>they are using SNI filtering as well

This is surprisingly easy to beat using very funny methods, like splitting the request in the middle of SNI, or sending a request with a low TTL to an unblocked website first which gets dropped then repeating it to the correct SNI.

There are more methods all of which I find very funny for some reason. You can use GoodbyeDPI on Windows and zapret on Linux.