Rage-Coding the Mother of All VPNs: Notes from Iran's Internet Blackouts

Transcript

[music] [music] >> Entire screen. Can we try again? Oh perfect. All right. Um, 9 months ago I spent 4 days trying to see if my wife and my friends are okay and I couldn't reach them uh because the whole country went dark. And that silence is where this talk starts. Next one.

So a bit about myself. I'm Shayan Eskandari. I'm a security researcher, hacker, educator. Um, I did my PhD in blockchains unforeseeable consequences as like front running, oracle failures, basically the dark side of permissionless. Um, and then I was like a Bitcoin blockchain engineer at a Bitcoin ATM company, did a smart contract audits for a few years and also a chief technology officer at the enterprise staking infrastructure for a publicly traded company. Why I'm here is mainly this other part that I've been teaching about blockchain technology and mainly to Farsi speakers and Iranians for the last decade through Coiniran Academy, Shayan podcast

and also co-founded DAO called Iran Unchained which we're helping Iranians to do pro-democracy work. Currently I'm a professor at Nova School of Business and Economics in Lisbon. I'm basically teaching blockchain fundamentals and my current obsession is internet freedom. Um. So just to give you the context, so Iran has been going dark for more than two decades. It's been ongoing 2009 green movement which was like a protest. Many SMS got caught, a lot of websites got blocked.

Um, there were a lot of arrests and killings. 2019 Bloody Aban uh which 95% of internet was cut. Um, and then 2022 which you you were at Bogota Defcon we did a whole ceremony there that all data got caught, many people got arrested. And one of the other ones 2025 in a 12-day war when there was like basically due to cyber war there was like internet was cut a lot. And basically I want to say the next blackout is in a risk. It's inevitable as we see this year was 2026 was one of the worst ever on record.

In January 8 and 9 everything was cut off, SMS, phones, everything was cut off for a few days and around 30 to 70,000 people were killed in the streets. And then the internet came back a bit and then 88 days of internet blackout. Phones returned but no internet for 88 days. Interestingly when it came back the internet was routed to Azerbaijan. I'm not going to spend that much time on why and how that happened but it was interesting that ChatGPT became the top three third top top country of the users because all the Iran traffic was going through Azerbaijan.

And before you say this is like Iran's problem it's not. Internet censorship is becoming the global default. In 2025 we had 313 internet shutdowns in in 52 countries. That means around 800 million people actually experienced government blackout in 2025 and 2026 is actually on pace to break that record. We've seen in so many countries like Nepal, United States even UK, Iran there is a spike in VPN demand and all those spikes are basically the whole population trying to flee to a free internet.

These are basically like different flags, same playbook. If you control the network you can control the people. Some places in Russia when talking about VPN is almost criminalized. And I'm going to use borrow the the framework of something called from Corey Doctorow which he basically uses that for social media and like Amazon. The framework goes in a way that you be good to users, attract users to your platform, capture the users through network effect and everything there, and then start abusing your users for your business customers, business users, and show them ads.

And later on start abusing those business customers for your shareholders and extract money. And then the platform starts to rot and becomes this pile of giant pile of So I feel like internet is also went down the same path as in we started open protocols, everyone can have their own websites and online, then ISPs start capturing the users to their around and then CDNs and like fiber became the check choke points for the governments to be able to control the traffic. And also Web 3 forgot the promise. Basically like a lot of reasons we're here is the cypherpunks and their motto was censorship resistance communication

across borders for everyone. And in this space we attracted a lot of people with that mindset. And then we see start to capture the space and try to like optimize for what could be priced in and be sold. And that changed the narrative. It became like more even now for privacy we talk about privacy, censorship resistance, money, not censorship resistance communication. And we became this thing that we do KYC privacy as a service system that it has some profit model, but basically financial privacy has a business model, but communication privacy for someone in Tehran does not.

And we started to build a lot of things, but on top of this rotted stack and kind of ignore the rest. We built a lot of app layers like wallets, dapps, social social applications, DeFi, protocol layers, layer twos, IPFS, all these. We touched the transfer layer with ENS, but it was early on that we wanted ENS to replace DNS. Now that conversation is not really um going on anymore. And we forgot everything under like ISPs, access, and the fiber, actual physical layer.

And if you cut this layer, everything up on top just vanishes. It doesn't exist anymore. Um and it is basically a failure of imagination of who the adversary could be. Um so back to my story, basically I'm Iranian diaspora. As I said, I put 10 years I've been teaching Farsi speakers the whole web three stack, more technical as like the protocols, auditing, um how this tech works self-custody. And then when the blackout happened, um the whole thing was worthless. I was just sitting in Lisbon and thinking, did I waste a decade of my life and thousands of people's life by talking about something that won't work when they needed?

Um and a lot of them were making money through online businesses, security audits, and just they're just gone. They couldn't even check their balances. So I was sitting there just contemplating my life um because nothing mattered. I couldn't even reach them to say, hey, how's it going? Now they're like anything crypto. By the way, all the QRs on the side, they're related to something on that slide. They're different. You can scan them. Um so what happened is like basically I was like frustrated, angry, I couldn't do anything, and I rage coded. I started like um just coding something, do something.

And it wasn't necessarily for any financial future. It was for better now, but mainly for my own sanity because I was going insane. And I started setting up different VPN protocols, sending it to friends. It some it worked with some people in some cities, some didn't work with some others. And I was like, what if I just put all of them together? And that meme, the mother of all VPN, became the product. So in January, the first communication blackout happened that I started rage coding this and I shipped um and after a few weeks, people actually start getting through and using it, which was exciting.

And late February, that was like the full internet shutdown when everything went silent and I felt defeated. I just broke down. I went for a walk for a few days. Came back and I looked at my test servers and I saw there's none no traffic from Iran, but I saw traffic from Myanmar, China, Russia, UK, Germany. And I realized, okay, I'm up to something. People are using this. And I really believe that you never fail until you stop trying. So I was like, I'm just going to continue adding protocols, fixing things and see where it goes.

Hopefully internet comes back. [snorts] The internet shutdown took 88 days. And in those times I couldn't really send I was billing this. I was like VPN configs, but I wanted to send this to someone in Iran to test it. And the only way to communicate was for them to call me from landline to my phone. And I don't know if you've ever tried to reading a JSON file over the phone. It's impossible. So I went to my friend Claude. I was like, I need to learn signal processing. But I basically built this thing called Netagram, which is works fully offline.

You can give it your configuration. It turns it to sound. And then on the other side offline, you can turn it back to config. It just has that bootstrapping problem that they need internet to load. But basically I end up using this technology that NASA implemented in Voyager in the 70s and Voyager from Interstellar is communicating with us using the same error correction that I implemented in this Netagram. And it worked. It worked. And I was able to like send some configs here and there. But then gladly we found some other ways.

So when internet shutdown happens, a lot of people start scanning for IP addresses. It's similar to a lot of like you are astronauts look at the sky to see if there is life out there. People start to scanning the whole internet to see if anything pings and any servers are open. And from time to time, either by for a mistake or government needs that, some ranges of cloud services gets open. Like example was Azure North Africa was open for a for a And it becomes like two problems. One, how would I as someone outside get an IP address in that range, which can be technically solved.

The other one is like you have a few days of that range being open. You want to get traffic going on so fast. And I wanted the whole stack to be able to like run within 10 minutes and just start routing traffic. So that's one of the specific problems I want to solve. Um and it's interesting cuz when they block the obvious ones, which they do with deep packet inspection, um the creative resilience routes around it. So just one thing, the deep packet inspection since 2021 and 22 2022 exponentially has grown to be with the sophisticated software and like method to like block uh different protocols. So Open VPN, Wireguard, a lot of PP L2 P get blocked really fast.

And people get really uh creative there. So um let's say SNI spoofing is like something that you can fake a traffic that your smart TV is updating from Samsung, but you're routing traffic through that. Or Ghost Relay, something I really like is like you can route through scripts of Google and use Google infrastructure. Sometimes some places are open. And one of my favorites is Bala VPN, which Bala is this official Iran approved chat app which has video support. And you can use the Web RTC to route traffic and use that as your proxy and also DNS tunnels.

So basically what government and regime needs to function and even their own app, that's where we can hide some traffic. And what basically Mahv does is I didn't choose like the most perfect protocol. I choose all of them. Uh so basically that blue box in the middle is what Mahv would pop up. And what it does is other than a lot of protocols from like VLESS, like all protocols are open source server side, it also starts to contribute to Tor network through Snowflake and also Siphon through conduits. These are like these anti-censorship softwares out there and networks. So other than becoming a VPN server for like the VPN server for a person, it

becomes the infrastructure for all these anti-censorship networks out there. And my mission was for anyone that can just go to command line Linux, be able to become the VPN provider and run this arsenal of VPN packages. And on the user side, anyone that ever had a VPN app on their phone that takes a config, there should be a config in this more of config for them to import. So they don't need a new app, they don't need anything. And basically solving the solution for the Iran cuz any even a five-year-old know what the VPN is there.

And basically rage coded I start sharing this. And interestingly in June I was like exhausted and I was invited to talk in New Cypherpunk Berlin and also the App Con. And that's one of the places things changed for me cuz I wanted to get over with this. But then that those talks people got excited when I was talking and I felt like I'm off to something. And I came back for the whole summer I did like the whole dev mode. And another place I went to a global gathering which used to be called Internet Freedom Festival. I realized I missed that crowd that they all care about freedom and they want to help each other. Most importantly they're willing to talk their governments.

And early early crypto conferences were like that. They were like oh we need to rebuild something. And that was a magical place that was give me a lot of hope. And I continued we have like a new version out. And actually this week even the mobile app came out so if you have a VPS or something you can just on the mobile app put the VPS config, it installs everything, it does handles everything, gives you like the bundles which is a really nice read me in right now in Farsi and English from your phone. You don't have to do anything even you don't have to do command line. So my goal was to make it so easy to become a VPN provider for yourself and part of the Um, and interestingly, so mother of all

VPN by accident became this research instrument as well. So so far a lot of like there's like two groups, OONI and Manta that they do um basically tunnel health and censorship measurement studies. And they usually know if the protocol works or doesn't work, a config works or doesn't work. And OONI enabled us to like be able to like see when a protocol is blocked, if it's IP, if it's a protocol, if it's a domain, like what is happening there and give a lot of information to people that are building anti-censorship tooling.

And it's really helping to figure that out. This is like ongoing project and it's recently started, but it became this instrument. And where I want to the move have to go is like yeah, strangers become infrastructure. I already shipped a a bunch of things. Client, I want everyone to be able to like have a Raspberry Pi at home that just loads balance and handles everything and everyone on household can use it. Um, I want to make it like more of the research to be able to figure out. So DPI has advanced a lot, but we need to be able to like match that at least to be able to like fight this fight.

And also the grassroots infrastructure, you know, want people to run this and we need to build and run this network before the next crisis because when it happens, it's late. And don't worry, it will happen to you in your lifetime. Um, and there's like a lot of other things that people did that were like fascinating to see. And this was done by people inside these blackouts. So it is something called grassroots infrastructuring or survival work. Those are the terms that are being used now. So people figured out that Git clone works. So they did HTTP over Git. So you could do your commit messages via URL and the GitHub action downloads that and you can Git clone and download the file.

And there were like so many interesting ones like the feed helps downloads like public Telegram channels and news over DNS. Um, there is like this group called NasNet that are figuring out a way to share Starlink internet with trusted actors without being being detected into in the infrastructure. There are like so many other projects. [snorts] Um one thing I want to have a call out here to like a few ideas I have that I think we have everything we need to have it. So like we do pop-up cities. I think like a lot of you might have been to H cities or here and there. Why don't we do pop-up meshes? I know like DWeb did that like experimental a while ago, but why do we use Discord, Telegram? We can just have a Delta chat and use all of us

um use it here. We can use B chat, Mesh tastic. Or better even we can have a short-lived L twos that like just runs here. We do all the payments and then at the end of the conference we sends uh checkpoints in the to internet. Mainly because we need the tooling, we need the culture, we need to have the tools on us available and the mental model to like what to do with in the situations. But we can make them easy to use. Like either not easy to use their hobbyist projects mostly. But this is something I want to see and we're so we're there almost.

Um another thing is so if internet is down for days, can money still move? I know there are so many conversation about stable coins becoming the next fiat currency, but if we we need to we want to do that it should work all offline as well. It that's the last mile. And it's again a signed transaction is just data. We can sign um anywhere and just carry it over any channel and then broadcast it. It can it should work. Um and I feel like it is a solved a problem, but we don't have it. Like as an example just like turn off do airplane mode to open any wallet you have. It just breaks. It should not break. It has everything there that should work at least the last state it had. You should be able to sign

something. Uh which is technical issues like it needs a nonce, it needs gas estimate, but those are solvable in my opinion. And I think the wallet should not die in that scenario. And there are some solutions for this. One is like basically like the scenario I have in mind there it's actually real scenarios that someone would go buy groceries, they have USDT, the seller accepts crypto, but there's no internet. So there's nothing to do, and there's some kind of trust there. So we can have a capped, lower trust offline stablecoin payments. It's buildable right now. Um you can do using smart accounts and capped session keys or 2D [snorts] nonces using the key card.

Um and the key card you can tap on your phone, have the other nonce, and have a way to like do $5 transactions with no internet. Or also intents was a big thing. We can use sign intents and store a forward relays to use it. Um so we don't have to like solve it for global scale. If you can solve it for a small scales, like that would actually work for people in need of these technology. And my question is like, can you build us? Will you? And what does it take for you to build it? Cuz when you in that crisis, it's too late. You we can build it and have it ready in your hand to use it.

And basically like the turn why I want I did the talk is like I want to say go build what you want to see. And like everything I talked about here, no one asked for it. It was just came I created them just because I wanted to. And I I believe internet freedom is a human right, and now we have the agency to build it. You don't need a team. You have like AI agents all over. You don't need that much funds to actually make it build. Um we early crypto was like that. We were experimenting, building cool things, and this was like before ETFs and all the distractions.

Um and I my point to you is like build for the hard problems, the real problems, the plumbing for the next blackout, just not just another DeFi app. Um and the last part is like yeah, run Moab, become the infrastructure, give me feedback, and let's build really cool things cuz the window is open now, but it's unstable, and the next blackout is inevitable. You will experience this. Um thank you, and we can go to questions. >> Thank you so much, I am.

Let's start with the question. We have a lot of them. [laughter] How have you ever been reached out by governments and your the pressures? >> Yes, yes. And I still build this as we need to. >> Okay. Can decentralized VPN remain liable when governments completely shut down the internet? >> Um so there is like the shutdowns like Iran case was literally unplugging internet and there was no other way to do it. Starlink was the only solution.

But decentralized VPNs most of them right now that I've looked at like Nim and Gnosis VPN, they're really cool software but they're more VPN for privacy rather than VPN for access and connectivity. Like what Muave is is like for you to be behind this firewall be able to access, not to access Netflix of US or some others. It's a different different kind of VPN. >> How should we ensure a non-state control physical layer? Starlink is also corporate one. How to ensure an open free publicly owned physical one network?

>> Um this is like a big problem and actually Fatima which I did a panel with and another talk right now she's doing the like a thought experiment on how we can build something like this. Um I don't have a proper solution because I played around with mesh and meshtastic they're about hobbies. There's like a security risk around running them because it's detectable. Ideally we can have these Wi-Fi Hello or something around that we can have local networks. And the thing is for a lot of things you do with internet you don't need the global internet. If I want to send a message to you someone in the crowd I don't have to send my message to New York and back here. We should be able to these clusters of networks that just runs and are almost internet in that sense.

>> Okay. Next, how does the connect if there's no internet? >> So, that is one of the parts we were saying 18 protocols is like unless it's unplugged, there is layers that we can get through. There are IPs, there's DNS that you can get through it and becomes like it's not a sustainable solution ever. It's like a cat and mouse. You figure something out that the vehicle later is closed, you have to figure something else. And that's what I'm saying like that using like ballet VPN which like there's an app that government approves and controls and is for video calls pass through traffic through that. Like there are like so many other ways, but when it's like fully shut down, yeah, there's nothing nothing we can do.

>> Another question is how do personally deal with the government intervention? >> And that's kind of a wide question like what kind of intervention? Yeah. >> You can go to the next one, no worries. Um Um what else? Are there more coming? >> We can answer the personally or I'm not >> Um Personally, I'm not sure I'm not sure I'm ready to afford my bandwidth to some stranger because I'm not sure they are not some shady person with shady goals. How do we solve this?

>> Uh so first of all like if you're running it on your home network on a Raspberry Pi, make sure you share it with the trusted crowd and maybe lower the bandwidth the bandwidth allowance for like Tor and others. Um but ideally run it on a VPS. There's like $5 $10 VPSs that you can run and it's like pretty um cost effective. Uh about the shadiness, it's overall about the freedom and anti-censorship. Even like I got one of my servers took down because someone was downloading torrent from and I want to block torrent, but I realized for anti-censorship software stack that I'm building, I don't want to add censorship. It becomes this moral morality question.

And um yeah, just if you are doing home, share it with your family and trusted group Use a VPS that is throw away. It's a disposable VPS. You can just move to another VPS if you want to. It's just takes 10 15 minutes to migrate to a new server. >> What will you do when App Store bans your service to avoid Iranian bypass sanctions? >> Well, the I'm on App Store since last week. Maybe my next talk would be answering that question. So it's still there. It works. I got all the approvals from the App Store.

And it works for now. So we'll see if that happens. >> Maybe the last one. I think you need much bigger solutions than VPN to solve the blackout problem. Do Did you think of any such solutions? >> So the last two slides like this offline payments is something that really saves lives if you can figure out so that that works in a blackout. That is something that is kind of my calling is like let's build this. Let's have this handy and work to like we can continue using crypto and our money when blackout happens.

Yeah nothing. >> Thank you so much. >> [music]