You are absolutely correct, I should have lead with that. Encrypted client handshake means no one can see what certificate you are trying to request from the remote end of your connection, even your ISP.
However, It’s worth noting though that if I am your ISP and I see you connecting to say public IP 8.8.8.8 over https (443) I don’t need to see the SNI flag to know you’re accessing something at Google.
First, I have a list of IP addresses of known blocked sites, I will just drop any traffic destined to that address, no other magic needed.
Second, if you target an IP that isn’t blocked outright, and I can’t see your SNI flag, I can still try to reverse lookup the IP myself and perform a block on your connection if the returned record matches a restricted pattern, say google.com.
VPN gets around all of these problems, provided you egress somewhere less restrictive.
Hope that helps clarify.
That makes sense! Believe it or not it’s actually easier for an ISP to block a whole country than select websites and services. We actually null route all Russian public IP space where I work, that would absolutely be plausible on a national scale as well.
It’s imperfect, you can get around it, but it catches 99% of normal users, which is the goal.