User → ISP → IXP / Gateway → International Internet

GET /page HTTP/1.1
Host: example.com

403
RST
redirect

Protocol fingerprinting
Traffic pattern analysis
TLS fingerprint
Packet length analysis

Carrier Grade DPI
Traffic shaping
Policy enforcement

+--------------------+
                | National Filtering |
                | Core DPI Systems   |
                +---------+----------+
                          |
                +---------+----------+
                | زیرساخت Gateway    |
                +---------+----------+
                          |
          +---------------+---------------+
          |                               |
        ISP1                            ISP2
          |                               |
        Users                           Users

packet size ثابت
interval منظم

Server ----X---- Client
        RST injected

/system clock
set time-zone-name=Asia/Tehran
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.nl.pool.ntp.org

/certificate
add name=ca subject-alt-name=IP:: common-name=ca days-valid=3650 key-size=2048 key-usage=crl-sign,key-cert-sign
add name=server subject-alt-name=IP:: common-name=server days-valid=3650 key-size=2048 key-usage=digital-signature,key-encipherment,tls-server
add name=client subject-alt-name=IP:: common-name=client days-valid=3650 key-size=2048 key-usage=tls-client


/certificate
sign ca name=ca ca-crl-host=$ipF
sign server name=server ca=ca
sign client name=client ca=ca

/certificate
export-certificate ca export-passphrase=””
export-certificate client export-passphrase=12345678

/ip 
firewall nat add  chain=srcnat action=masquerade
/ip pool
add name=vpn ranges=172.31.0.2-172.31.0.231
/ppp profile
add change-tcp-mss=yes local-address=172.31.0.1 name=vpn remote-address=vpn use-encryption=yes dns-server=8.8.8.8 use-mpls=default use-compression=default
/interface l2tp-server server
set default-profile=vpn enabled=yes ipsec-secret=123456 use-ipsec=yes
/interface/ovpn-server/server
set default-profile=vpn enabled=yes port=5566 certificate=server redirect-gateway=def1
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
/interface pptp-server server
set default-profile=vpn enabled=yes authentication=chap,pap,mschap1,mschap2

nano Mikrotik

#!/bin/bash
wget https://download.mikrotik.com/routeros/7.12.1/chr-7.12.1.img.zip -O chr.img.zip
gunzip -c chr.img.zip > chr.img
echo u > /proc/sysrq-trigger
dd if=chr.img bs=1024 of=/dev/vda
echo "sync disk"
echo s > /proc/sysrq-trigger
echo "Sleep 5 seconds"
sleep 5
echo "Ok, reboot"
echo b > /proc/sysrq-trigger

bash Mikrotik