Indonesia's X Blockade: DNS, IP, SNI, and DPI Techniques Explained

Indonesia implemented a nationwide block of X (formerly Twitter) in September 2024, following government orders to restrict access to the platform. The blockade employed multiple technical layers—DNS filtering, IP address blacklisting, Server Name Indication (SNI) inspection, and deep packet inspection (DPI)—that operate simultaneously to prevent users from reaching the service. Understanding how each method works, and how it appears to end users, clarifies both the engineering approach and the surveillance infrastructure required to sustain such blocks.

The Indonesian government, through the Ministry of Communication and Informatics (Kementerian Komunikasi dan Informatika, or Kominfo), issued the blocking order on September 2, 2024, citing concerns about content moderation and national security. Internet service providers (ISPs) began enforcement shortly after. Unlike blocks in other jurisdictions that target a single mechanism, Indonesia's approach stacked multiple techniques—a strategy that reflects both technical redundancy and an implicit acknowledgment that any single layer can be circumvented.

At the DNS level, ISPs configured their recursive resolvers to return NXDOMAIN or sinkhole responses when users query for x.com, twitter.com, and related domains. A user attempting to visit X would see a timeout or an error page, often served by the ISP itself. This is the most visible blocking technique: users typing x.com into a browser receive no valid IP address, and the connection fails before it begins. OONI (Open Observatory of Network Interference), which operates measurement nodes across Indonesia, documented this DNS filtering through its DNS consistency test, which compares responses from user-controlled resolvers to those from resolver networks operated by ISPs. When responses diverge—ISP resolvers return block pages while alternate resolvers return legitimate IP addresses—it indicates DNS-based filtering.

Parallel to DNS filtering, Indonesian ISPs blacklisted IP addresses hosting X's infrastructure. Public IP space assigned to Twitter/X was added to firewall rules at the ISP level, causing packets destined for those IPs to be dropped at the border gateway or upstream. A user who bypassed DNS filtering by manually entering an IP address (or by using a resolver outside the country) would still find the connection blocked at the IP layer. This is less visible to end users—they experience a timeout or connection reset—but it is measurable through traceroute analysis and OONI's TCP connectivity tests, which probe whether specific IP addresses are reachable.

More sophisticated is Server Name Indication (SNI) inspection. SNI is an extension of the TLS handshake that allows a client to specify which hostname it is trying to reach before the full encryption of the connection. By inspecting unencrypted SNI packets, ISPs can identify whether a user is attempting to connect to x.com even if they use a proxy or VPN that obscures the destination IP address. Governments and ISPs use SNI filtering because it operates before the full TLS connection is established—the ISP can reset the connection without needing to decrypt HTTPS traffic. OONI's TLS handshake test can detect SNI filtering by observing whether connections are blocked specifically when SNI is presented, versus when it is omitted.

Deep packet inspection (DPI) represents a further layer. DPI systems analyze packet payloads and flow metadata to identify application-level patterns. In the case of X, DPI might recognize behavioral signatures of the X client (patterns in API requests, certificate pinning behavior, or protocol-specific traffic shapes) and block connections matching those profiles. DPI is expensive to operate at scale and typically reserved for high-priority targets; its presence is harder to measure directly but can be inferred through OONI measurements that show blockage occurring even when other circumvention attempts are employed.

Documented measurement data from OONI probes in Indonesia showed consistent DNS blocking across major ISPs and partial IP-level blocking. Access Now's KeepItOn campaign documented the shutdown as one of 2024's largest social media blockades by user count. The blocking was not uniform: some ISPs implemented it more thoroughly than others, and effectiveness degraded over time as users adopted circumvention techniques.

Circumvention against these stacked techniques requires different tools for different layers. DNS filtering alone is bypassed by using DNS over HTTPS (DoH) or DNS over TLS (DoT) to resolvers outside Indonesia. IP blocking requires either a VPN tunnel, Tor, or a proxy that routes traffic through external infrastructure. SNI inspection can be defeated using encrypted SNI (ECH), which encrypts the hostname before sending it, or by using protocols like QUIC with encrypted ClientHello. Against DPI, protocols designed for obfuscation—including Shadowsocks, obfs4, REALITY/Vision, or Tor pluggable transports like Snowflake—can mask the application signature.

No single tool handles all layers. Users relying on DNS-over-HTTPS alone will still hit IP blocks. Those using standard OpenVPN or WireGuard with unobfuscated traffic may be vulnerable to SNI or DPI inspection at the ingress point. Effective circumvention often requires layered approaches: combining tunneling with traffic obfuscation, or using Tor over Snowflake to introduce additional indirection.

Indonesia's X blockade remains in place and serves as a real-world case study of how state-level blocking infrastructure combines multiple technical mechanisms. The block's persistence and partial effectiveness reflect both the sophistication of modern filtering and the ongoing arms race between circumvention and detection technologies.