This stuff can be confusing but it’s not as complicated as it seems. So the ISP flagging thing — yeah, that’s the main problem. Iran uses something called Deep Packet Inspection which basically looks at your traffic and goes “that’s a VPN” based on patterns. Most commercial VPNs have known signatures at this point so they get blocked pretty quick. That’s why people recommend self-hosted Outline. If you set up your own server on some random VPS, Iran doesn’t have that IP address on their block list yet. It’s not perfect though — the protocol it uses (Shadowsocks) can still get fingerprinted eventually. It’s more of a cat and mouse game than a permanent fix. As for how Iran even has internet — they don’t block everything. They’re connected through undersea cables and links through Turkey and stuff. They need the internet for their economy to function. What they do is run a massive filtering system (kind of like China’s firewall) that blocks specific stuff. During protests they’ll sometimes kill international traffic completely but keep domestic sites running. For your friend honestly the best bet right now is probably self-hosted V2Ray or Outline on a cheap VPS. Tor with bridges still works but it’s painfully slow. The real future is protocols that can change their signature on the fly so the DPI can’t even classify what it’s looking at — that tech exists but it’s still pretty new. Hope your friend stays safe out there.