Tor Bridges for Iran - What Works in 2026 and How to Operate Them

Iran's filtering system has undergone significant capability upgrades since 2019 and uses a combination of IP blocklisting, deep packet inspection, and protocol fingerprinting. The system operates at the level of Iranian Internet Exchange Points and can apply filtering rules that affect all traffic entering and leaving the country.

Tor direct connections without bridges are blocked in Iran. Standard obfs4 bridges from BridgeDB are increasingly burned within days to weeks of listing. The filtering system appears to use a combination of BridgeDB scraping and active probing that has become more sophisticated with each major censorship event, particularly the November 2019 shutdown and the 2022 Mahsa Amini protests.

Despite these challenges, circumvention tools including Tor with Snowflake or private obfs4 bridges remain widely used in Iran. OONI data shows consistent Tor usage from Iranian IPs even during periods of heavy blocking, indicating that motivated users with access to working bridge lines continue to connect successfully. The blocking is effective at scale, not absolute.

Snowflake is the most reliable transport for Iran in 2026. The WebRTC-based architecture resists IP-level blocking, and the broker domain fronting has remained operational through all Iranian censorship events in recent years. Snowflake provides lower throughput than obfs4 but higher availability during crises. For users who only need to access the internet at all during shutdowns, Snowflake is the recommended first choice.

Private obfs4 bridges, not listed in BridgeDB, have significantly longer lifespans in Iran than public bridges. Bridge operators who distribute lines through trusted Iranian diaspora networks and human rights organizations have reported bridge IP lifespans of 3 to 6 months. The key difference is the distribution channel: private distribution limits the surface available for BridgeDB scraping and active probing from inside Iran.

meek remains a reliable fallback when both obfs4 and Snowflake face degraded performance. Its HTTPS-over-CDN architecture makes it extremely difficult to block without disrupting major cloud services that Iranian businesses depend on. meek throughput is low but it consistently provides connectivity when other transports are degraded.

Operators who specifically want to serve Iranian users should budget for shorter bridge IP lifespans than the average. A realistic operational budget assumes replacing public obfs4 bridges every 2 to 4 weeks. Private bridges with trusted distribution can last 2 to 4 months. Snowflake proxies do not burn in the same way since they lack fixed IPs.

Source new bridge IPs from data centers without heavy existing presence in Iranian blocklists. Fresh IP ranges from Romania and Iceland consistently outperform well-known US or UK ranges in lifespan. Anecdotally, IPs that have never hosted any infrastructure before tend to survive longer than those with prior hosting history, possibly because they lack entries in threat intelligence feeds that the filtering system consults.

Maintain a reserve pool of at least 3 provisioned but unpublished bridge instances at any time. When an active bridge shows burn signals - declining Iranian user counts on Tor Metrics, reports from Iranian contacts, or active probing alerts in the Tor log - promote a reserve bridge immediately and provision a new reserve instance to replace it. This keeps response time to burn events below 1 hour.

The most effective bridge distribution networks for Iran are operated by or in close cooperation with Iranian diaspora organizations. Groups including Access Now, 6rang (Iranian LGBT+ rights), and various independent journalists who maintain contact networks inside Iran have established trusted distribution channels that reach motivated users efficiently.

Reaching out to these organizations to offer bridge capacity is one of the highest-impact contributions a bridge operator can make. They have vetted distribution channels, experienced operators who understand Iranian threat models, and the ability to rapidly distribute updated bridge lines when IPs burn. In return, they provide feedback from inside Iran about which bridges are working and which are blocked, enabling rapid response.

Contact these organizations through their official channels using encrypted communication. Offer specific technical resources: bridge fingerprints, obfs4 bridge lines, or Snowflake proxy capacity. Providing a reliable monthly bridge resource with consistent rotation is more valuable to these organizations than ad-hoc contributions.