In Russia, DPI systems which are used for censorship generally prevent accessing only blocked domain names or exact HTTP URLs. There's no proxy or VPN censorship in place, so unknown protocols are not getting discarded.

We still don't have national-wide firewall like that in China, each ISP (and we have 1000+ of them) performs censorship using either dumb IP blackholing (breaks a lot of legitimate stuff), on-path DPI (I call it "passive" in GoodbyeDPI, DPI which receive mirrored traffic and can only inject something but not prevent the connectivity per se), in-path DPI (DPI as a router/bridge).

Most DPI systems in Russia were specifically created for Russian censorship (i.e. capable only for HTTP URL and TLS SNI introspection), from scratch. Some ISP have their own in-house DPI systems. These systems were just not designed to handle packets fragmented on TCP or IP level at the beginning, because it's rarely the case in the real world.

If you want to learn more, visit internet censorship forum I created. I write about different DPI systems there and trying to document internet censorship in Russia as a whole. https://ntc.party/c/internet-censorship-all-around-the-world...