There are numerous ways to block undesirable traffic.
- Identify all the connections to the outside world
- Instruct the owners of those connections to:
- Block certain websites based on their IP (ie, don't route packets addressed to certain IPs on a block list)
- Block DNS results based on wildcards (so *news* might block all DNS requests that have "news" anywhere in their name)
- Use a packet inspector to monitor HTTP and other traffic for keywords, and send a TCP disconnect packet if certain triggers on the content are seen.
- Block non port 80 and 25 traffic
Note that the gov't can't control all the ISPs (those with satellite phone data plans are ok since the company doesn't have an office in the country they can put pressure on).
Further, some tactics can't be used due to the burden - the packet inspector, running on even a relatively slow 10gbps trunk line requires a ton of processing power and speed to keep up with traffic. Compromises must be made.
On the other hand, 99% of the people in the country are going to be stymied by a simple DNS blocking scheme. Those that can get past that easily will also be able to get around most of the other block anyway.
The goal of such a program isn't to prevent anyone from having access, it's to capture the greatest portion of the public and make sure they are getting your message and only your message.
In political battles that's usually sufficient.