeted IPs / sites
3. No request header filtering
4. Some IPs / sites NOT SSL protocol or port filtered!
5. All Tor filtered, even unpublished proxies

I'm not going to openly publish what went through to prevent it getting blacklisted and useless for testing, but it was a full normal https://something:443 connection, green lock w/ verified serial # and all.


ETA2 2/11: SSL to previously working site now down. SSL to internal Iranian site up. Don't yet know why on either.

obfsproxy is working successfully from inside Iran and enabling full Tor access.

Install: https://www.torproject.org/projects/obfsproxy

List of bridge relays being distributed privately. Not public to prevent relay IPs getting blacklisted, but contact me or anyone on the tor dev team to get a copy.

Help censored users: https://lists.torproject.org/pipermail/tor-talk/2012-February/023070.html


ETA3 2/11: SSL w/out tor is currently erratic. https://www.google.com and https://mail.google.com sometimes get through, as do some other sites; https://encrypted.google.com eg does not. Traffic is still going through the same filter server. Still don't know cause; SSL certs of connections that go through do confirm as legit.



Still to test, will update post:
* ssh on standard & nonstandard ports
* nonstandard ssl ports

More info:
https://blog.torproject.org/blog/iran-partially-blocks-encrypted-network-traffic (based in part on my info)
http://news.ycombinator.com/item?id=3575029
Shared publiclyView activity