5 min read
Three filtering systems — Iranian, Russian and Chinese — are built differently but cut off the same thing: protocols with a recognisable packet pattern. OpenVPN, L2TP, plain WireGuard and Shadowsocks in its base configuration fail in all three. One class of solution gets through: the kind indistinguishable from ordinary HTTPS. BessyConnect works in Iran, Russia and China precisely because it is built on that class. Below is a breakdown of which properties are responsible.
The equipment does not decrypt traffic — it has neither the compute nor the keys for that. It looks at the signals visible from outside:
| Signal | What it gives the protocol away | |---|---| | Size and order of the first packets | constant for every classic VPN | | TLS handshake fields | a mismatch with a real site shows up immediately | | Entropy of the first bytes | Shadowsocks betrays itself here | | Rhythm of the exchange | evenly spaced fixed-length packets look nothing like the web | | Response to a probe request | a server that answers "like a VPN" lands on the blocklist |
That last line is the one most often forgotten. The Chinese system does not only listen: it connects to a suspicious address itself and checks how it responds. Encryption does not help here — behaviour is being tested, not content.
1. The handshake is performed with a real site. The VLESS protocol with Reality masking borrows the TLS certificate of a genuinely popular resource. To an observer the connection looks like an ordinary visit to an ordinary site: real certificate, real domain, the same handshake fields.
2. The server survives active probing. When the filtering system sends a probe, it gets back exactly the response that real site would have given. There is nothing to latch onto. This is what separates Reality from "VPN over TLS": masking the stream without a plausible answer to the probe does not save you in China.
3. No signature of its own. There is none of that constancy in the first packets by which a protocol gets written into a rule. Nothing to describe means nothing to block by list.
4. A supply of addresses. More than a hundred servers. When a specific address does end up restricted — and that happens to any service — switching takes a second. The difference between "the service stopped working" and "it changed location" comes down precisely to how many there are.
The technical side of the protocol is covered separately: Reality and VLESS in plain language.
Distance governs latency more than any setting: light in fibre travels at roughly 200,000 km/s, which works out to about 1 ms per 100 km round trip.
| From | Nearest location | Physical floor | Realistic | |---|---|---|---| | Russia, European part | Finland | ~9 ms | 15–25 ms | | Russia, European part | Poland, Germany | 12–16 ms | 25–40 ms | | Iran | Turkey | ~15 ms | 30–50 ms | | China, east coast | Singapore | ~25 ms | 50–80 ms |
European and American nodes work from there too, but with latency in the hundreds of milliseconds: tolerable for messaging, not for calls or maps.
During a full internet shutdown nothing works — not ours, not anyone's. A tunnel carries traffic over an existing channel. When a country switches the network off, as Iran did on 8 January 2026, there is nothing left to carry. Any service promising to work through a shutdown is lying to you.
An individual address can end up restricted. This happens to every service in these regions and does not mean the service has stopped working: switching to another location takes a second, and there are over a hundred servers. It is precisely the supply of addresses that separates "changed server" from "lost connectivity".
How the filtering systems themselves are built: VPNs in the most censored countries, by country: China, Iran, what TSPU is.
In countries with heavy filtering the app stores are restricted too. A client installed in advance works; a client you try to download at the moment you need it may already be unavailable. This is the single most common mistake made by people who arrive unprepared.
Does BessyConnect work in China and Iran? Yes. The service runs on VLESS with Reality masking — a protocol with no signature of its own that answers active probing correctly. Those are two properties classic protocols lack, and without them nothing gets through in these regions.
What should I do if one specific server stops opening? Switch to another server in the same country: more often than not a single address has been restricted rather than the whole location. There are over a hundred servers.
Which location should I pick from Iran and China? Turkey and Singapore respectively — the nearest major hubs. Distant countries add hundreds of milliseconds of latency.
Do I need a kill switch in this situation? Yes. A dropped tunnel in a filtered country means that for those seconds traffic leaves in the clear through the operator's network. A kill switch turns a drop into no connection at all.
How many devices can I connect? There is no limit: one account covers phone, laptop, tablet and TV at the same time.
A proxy covers one program and encrypts nothing; a VPN covers the device and encrypts everything. A layer-by-layer table and how to choose in one question. More
Tor spreads trust across three relays, a VPN concentrates it in one operator. A full comparison, bridges, and why the order of VPN and Tor matters. More
The server bill isn't the whole cost. Hidden expenses, the one-address-one-person risk, and when a managed service works out cheaper in time and money. More
