illegal unless registeredFreedom on the Net: 12/100
After Supreme Leader Khamenei's February 2024 order, the Supreme Council of Cyberspace's 2024 resolution (cl. 6) permits circumvention tools only with an official permit; unpermitted VPN use is prohibited under the Computer Crimes Law framework. Enforcement is technical (mass filtering, IPv6 blocked May 2024, ~2.7 GB international charge per 1 GB vs cheap intranet) plus a grey market the state taxed at an estimated US$1bn/year and now wants to shut down. Permitted VPNs have been documented enabling inspection of user data.
What works there
VLESS/Xray (mainstream) · AmneziaWG · Shadowsocks · Psiphon · Tor with bridges (slow)
Honest advice: Assume every connection is inspected; use Xray/Reality-class tools, and treat any 'approved' VPN as a government tap.
VPN providers with servers in Iran
No published server list places a physical or labeled exit IP in Iran yet. Expats from Iran can still use any provider's nearest "home" region - see the comparison table.
Obfuscation-capable providers
Providers that document obfuscation or stealth protocols - the feature class that matters where VPN protocols themselves are blocked. Directly relevant in Iran.
A rare genuinely usable free plan (no card, P2P allowed on the 10 GB free tier) plus audited no-logs claims twice over - DefenseCode 2015 and Securitum 2024…
The most honest VPN on the internet, and in 2026 still the one this industry is measured against: numbered accounts, cash or Monero accepted, open-source…
CactusVPN is the bundle case in the Smart DNS vertical: a 2011 Moldovan three-friends shop that once sold Smart DNS as its own product line and has now folded…
audited
intro $3.96 /mo
Moldova - the about page says 'CactusVPN started as a small company in Moldova' (late 2011, three friends with ecommerce backgrounds); the Securitum audit names the contracting entity only as 'Cactus VPN LLC' with no registration country; the live site carries no postal imprint anywhere; one third-party review reports a later headquarters move to Canada, which conflicts with the Moldova storysmart dns service 10 d ago
The most credible self-hosting on-ramp in the VPN space, built by and for people inside the censorship: the app is free and open source, you connect it to your…
auditedopen source
intro $5 /mo
Cyprus (EUPHORIATECH LIMITED, Nicosia, reg HE 484287 per site footer, verified 2026-11-02; IP rights in Portugal with Amnezia LDA, ops in Estonia) - for self-hosted users the operative jurisdiction is wherever their own VPS is hostedself-hosted vpn 11 d ago
The anti-affiliate champion candidate holds up: no affiliate program (stated out loud on the homepage), flat honest pricing, quarterly warrant canary, annual…
The most honest mainstream deal in 2026: open-source apps, real audits, a genuinely usable free tier with no data cap, and a transparent renewal model - and in…
Unregistered VPN use is illegal under Iran’s Computer Crimes Law, following the 2024 Supreme Council of Cyberspace resolution. Only state-approved services with permits are legal, but these allow full monitoring. Most users rely on unregistered tools despite the risk of filtering and throttling.
The government blocks most circumvention methods at the network level, including IPv6 since May 2024. Data pricing heavily discourages international access—users pay roughly 2.7 GB of domestic data for every 1 GB of foreign bandwidth. This makes constant tunneling expensive; limit usage to essential tasks.
Tools like VLESS/Xray (especially with Reality), AmneziaWG, Shadowsocks, Psiphon, and Tor with bridges are still functional, though inconsistent. Performance varies daily. Tor is slow but more resilient during crackdowns. Rotate configurations regularly and avoid public or default settings.
Assume all traffic is inspected. Even if a connection works, endpoints may be monitored. Never transmit sensitive information using any service that doesn’t support end-to-end encryption outside Iran’s infrastructure. Treat “approved” VPNs as compromised by design.
Have at least two independent circumvention methods ready. During elections, protests, or national unrest, filtering intensifies and previously working servers go dark. Pre-load configs when access is stable.
Don’t rely on a VPN during major outages or internet shutdowns. The state can and does cut international bandwidth drastically. Local intranet (National Information Network) remains accessible but heavily censored. Plan accordingly.
FAQ
Is using a VPN legal in Iran?
After Supreme Leader Khamenei's February 2024 order, the Supreme Council of Cyberspace's 2024 resolution (cl. 6) permits circumvention tools only with an official permit; unpermitted VPN use is prohibited under the Computer Crimes Law framework. Enforcement is technical (mass filtering, IPv6 blocked May 2024, ~2.7 GB international charge per 1 GB vs cheap intranet) plus a grey market the state taxed at an estimated US$1bn/year and now wants to shut down. Permitted VPNs have been documented enabling inspection of user data.
What actually works in Iran?
Per current research: VLESS/Xray (mainstream), AmneziaWG, Shadowsocks, Psiphon, Tor with bridges (slow). During crackdowns or sensitive periods, even working methods can be disrupted - have at least two options configured.