Russia Vpn Ban Which Services Still Work After Roskomnadzor

As of 2026, standard VPN protocols (OpenVPN, WireGuard) no longer work in Russia due to DPI blocking. Use instead NaiveProxy (disguises as HTTPS), Shadowsocks with obfuscation, or custom proxy solutions that don’t announce themselves as VPNs. Self-hosted solutions on foreign VPS providers are more reliable than commercial VPN apps. Pre-position credentials before entering Russia, use multi-hop routing through neighboring countries, and maintain offline copies of circumvention tool setup instructions.

How Roskomnadzor’s DPI System Works

Roskomnadzor operates TSPU (Technical Means for Countering Threats) equipment installed at ISP level across Russian networks. Every major ISP is required by law to route traffic through this hardware, which performs deep packet inspection in real time. The system identifies VPN traffic through several methods:

Protocol fingerprinting: WireGuard’s handshake has a distinctive header structure (first byte patterns, packet timing, port defaults). OpenVPN is identified by its TLS certificate structure and control channel behavior.
Statistical traffic analysis: VPN traffic produces characteristic entropy patterns — high uniformity, consistent packet sizes, regular keepalive intervals — that differ from typical HTTPS browsing.
IP blocklists: Known VPN server IP ranges are blocked reactively. Major commercial VPN providers’ IP ranges are comprehensively listed.
Active probing: When TSPU suspects a server may be hosting a VPN, it sends connection probes. Servers that respond in VPN-characteristic ways are added to blocklists.

Commercial VPN apps are particularly vulnerable because they use known IP ranges, identifiable app signatures in TLS SNI fields, and server infrastructures that have been catalogued by blocking authorities over years.

Technical Approaches That Remain Functional

Self-Hosted WireGuard with Custom Ports

Despite the crackdown, self-hosted WireGuard setups with non-standard port configurations remain viable. The key is avoiding ports 51820 and 51821 (WireGuard’s defaults), which are now actively monitored.

A basic WireGuard server configuration using port 443:

# /etc/wireguard/wg0.conf on server
[Interface]
PrivateKey = <server-private-key>
Address = 10.0.0.1/24
ListenPort = 443
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT
PostUp = iptables -A FORWARD -o wg0 -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = <client-public-key>
AllowedIPs = 10.0.0.2/32
PersistentKeepalive = 25

Client configuration connects to port 443, making the traffic appear as standard HTTPS:

# Client wg0.conf
[Interface]
PrivateKey = <client-private-key>
Address = 10.0.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = <server-public-key>
Endpoint = your-server-ip:443
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

This approach works because port 443 traffic cannot be blocked without disrupting legitimate HTTPS browsing. However, TSPU can still perform statistical fingerprinting on WireGuard traffic regardless of port. Pair this with AmneziaWG (a WireGuard fork that randomizes header fields) for better evasion.

AmneziaWG: WireGuard with Anti-Fingerprinting

AmneziaWG is a fork of WireGuard developed specifically to defeat Russian DPI. It adds configurable junk data injection and packet header obfuscation:

# AmneziaWG additional parameters in wg0.conf
Jc = 4       # Junk packet count (sent before handshake)
Jmin = 40    # Minimum junk packet size
Jmax = 70    # Maximum junk packet size
S1 = 0       # Init packet junk size
S2 = 0       # Response packet junk size
H1 = 1       # Custom init packet header
H2 = 2       # Custom response packet header
H3 = 3       # Custom cookie reply header
H4 = 4       # Custom transport header

The randomized headers break the pattern matching TSPU relies on for WireGuard identification. AmneziaWG clients are available for Android, iOS, macOS, Windows, and Linux.

Obfsproxy with Tor

For users requiring additional obfuscation, running Tor bridges through obfsproxy provides another layer of protection. Roskomnadzor has limited capacity to identify all bridge types, particularly those that rotate regularly.

Install and configure obfs4:

# Install Tor and obfs4proxy
sudo apt install tor obfs4proxy

# Edit /etc/tor/torrc
Bridge obfs4 192.0.2.1:443 <fingerprint> cert=<cert> iat-mode=2
BridgeRelay 1
PublishServerDescriptor 0

The iat-mode=2 setting enables packet padding, making traffic patterns less distinguishable from random data.

Shadowsocks with SIP002 URI Format

Shadowsocks remains functional when configured with AEAD ciphers (chacha20-ietf-poly1305 or aes-256-gcm). The protocol’s encryption wrapper makes it difficult for DPI systems to distinguish from regular HTTPS traffic.

Server setup:

# Install shadowsocks-libev
sudo apt install shadowsocks-libev

# /etc/shadowsocks-libev/config.json
{
    "server": "0.0.0.0",
    "server_port": 8388,
    "password": "your-secure-password",
    "method": "chacha20-ietf-poly1305",
    "mode": "tcp_and_udp",
    "fast_open": true
}

Client configuration using ss-local:

ss-local -s your-server-ip -p 8388 -k your-secure-password -m chacha20-ietf-poly1305 -l 1080

Combine this with a SOCKS5 proxy to your local machine for full tunnel functionality.

VLESS Protocol with Reality

The VLESS protocol, combined with the Reality TLS fingerprint, provides one of the most resilient options against current detection methods. Reality uses genuine TLS certificates from popular CDNs, making protocol identification extremely difficult.

Server configuration (using Xray):

{
  "inbounds": [{
    "port": 443,
    "protocol": "vless",
    "settings": {
      "decryption": "none",
      "clients": [{
        "id": "your-uuid-here",
        "flow": "xtls-rprx-vision"
      }]
    },
    "streamSettings": {
      "network": "tcp",
      "security": "reality",
      "realitySettings": {
        "show": false,
        "dest": "www.microsoft.com:443",
        "xver": 0,
        "serverNames": ["www.microsoft.com"],
        "publicKey": "your-public-key",
        "shortId": "your-short-id"
      }
    }
  }],
  "outbounds": [{
    "protocol": "freedom",
    "tag": "direct"
  }]
}

This configuration forwards traffic through Microsoft’s TLS, making it appear as legitimate browsing to external observers.

Network-Level Implementations

DNS over HTTPS with Encrypted SNI

Combining DNS over HTTPS (DoH) with encrypted Server Name Indication (ESNI) provides both DNS resolution privacy and connection metadata protection. While ESNI has been replaced by Encrypted Client Hello (ECH), properly configured clients still benefit from reduced metadata leakage.

Using cloudflared on Linux:

# Install cloudflared
wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64
sudo mv cloudflared-linux-amd64 /usr/local/bin/cloudflared
sudo chmod +x /usr/local/bin/cloudflared

# Run as a DoH proxy
cloudflared proxy-dns --port 53 --upstream https://1.1.1.1/dns-query --upstream https://1.0.0.1/dns-query

Configure your system to use 127.0.0.1 as the primary DNS resolver.

WireGuard + Stunnel Combination

For environments where WireGuard alone fails, wrapping WireGuard traffic within a stunnel provides additional camouflage:

# /etc/stunnel/stunnel.conf
[wireguard]
accept = 8443
connect = your-wireguard-server:51820
client = yes

# Using ncat to tunnel WireGuard through stunnel
ncat -proxy localhost:8443 -shut -exec /usr/bin/wg-quick up wg0

This creates multiple layers of indirection that DPI systems must unwrap to detect the underlying WireGuard traffic.

Choosing Your VPS Provider

Self-hosted solutions require a foreign VPS. Several practical considerations apply when selecting one for circumvention use:

Jurisdiction: Choose providers outside Russia, Belarus, and the CIS. EU-based providers (Hetzner in Germany/Finland, OVHcloud in France) have no legal obligation to assist Roskomnadzor. Singapore and Japan-based providers are also reliable choices.

Payment privacy: Pay with cryptocurrency if the service allows it, or use privacy-preserving payment methods. Your account registration creates a legal trail even if your traffic is encrypted.

IP range freshness: Avoid VPS providers whose IP ranges are already known to Roskomnadzor. Smaller, less-known providers are less likely to have their ranges pre-blocked. Check your server IP against blocklists before deploying.

Bandwidth: Obfuscated protocols are more CPU-intensive than raw WireGuard. A VPS with 1 CPU and 1GB RAM is sufficient for a single user, but increase resources if routing multiple connections.

Practical Recommendations

When operating in Russia or connecting to services within the country, consider these practical guidelines:

Rotate server locations: Using servers in neighboring countries (Finland, Estonia, Latvia, Georgia) provides better uptime than Russian-based servers, which face the most aggressive blocking.
Maintain multiple configurations: Keep at least two or three different protocol configurations ready. When one fails, switch immediately to another.
Use domain-fronting: Configuring your VPN endpoint behind a major CDN domain (AWS, Cloudflare, Azure) makes traffic pattern analysis significantly harder.
Monitor connectivity: Set up simple health checks that detect connection failures within seconds:

#!/bin/bash
# Simple VPN health check
while true; do
    if ! ping -c 1 -W 2 10.0.0.1 > /dev/null 2>&1; then
        echo "Connection lost, switching configuration"
        # Trigger your failover script here
        wg-quick down wg0
        wg-quick up wg0-alt
    fi
    sleep 10
done

Pre-position credentials: Download all configuration files, client applications, and setup instructions before traveling to Russia. Access to circumvention tool download sites (GitHub, etc.) may itself be blocked on arrival.
Use mobile data as a fallback: Russian mobile carriers (MTS, Beeline, MegaFon) sometimes implement DPI less aggressively than fixed-line ISPs, particularly for roaming SIMs from neighboring countries. A Georgian or Armenian SIM used on Russian mobile networks may bypass TSPU entirely, since the roaming traffic is routed through the foreign carrier’s network before entering Russia.

Protocol Comparison Summary

Protocol	Obfuscation Level	Speed	Setup Complexity	Recommended Use
WireGuard (default)	None	Very Fast	Low	Blocked in Russia
AmneziaWG	High	Fast	Medium	Best for WireGuard users
Shadowsocks + AEAD	Medium	Fast	Low	Good general option
VLESS + Reality	Very High	Fast	High	Best resistance to DPI
obfs4 over Tor	Very High	Slow	Medium	Maximum anonymity
WireGuard + Stunnel	Medium	Medium	Medium	Layered fallback

The technical ecosystem continues evolving rapidly. Roskomnadzor’s capabilities advance alongside the detection methods used by privacy-conscious users. Staying informed about new protocols, configuration techniques, and community recommendations provides the best long-term strategy for maintaining internet freedom.

Built by theluckystrike — More at zovo.one