VPNs in Iran

illegal unless registered Freedom on the Net: 12/100

After Supreme Leader Khamenei's February 2024 order, the Supreme Council of Cyberspace's 2024 resolution (cl. 6) permits circumvention tools only with an official permit; unpermitted VPN use is prohibited under the Computer Crimes Law framework. Enforcement is technical (mass filtering, IPv6 blocked May 2024, ~2.7 GB international charge per 1 GB vs cheap intranet) plus a grey market the state taxed at an estimated US$1bn/year and now wants to shut down. Permitted VPNs have been documented enabling inspection of user data.

What works there

VLESS/Xray (mainstream) · AmneziaWG · Shadowsocks · Psiphon · Tor with bridges (slow)

Honest advice: Assume every connection is inspected; use Xray/Reality-class tools, and treat any 'approved' VPN as a government tap.

VPN providers with servers in Iran

No published server list places a physical or labeled exit IP in Iran yet. Expats from Iran can still use any provider's nearest "home" region - see the comparison table.

Obfuscation-capable providers

Providers that document obfuscation or stealth protocols - the feature class that matters where VPN protocols themselves are blocked. Directly relevant in Iran.

hide.me

A rare genuinely usable free plan (no card, P2P allowed on the 10 GB free tier) plus audited no-logs claims twice over - DefenseCode 2015 and Securitum 2024…

7
audited crypto accepted
intro €2.69/mo (about $3.04/mo)
Malaysia commercial vpn 20 d ago

Mullvad VPN

The most honest VPN on the internet, and in 2026 still the one this industry is measured against: numbered accounts, cash or Monero accepted, open-source…

6.6
court-proven no-logs audit open source crypto accepted
intro €5/mo (about $5.65/mo)
Sweden commercial vpn 11 d ago

CactusVPN Smart DNS

CactusVPN is the bundle case in the Smart DNS vertical: a 2011 Moldovan three-friends shop that once sold Smart DNS as its own product line and has now folded…

6.3
audited
intro $3.96 /mo
Moldova - the about page says 'CactusVPN started as a small company in Moldova' (late 2011, three friends with ecommerce backgrounds); the Securitum audit names the contracting entity only as 'Cactus VPN LLC' with no registration country; the live site carries no postal imprint anywhere; one third-party review reports a later headquarters move to Canada, which conflicts with the Moldova story smart dns service 10 d ago

Amnezia VPN (self-hosted with obfuscation)

The most credible self-hosting on-ramp in the VPN space, built by and for people inside the censorship: the app is free and open source, you connect it to your…

6.2
audited open source
intro $5 /mo
Cyprus (EUPHORIATECH LIMITED, Nicosia, reg HE 484287 per site footer, verified 2026-11-02; IP rights in Portugal with Amnezia LDA, ops in Estonia) - for self-hosted users the operative jurisdiction is wherever their own VPS is hosted self-hosted vpn 11 d ago

IVPN

The anti-affiliate champion candidate holds up: no affiliate program (stated out loud on the homepage), flat honest pricing, quarterly warrant canary, annual…

6.1
audit canary open source crypto accepted
intro $5/mo
Gibraltar commercial vpn 42 d ago

Proton VPN

The most honest mainstream deal in 2026: open-source apps, real audits, a genuinely usable free tier with no data cap, and a transparent renewal model - and in…

6.1
audit open source crypto accepted
intro $3.49/mo renews $83.88 / 12 mo ($6.99/mo)
Switzerland commercial vpn 42 d ago

Tips & tricks for Iran

  • Unregistered VPN use is illegal under Iran’s Computer Crimes Law, following the 2024 Supreme Council of Cyberspace resolution. Only state-approved services with permits are legal, but these allow full monitoring. Most users rely on unregistered tools despite the risk of filtering and throttling.
  • The government blocks most circumvention methods at the network level, including IPv6 since May 2024. Data pricing heavily discourages international access—users pay roughly 2.7 GB of domestic data for every 1 GB of foreign bandwidth. This makes constant tunneling expensive; limit usage to essential tasks.
  • Tools like VLESS/Xray (especially with Reality), AmneziaWG, Shadowsocks, Psiphon, and Tor with bridges are still functional, though inconsistent. Performance varies daily. Tor is slow but more resilient during crackdowns. Rotate configurations regularly and avoid public or default settings.
  • Assume all traffic is inspected. Even if a connection works, endpoints may be monitored. Never transmit sensitive information using any service that doesn’t support end-to-end encryption outside Iran’s infrastructure. Treat “approved” VPNs as compromised by design.
  • Have at least two independent circumvention methods ready. During elections, protests, or national unrest, filtering intensifies and previously working servers go dark. Pre-load configs when access is stable.
  • Don’t rely on a VPN during major outages or internet shutdowns. The state can and does cut international bandwidth drastically. Local intranet (National Information Network) remains accessible but heavily censored. Plan accordingly.

FAQ

Is using a VPN legal in Iran?

After Supreme Leader Khamenei's February 2024 order, the Supreme Council of Cyberspace's 2024 resolution (cl. 6) permits circumvention tools only with an official permit; unpermitted VPN use is prohibited under the Computer Crimes Law framework. Enforcement is technical (mass filtering, IPv6 blocked May 2024, ~2.7 GB international charge per 1 GB vs cheap intranet) plus a grey market the state taxed at an estimated US$1bn/year and now wants to shut down. Permitted VPNs have been documented enabling inspection of user data.

What actually works in Iran?

Per current research: VLESS/Xray (mainstream), AmneziaWG, Shadowsocks, Psiphon, Tor with bridges (slow). During crackdowns or sensitive periods, even working methods can be disrupted - have at least two options configured.

Which providers ship the needed obfuscation?

hide.me, Mullvad VPN, CactusVPN Smart DNS, Amnezia VPN, IVPN, Proton VPN document obfuscation features. Self-hosted AmneziaWG or VLESS/Reality on your own server is the strongest option.

last checked 2026-09-29 · information, not legal advice