When BCP 38 Is the Wrong Answer: Iran, Spoofed Tunnels, and Where We Draw the Line

On 8 January 2026, Iran entered what became the longest nationwide internet disruption ever recorded. Within twenty-four hours NetBlocks measured national connectivity at roughly 1% of normal levels. Restrictions eased on 28 January into a whitelist, tightened again into a near-total blackout on 28 February, and were only partially lifted when President Pezeshkian ordered the shutdown ended on 25 May. Iran's own communications minister put the cost at $35.7 million per day. 1

We host many customers from Iran. The interesting question for us was not the politics. It was the mechanism.

The blackout was a firewall, not a cable

The common picture of a national shutdown is a country withdrawing its routes and disappearing from the global internet. That is not what happened.

A team at the University of Napoli Federico II analysed public measurement data in March and found that despite losing many BGP adjacencies for AS49666, "most Iranian IPv4 prefixes remained globally routed", and that "routing announcements were not the main mechanism used to generate the shutdown". 2

An Iranian developer in Kermanshah, working from inside the country during the same period, reached a similar conclusion. His analysis notes that Iranian ranges were still being announced, that a small number of foreign IP addresses could still establish inbound connections, and concludes that the blackout "was not a physical severance, but rather a stringent, whitelist-based Layer 3 firewall policy". 4

That difference matters. A cable cut is a physical failure. A source and destination allowlist is a filter, and filters have gaps.

What happens at the edge of an allowlist

If a firewall allows traffic only from a small number of trusted addresses, such as a domestic CDN, a government service, or a limited set of foreign networks, then reaching those services requires appearing to come from one of those permitted sources.

That is what spoof-tunnel does. It is a Layer 3/4 tunnelling proxy that uses bidirectional IP spoofing. The client inside Iran sends packets using a forged source address to the foreign server's real address. The foreign server sends replies using a forged source address back to the client's real address.

Neither endpoint depends on normal bidirectional routing state, because both sides already know the other's actual address. The result is an asymmetric flow that traditional connection tracking systems do not handle as a normal session. Current versions have removed the custom reliability layer and now use a plain UDP transport with WireGuard running on top at MTU 1280. 4

The requirement on the foreign side is simple: the provider must allow packets with non-standard source addresses to leave their network. That requires a provider willing to make a controlled exception.

Our default is, and stays, BCP 38

Before explaining the exception, the default needs to be clear.

RFC 2827, BCP 38, "Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing", has been the correct approach since May 2000 and remains so today. 9 RFC 3704, published in 2004 as BCP 84, later documented the uRPF approaches commonly used for source validation, including strict mode, loose mode, and feasible-path filtering. 10

We enforce source address validation on customer ports by default. We also enforce RPKI on every BGP session upstream and downstream. The reasoning behind that is covered in Signing Your Prefixes Is the Easy Half. We also filter bogons and unannounced prefixes.

Those protections remain enabled unless somebody specifically requests a narrow exception through a ticket.

For more than 99% of our customers, nothing in this article applies. Source address validation remains enabled on their ports and there is no option to disable it.

We do not sell "spoofing VPS". There is no order option, API setting, or plan tier for this. If it were a normal hosting product, it would attract a very different type of customer.

How the exception works

The process starts with a ticket. Not an order note. A ticket means there is a record and a person reviews the request.

The customer provides two lists:

• The source addresses they need to emit. These are the addresses they need to use as packet sources. In the case of an Iranian tunnel, these are usually domestic addresses that the national filtering system permits.
• The destination addresses they need to reach. These are the customer's own systems inside Iran. Specific addresses only, not ranges and not "Iran".

We then create a limited permit covering those sources and those destinations only. Other traffic on that port continues to pass through normal source validation and is dropped if it fails. Changes require another review. Traffic volume is capped because this is intended for personal tunnels, not general-purpose spoofed traffic. Abuse reports or observed misuse end the exception.

This is what we told a customer asking about this in May: "For spoofing, you'll just have to tell us what IPs you'll want to spoof out, so we can whitelist them - and that's it." 7

There is also an infrastructure limitation. We can only change filtering that we control. If an upstream carrier applies uRPF on their side of the connection, we cannot override that. Customers should ask about the required location before ordering so we can confirm whether the setup is possible.

Why destination restrictions matter

The risk with unrestricted spoofing is not the ability to change a source address. The risk is reflection.

Amplification attacks rely on reaching third-party services with forged sources. Examples include open DNS resolvers, NTP servers, memcached instances, and CLDAP services. A small request becomes a large response directed at someone else.

A destination-scoped exception removes that capability. The customer can only send forged packets to the destinations they requested. Adding a third-party reflector would require another request and review.

A direct flood using a forged source is different. It does not increase available bandwidth or reduce attack cost. It mainly provides attribution hiding, and it still operates within an account with limits that can be suspended.

The parts that are uncomfortable

The address being impersonated belongs to someone who did not consent.

In practice, these requests usually involve an Iranian CDN or another address that is accepted by the national filtering system, while the traffic itself goes only to the customer's own endpoint. The impact is limited, but limited does not mean irrelevant.

We cannot completely verify every claim a customer makes. We review the request, examine the destinations, and require the customer to state that those destinations are under their control. Beyond that, the safety comes from the technical restrictions we put around the exception.

There is also a cost for us. On 25 June we experienced a large multi-vector DDoS affecting every location. Albania and Macedonia went fully offline, while the Netherlands and the UK were partially affected. The initial traffic was aimed at anti-censorship customers in the Netherlands. 12

We moved traffic through scrubbing and restored service the same day.

Hosting customers who need this type of access means sometimes becoming a target ourselves.

The people actually asking

This is not a theoretical use case, and the requests we have seen do not resemble normal abuse patterns.

In April, a customer looking for a provider without strict source validation described the requirement clearly: "A single tunnel, just for me, connecting my client to this VPS. Low volume. Destination is my own infrastructure only." They also specifically excluded "reflection, amplification, spoofed traffic aimed at third parties, or anything that would generate abuse complaints." 5

Another user described the reason more directly: "the only way of getting a connection in my country is to spoof your IP as one of the White Listed IPs." 6

The objection raised in those discussions is valid. Networks without source validation are one of the foundations of DDoS abuse. The difference here is that the purpose is not anonymous attack traffic. It is a narrowly scoped tunnel to reach systems that are otherwise inaccessible because of national filtering. 5

When someone asked in May whether we serve Iranian customers, our answer was that we had around 150 at the time and the number was increasing. 7

In June, another Iranian user looked for the same capability at 10Gbps. By July, they reported back that they had contacted us and were running services with us. 8

The rest of the stack has to match

A tunnel alone is not enough if the surrounding services leak information.

Our terms require an email address and a name, with no additional KYC requirements. We do not monitor customer traffic beyond what is necessary to operate the service.

We accept cryptocurrency, which for many Iranian customers is not a preference but the only practical payment option available to them. Private VPN use is allowed. Public and commercial VPN services are not.

Our VPS and VDS templates include encrypted DNS and DNSSEC validation by default, because protecting the connection while allowing DNS requests to leak defeats the purpose. The wider case for Albania as a hosting location, including routing diversity and regulatory environment, is covered in Why Albania Is a Strong Location for Privacy-Focused VPS Hosting.

Regarding sanctions, US policy has specifically created exceptions for internet freedom tools. Treasury issued General License D-2 in September 2022 to support access to anti-censorship tools, VPN software, and related cloud services for Iranian users. 11

We are an Albanian company and this is not legal advice. However, it is notable that the stated goal of those sanctions rules is not to prevent ordinary people from accessing communication tools.

The take

Iranians are back online in the sense that packets are moving again. What returned is still a restricted network where IPv6 and HTTP/3 remain blocked or disrupted, UDP is affected, many data centres remain unavailable, and foreign networks may be reachable only through limited or degraded access. 3

The Napoli measurements showed traffic recovering to around half of previous levels even after restoration. 2

This is what filtering creates. It also creates the conditions where people look for technical ways around it.

Our role is limited. We run BCP 38 because that is the responsible default. When someone needs a controlled exception to reach their own system in a country that has restricted access, we make that exception as narrow as possible, record the request, and remove it when it is no longer needed.

An open internet does not happen automatically. It depends on decisions made by networks and operators.

This is one of ours.

VPS from €5/mo, VDS with 4 to 16 vCPU from €40/mo, bare metal from €150/mo, in Tirana, Skopje, Amsterdam and London. Crypto accepted, no KYC, DDoS protection included. Open a ticket if you need the exception described above and provide the source and destination lists.

Sources

1. 2026 Internet blackout in Iran, Wikipedia, citing NetBlocks
2. Iran's January 2026 Internet Shutdown: Public Data, Censorship Methods, and Circumvention Techniques, Aceto, Persico and Pescapè, University of Napoli Federico II, 30 March 2026
3. Iran reinstates some internet access but restrictions remain for most, Al Jazeera, 31 May 2026
4. ParsaKSH/spoof-tunnel, GitHub
5. VPS provider recommendations for personal VPN tunnel with non-standard egress, LowEndTalk, April 2026
6. need a server with ip spoofing enabled, LowEndTalk, April 2026
7. Dedicated Server with non-standard egress, legitamate use, LowEndTalk, May 2026
8. Need Server with src ip forging capability, LowEndTalk, June to July 2026
9. RFC 2827 (BCP 38): Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing, Ferguson and Senie, May 2000
10. RFC 3704 (BCP 84): Ingress Filtering for Multihomed Networks, Baker and Savola, March 2004
11. U.S. Treasury Issues Iran General License D-2 to Increase Support for Internet Freedom, U.S. Department of the Treasury, 23 September 2022
12. DDoS Effecting AVS ISP, LowEndTalk, June 2026