Russia’s renewed push to stop VPNs. Bypassing website blocks will become increasingly difficult, experts warn

Russian authorities have been ramping up their control over the internet for several years now, with the censorship agency, Roskomnadzor (the Federal Service for Supervision of Communications, Information Technology and Mass Media), particularly keen to block virtual private networks (VPNs), services that allow Russians to bypass heavy online censorship introduced with the onset of the war in Ukraine. The government has tried to force services to comply with its heavily swollen blacklist, and those who have refused have also been blocked. Last spring, Roskomnadzor began to fight not just individual services, but outright banning entire VPN protocols. This ban was short-lived, but it appears that the censors are returning to this practice on a larger scale.

On Monday, August 7, VPN users in Russia noticed problems connecting to their servers. IT specialist Philipp Kulin was one of the first to notice this, writing about it on his Telegram channel, and hundreds of users shared their observations. The picture was contradictory: same carrier could have users with VPNs blocked and VPNs working perfectly fine. In some regions, some users had difficulties connecting, while others experienced no technical problems. A Mediazona reporter polled his Twitter audience achieving the same result.

That same evening, the creator of the AntiZapret service for bypassing blocks, who goes by the name ValdikSS, published a post in which he described his tests on different types of connections and their blocking. He concluded that connections from Russia to servers abroad were predominantly blocked, specifically those of mobile carriers, and that these blocks were significantly different from previous ones.

This time, the crackdown targeted not popular commercial services available to everyone, but private servers that users set up with foreign providers. The approach also changed: ValdikSS believes that Roskomnadzor, using DPI (Deep Packet Inspection) and TSPU (short for “Technical Means to Counter Threats”), assessed the type of traffic and immediately blocked it if identified as a VPN connection. Popular protocols such as WireGuard, L2TP, and OpenVPN were blocked.

According to Stanislav Shakirov, Technical Director of Roskomsvoboda, a digital rights organisation, and founder of Privacy Accelerator, these are “no stupid blocks.” In his opinion, the censors are trying to ensure that the VPN blockade affects only private individuals and does not impact corporate clients.

Vladislav Zdolnikov, creator of RedShield VPN, agrees with him, believing that the authorities previously did not block VPN protocols because they “negotiated with big businesses to exclude addresses so as not to collapse their commercial tunnels.” Back in 2021, the Central Bank sent letters to banks requesting the names of the VPN services they used, so as not to harm credit institutions.

VPN (Virtual Private Network): This technology allows computers to be combined into a “private” network over the internet, as if they were directly connected, even if they are far apart. It can be used to link any devices or even entire local networks, such as offices or branches of a company. The VPN connection is encrypted, so an external observer, such as a provider, only sees encrypted traffic. This has led to VPNs being used to access blocked news websites and social media in Russia.

DPI (Deep Packet Inspection): This method analyses the content of data packets, even if they are securely encrypted. Observers cannot read the content but can understand, for example, which site the user is contacting and by which data exchange protocol.

TSPU (Technical Means to Counter Threats): Devices installed by Roskomnadzor at internet providers under the Sovereign Internet law to control user traffic: to study it using DPI, slow it down, or even block it entirely.

DNS (Domain Name System): A phone book of the internet, connecting site and server addresses in numerical values with familiar web addresses. Modern technologies like DNS over HTTPS (DoH) and DNS over TLS (DoT) try to hinder eavesdropping by encrypting DNS queries; last year, Russian authorities proposed to ban their usage.

Experts seek ways to bypass the new approach

On ntc.party, an IT forum, methods to thwart DPI technology are being widely discussed. Specifically, users advise sending harmless requests so that the blocking system marks the connection as permitted, and then connecting via VPN. However, this method requires serious skill and is not suitable for ordinary users.

The authors of the VPN Generator, a Telegram channel, promised a solution, “to stop which, one would have to completely cut off the entire internet.” They also described the apparent side effects of the new blocking approach: “Many have lost access to video surveillance (free for all!), ordinary businesses can’t reach their servers, and connectivity between branches has been destroyed.”

Shakirov from Roskomsvoboda advises ordinary users to install several VPN or VPN-like apps, such as Psiphon, Lantern, Amnezia, and Tor. “So far, something has always kept working, no matter what happened.”

“If suddenly nothing works, you need to wait a few days because it takes time for the developers of all these systems to update their software,” he explains. “First, it takes time to write it. Then it takes some time for the release to be approved in the Apple Store and Google Play.”

Experts also mention the Shadowsocks and XTLS protocols, which allow VPN connections that are difficult to detect by Roskomnadzor’s methods. They were used in China to overcome the Great Firewall and are now widely used in Russia. However, Roskovsvoboda believes these will be the next targets for Roskomnadzor.

What happens next

Stanislav Shakirov of Roskomsvoboda is convinced that ultimately, Russia will adopt the “Chinese model” of the internet, a system almost entirely autonomous from the global network, where global platforms like YouTube or Facebook are blocked and replaced with domestic alternatives. However, he holds that means to circumvent these blocks will still exist, but will increasingly require more complex and sophisticated methods.

Vladislav Zdolnikov echoes this sentiment. “As access becomes more complicated, the number of people accessing alternative information will inevitably shrink,” he says.

For Philipp Kulin, this substantial shift in the approach might stimulate IT companies to actively combat censorship: “Let’s put it this way, Roskomnadzor’s battle with VPNs until just the other day was a ‘strange war.’ They were merely shoving each other around. But now, it’s a real war,” he asserts.

Zdolnikov shares this perspective. “Currently, there’s a painful process of realization unfolding in the Russian IT community, visible in professional chat rooms,” he observes. “For several years, no one wanted to believe that the authorities would reach this point, and almost no one was willing to explore new tools. Now, the need for them is becoming apparent.”

He anticipates that protocols like OpenVPN and Wireguard will be blocked, rendering almost all services previously unnoticed by Roskomnadzor inaccessible to Russian users. He adds that at RedShield VPN, they have already begun working on ways to camouflage VPNs to resemble other types of traffic, so that from the viewpoint of Roskomnadzor’s data analysis, it appears as though the user is simply accessing a standard, permitted website.

Editor: Dmitry Treschanin