Internet Censorship in Russia

Russia does not operate one national filtering switch. It runs a system of inspection equipment inside carrier networks, then layers legal requirements, platform rules and app-store pressure on top. The result varies by operator, region, device and time of day.

The useful question is which layer stops a connection, because that determines whether a tunnel can help. A VPN can move traffic around an address block or a protocol signature. It cannot create a path through a mobile network that has been reduced to an approved list of destinations.

Current situation#

The core of the system is TSPU, short for “technical means of countering threats.” These are hardware and software systems installed at telecommunications operators and controlled by Roskomnadzor, the state communications regulator, through the Main Radio Frequency Center. Operators carry the traffic. They do not decide what the filter does with it.

By October 2023, Roskomnadzor said TSPU covered every communications node in the country. The equipment can block addresses and domains, identify protocols, throttle traffic and enforce allowlists. It also gives the regulator a point inside each network where the same policy can be applied at scale.

The visible result is not uniform. Fixed-line users often encounter address and protocol blocks while domestic services continue to work. Mobile users can encounter something more severe: a whitelist shutdown in which the network carries only approved sites and services. Human Rights Watch dates the wider use of these shutdowns to spring 2025, and they have continued through 2026.

Scale is significant. By February 2026, the authorities had blocked at least 469 VPN services under the 2017 law that requires circumvention tools to respect the state blocklist. Human Rights Watch cites an estimate that about 40% of Russia’s population, or 57 million people, use a VPN. In August 2026, Human Rights Watch, citing Exploit, reported that 20 VPN providers had suffered service disruptions from blocking.

Those numbers describe pressure on circumvention, not the end of it. Some services remain reachable. Some protocols still work on some networks. The pattern is a moving target, and the sections below separate the layers that move.

Known techniques#

TSPU is the part most often described as a firewall, but the comparison hides the design. A national firewall usually sits at the border. TSPU sits at the operator, close to the subscriber. That placement lets the state apply different rules to different networks and lets it combine filtering with subscriber-level information held by the carriers.

The Russian system also uses the law as a filtering layer. The 2017 rules did not ban VPNs outright. They required VPN services not to provide access to blocked resources, and required operators to block services that failed to comply. Later measures added fines for VPN operators, banned VPN advertising, and made VPN use an aggravating factor in certain criminal cases. The effect is to raise the cost of running a service and to make some uses legally riskier than others.

Recent events#

February 2026. The count of VPN services blocked under the 2017 law reached at least 469. Around the same period, Human Rights Watch reported that Apple had removed 468 “utility” applications, a category that includes VPNs, from its App Store in 2025 in response to Russian requests.

15 April 2026. Major Russian sites and services began blocking visitors with active VPNs. The Moscow Times confirmed access denials on Ozon and Kinopoisk, with similar reports from banking and ride-sharing apps. The move coincided with a reported government deadline for more than 20 large platforms to curb VPN use.

June 2026. Russian authorities attacked Amnezia VPN with bulk IP blocking, phishing against staff and distributed denial-of-service traffic. One developer said full restoration took about six weeks. On 26 June, a law change prohibited Russian hosting providers from serving VPN services that bypass blocks.

4 August 2026. Human Rights Watch, citing Exploit, reported that 20 VPN providers had suffered disruptions. A representative told the organisation that the blocking targeted large IP ranges and entire subnets, which takes longer and costs more to replace than individual addresses.

21-25 September 2026. After the State Duma elections, ten VPN services reported tighter restrictions within a week. One large service said blocking peaked on 25 September. Another replaced eight servers in five days. Two others said Roskomnadzor had blocked all their foreign server locations and the IP addresses of all their servers. The VPN Guild described the wave as a continuation of pressure that began in early August, not a new campaign.

8 October 2026. Meduza reported that the draft federal budget for 2027-2029 would nearly double the annual TSPU subsidy to about 19.8 billion to 19.9 billion rubles. The three-year total is nearly 60 billion rubles for traffic filtering and internet blocking.

16 October 2026. Kommersant reported that a draft national AI plan through 2030 proposed using AI to identify VPN characteristics, with a claimed 95% blocking effectiveness. The Digital Development Ministry said the current draft contained no such measure. Industry sources said behavioural analysis could find VPN servers faster but would likely produce false positives during training.

27-29 October 2026. The Digital Development Ministry announced restrictions on mobile internet inside Moscow’s Third Ring Road during the Russia-Africa and Gas Exporting Countries Forum summits. The ministry said exempt websites, voice calls and Wi-Fi would remain available. The restriction is a temporary, location-specific version of the mobile allowlist model.

27 October 2026. Forbes reported that the Digital Development Ministry was considering routing all foreign traffic through TSPU equipment and capping each user’s foreign data. The proposal could cover home internet as well as mobile networks, and would likely be included in a telecom bill. The ministry said the measures were still under review. No final quota has been published.

Effects on users#

The first distinction is the access path. On a fixed connection, a working tunnel can still route around many address and protocol blocks. On a mobile connection under a whitelist shutdown, the network may carry only approved destinations, so the VPN endpoint is not reachable at all. Switching to Wi-Fi or a wired connection can change the result because the restriction is applied to the mobile path, not to the account.

The second is the type of block. A protocol signature can be defeated by changing how the traffic looks, but a bulk subnet block can remove every server in a provider’s range at once. Services respond by replacing addresses, which is why one provider can lose eight servers in five days and still operate. The cost is visible to users as reconnects, changed endpoints, slower speeds and intermittent failures.

The third is the platform layer. A VPN can be working at the network level and still fail against a Russian site that refuses connections from known VPN addresses. Ozon, Kinopoisk and other large services began doing this in April 2026. Some users respond with split tunneling or by disabling the tunnel for those services, which trades one kind of access for another.

Installation and payment are part of the same problem. App-store removals and payment restrictions make it harder to obtain a client after a block is announced. A client installed before travel, with configurations saved offline, is more useful than a download link that depends on the same network that is being filtered.

Relevant protocols#

WireGuard and OpenVPN are the clearest examples of a protocol problem. Both have recognisable wire formats. WireGuard’s fixed header and handshake make it easy to classify, and Russia blocked WireGuard traffic in 2023. OpenVPN has more configuration options, but its common profiles are also well known to filters. Obfuscated variants can change the signature, but they do not change the address, the volume of traffic or the fact that a single long-lived connection is carrying it.

VLESS inside REALITY addresses a different part of the problem. VLESS adds no encryption layer of its own, so there is no inner TLS session for a filter to detect. REALITY borrows the handshake of a real site, so a probe receives a genuine certificate instead of an answer from a VPN server. That removes two structural signals. It does not hide the server address, the amount of traffic or the behaviour of the target site.

Hysteria2 takes another route. It runs over QUIC and UDP, which can perform better on mobile links where packet loss is the main obstacle. It is not a universal answer. A network that throttles or blocks UDP can make it unusable, and a whitelist shutdown removes the path before the protocol matters.

The practical lesson is that protocol choice is one layer. Address diversity, hosting provider, probe response and operational testing decide whether a working configuration stays working. A strong protocol on a blocked subnet is still unreachable.

Maronix keeps improving its server configuration and setup against these findings, testing deployments on restricted networks and changing the details that stop working instead of treating one reachable setup as permanent.

Practical considerations#

• Install the client and save configurations before you need them. App-store access and account recovery can fail on the same network that blocks the service.
• Test mobile data and Wi-Fi separately. If mobile data is under a whitelist, a VPN will not restore it; a fixed connection may behave differently.
• Keep more than one transport and more than one endpoint. A single address is a single blocklist entry.
• Test the services you actually use, not just the tunnel handshake. A connection can open and still fail against a platform that rejects VPN addresses.
• Treat legal risk as separate from technical risk. Russian law restricts VPN advertising and treats VPN use as an aggravating factor in some criminal cases. This page describes network behaviour, not legal advice.
• Expect change. A configuration that works this week can fail after an enforcement wave, and the reason may be an address, a protocol signature or a platform rule rather than the tunnel itself.

Atlas articles#

• What Is Deep Packet Inspection? - the inspection layer TSPU relies on
• Why a VPN Can Work Today and Fail Tomorrow - the four ways a working tunnel stops working
• What Makes a VPN Resistant to Censorship? - protocol, address, provider, placement, probing and operations
• What Is VLESS? - the proxy core used inside REALITY
• What Is REALITY? - borrowed handshakes and probe resistance
• How Often Do Countries Shut Down the Internet? - shutdowns as a separate layer from filtering

Last reviewed October 30, 2026. Corrections and additions are welcome.