Black Friday Our biggest deal of the year is coming soon Get notified →
Iran · Filtering and shutdowns

A VPN that keeps working in Iran

Iran's filtering blocks most VPNs, and it gets much stricter during protests and shutdowns. PremierVPN gives you three layers: VLESS in our apps for everyday use, HTTPS and DNS tunnels when VLESS is blocked, and StormDNS for when almost nothing else gets out.

Get PremierVPN: 50% off What to try first

Code ANNUAL50 takes 50% off your first year · Bitcoin and Lightning accepted · 30-day money-back guarantee

  • VLESS in the apps
  • 6 tunnel protocols
  • StormDNS
What to try, in order

Three layers, from fastest to toughest

OpenVPN, IKEv2 and plain WireGuard® are blocked on most Iranian networks. Start at the top and only move down when the layer above stops connecting.

01 · Try first

VLESS in the PremierVPN app

Everyday

Built into the normal app. Start with REALITY. If it connects but keeps dropping, switch to xHTTP. If our servers can't be reached at all, use CDN.

REALITY→xHTTP→CDN
Fastest option · UK and German servers are typically good from Iran
02 · If VLESS is blocked

HTTPS and DNS tunnels

Heavy filtering

Six tunnel protocols that carry your traffic inside HTTPS or DNS. On Android, use the free SlipNet app and start with DNSTT. On iPhone, use NaiveProxy in Shadowrocket.

Android SlipNetiPhone Shadowrocket
Servers in Frankfurt and Helsinki · included with every plan
03 · When almost nothing gets out

StormDNS

Shutdowns

Sends your connection as ordinary DNS queries through public resolvers. Slower than a VPN, but good for messaging and browsing when everything else is blocked.

iPhone PremierNexusAndroid WhiteDNS
Tested in Iran during shutdowns on MCI, Irancell and others

Set up all three now, while your connection works. Layers 2 and 3 are set up in the client area, which can be harder to reach once filtering tightens. With everything ready, you can switch layers without downloading anything new.

Layer 1 · VLESS

Looks like a visit to an ordinary website

Iran's filtering recognises the shape of OpenVPN, IKEv2 and WireGuard traffic and cuts it off. VLESS avoids that by travelling as normal HTTPS on port 443, the port every secure website uses.

With REALITY, your device makes a genuine TLS 1.3 connection that borrows the certificate of a large, well-known site, with the same fingerprint as Chrome. Only our server holds the key that tells it apart. xHTTP shapes traffic like everyday web requests, which helps on networks that cut long connections. CDN goes through a content delivery network, so blocking our server addresses doesn't stop it.

How REALITY works → How xHTTP works →

No separate app

Where to find it on each device

iPhone, iPad
Leave it on Auto. It tries WireGuard, AmneziaWG, REALITY, xHTTP, CDN and Stealth relay, keeps the first that works and remembers it for each Wi-Fi network. App
Android
Open the VLESS tab and start with a Reality server. Needs a 64-bit phone. App
Windows
Turn on Bypass and choose VLESS, or leave Bypass on Auto. VLESS runs as a Windows proxy for your browser and proxy-aware apps. App
macOS
Choose a VLESS server and connect. App
Linux
Ubuntu, Debian and Fedora. Pick a server in the VLESS tab. App

Start with a UK or German server. One subscription covers every device.

Layer 2 · Tunnels

Six tunnels for heavy filtering

When filtering tightens and VLESS stops connecting, these carry your traffic inside DNS lookups or HTTPS. They run on their own servers in Frankfurt and Helsinki.

DNSTT

Start here

Hides encrypted traffic inside DNS queries, secured with Curve25519. The most dependable of the DNS tunnels, and the one to try first.

Port 53 / UDP · Android (SlipNet)

Slipstream

Fastest

QUIC carried over DNS. The quickest of the DNS tunnels when your network lets it through.

Port 53 / UDP · Android (SlipNet)

VayDNS

9 record types

KCP over DNS, using any of nine record types (TXT, CNAME, A, AAAA, MX, NS, SRV, NULL, CAA). If one pattern starts getting blocked, the record type can be changed on the server.

Port 53 / UDP · Android (SlipNet)

NaiveProxy

iPhone too

HTTPS on port 443 with a real certificate and Chrome's own network stack, so it looks like a browser visiting a website. Resists active probing.

Port 443 / TCP · iPhone (Shadowrocket) · Android (SlipNet)

StunTLS

No domain needed

SSH inside TLS, straight to the server's IP address. A useful fallback when DNS is filtered locally, with an optional WebSocket mode for use through a CDN.

Port 8443 / TCP · Android (SlipNet)

NoizDNS

Anti-analysis

DNSTT with added noise from your device, which makes the traffic harder to pick out by statistical analysis. Slightly slower than DNSTT.

Port 53 / UDP · Android (SlipNet)

Android: all six in SlipNet

Install the free SlipNet app, set up your tunnel servers in the client area and import the connection links. If one protocol stops working, switch to another in a couple of taps.

iPhone and iPad: NaiveProxy in Shadowrocket

Get Shadowrocket from the App Store and add your NaiveProxy server details from the client area. Your traffic travels as HTTPS on port 443.

The tunnels come with every subscription at no extra cost. Each tunnel server allows one device at a time, and you can use both at once.

Set up tunnels in the client area → More on each protocol →

Layer 3 · StormDNS

For when almost nothing gets through

StormDNS encrypts your traffic, splits it into small fragments and sends them as DNS queries through public resolvers to our StormDNS server. As long as DNS lookups still get out of the country, so does your connection.

It's slower than a normal VPN, so think messaging, email and browsing rather than video. We've tested it in Iran, including during shutdowns, on MCI, Irancell and other networks.

How StormDNS works →

Included with every plan

Getting StormDNS ready

Activate
One click per server in the client area. Each server gives you your own hostname, and deactivating it revokes access.
iPhone
Our own PremierNexus app. Import from your dashboard in one tap.
Android
WhiteDNS, free and open source.
Resolvers
Lists for Iranian networks in the client area, refreshed regularly.

Activate StormDNS in the client area →

For family inside Iran

Set it up for the people back home

If you live abroad, you can pay for family inside the country and get them set up. One subscription covers several devices, so one account can cover a whole household.

  • Pay from abroad by card or PayPal, or with Bitcoin or Lightning.
  • Install while unfiltered. Have them download the apps while on an unfiltered connection or a hotspot.
  • Set up the backups too: tunnels and StormDNS, so they can move down the ladder without your help.
  • Visiting yourself? Install and test everything before you fly.
On their phone

What a ready phone looks like

Main app
PremierVPN, signed in, with a UK or German VLESS server tested once.
Tunnels
SlipNet on Android, or Shadowrocket on iPhone, with your tunnel server imported.
StormDNS
WhiteDNS on Android, or PremierNexus on iPhone, with a StormDNS server activated.

Each tunnel server allows one device at a time, so plan which phone uses Frankfurt and which uses Helsinki.

Blocked in Iran

Reach the services you rely on

Filtered, restricted or unavailable on Iranian connections. Some are blocked all the time, others during crackdowns.

  • Instagram
  • YouTube
  • Telegram
  • X (Twitter)
  • Facebook
  • Signal
  • TikTok
  • Clubhouse
  • SoundCloud
  • Netflix
  • BBC Persian
  • Voice of America
  • Spotify
  • ChatGPT
  • Wikipedia
  • Medium
Getting started

Ready in four steps

  1. Subscribe

    Every plan includes all three layers. Code ANNUAL50 takes 50% off your first year. Pay by card, PayPal, Bitcoin or Lightning (through BTCPay), or other coins through Cryptomus.

  2. Install the app

    On each phone and computer. From inside Iran, download while on an unfiltered connection or a hotspot.

  3. Set up the backups

    In the client area, set up your tunnel servers and activate StormDNS, then add them to SlipNet, Shadowrocket, PremierNexus or WhiteDNS.

  4. Connect

    Start with a VLESS REALITY server in the UK or Germany. If it stops working, move down the ladder.

Have every layer ready before you need it. When filtering tightens, app stores, our website and the client area can all be hard to reach from Iran. Once everything is installed and set up, switching layers takes seconds.

FAQ

Using a VPN in Iran

Does PremierVPN work in Iran?
Yes. For everyday use, the VLESS protocols in our apps (REALITY, xHTTP and CDN) are built to look like ordinary HTTPS and get past most filtering. For heavy filtering and shutdowns, every subscription also includes six HTTPS and DNS tunnel protocols and StormDNS, which we have tested in Iran during shutdowns on MCI, Irancell and other networks.
What should I try first?
Start with VLESS in the PremierVPN app: REALITY first, then xHTTP if the connection keeps dropping, then CDN if our servers can't be reached. If none of those connect, use the tunnels: DNSTT in SlipNet on Android, or NaiveProxy in Shadowrocket on iPhone. When almost nothing gets out, use StormDNS.
Does it work during internet shutdowns?
Often, but nothing can promise to work through every shutdown. When international access is cut, DNS lookups often still get through, and StormDNS and our DNS tunnels carry your traffic inside them. We have tested StormDNS in Iran during shutdowns. It is slower than a normal VPN, so expect messaging and browsing rather than video.
Does it work on iPhone?
Yes. The PremierVPN app for iPhone and iPad includes VLESS, and Auto mode tries each protocol in turn and remembers what worked on each Wi-Fi network. For heavier filtering you can use NaiveProxy through Shadowrocket, and for shutdowns our own PremierNexus app runs StormDNS.
Which server should I use from Iran?
Our UK and German servers are typically good from Iran, so start there for VLESS. The tunnel servers are in Frankfurt and Helsinki, and you can set up both.
Can I set it up for family in Iran?
Yes. One subscription covers several devices, so you can pay from abroad and install the app on their phone and laptop. Do the install while they are on an unfiltered connection or a hotspot, and set up the tunnels and StormDNS at the same time so the backups are ready. Each tunnel server allows one device at a time.
Is it safe to use a VPN in Iran?
VPN use is very common in Iran, but the authorities restrict it and the rules and enforcement can change. Our protocols are built to look like ordinary web traffic, and we keep no activity logs, so we don't record the sites you visit. We can't give legal advice, and no service can promise that nobody will ever notice a VPN.
Can I pay with cryptocurrency?
Yes. We accept Bitcoin and Lightning through BTCPay, and other coins through Cryptomus. Card and PayPal are accepted too, which is often easier for family members paying from abroad.
What if I need help setting it up?
Real people answer support tickets at portal.premiervpn.net and email at [email protected]. We can help you choose a protocol, set up the tunnels or get StormDNS working.
Ready before you need it

Stay connected from Iran

VLESS in the app for everyday use, tunnels and StormDNS for the hard days. 50% off your first year with code ANNUAL50, and you can pay with Bitcoin or Lightning.

Get PremierVPN: 50% off See pricing
  • No activity logs
  • UK-based
  • Bitcoin and Lightning
  • 30-day money-back

Stay Ahead of Online Threats

Get VPN tips, security insights, and exclusive offers delivered straight to your inbox. No spam — just the essentials.

Unsubscribe at any time. We respect your privacy.

PremierVPN Support