In the "white lists" is not listed

In Russia, sites and applications related to the Cloudflare web service are more often blocked. Why is this associated with testing the new Internet regulation system?

In 2025, disconnecting mobile Internet and blocking foreign services became ordinary. But since last year, mass malfunctions on the Internet were also added to them. So, in August 2024, most Russians did not open Telegram, WhatsApp, Skype, Discord, Steam, Wikipedia and “State Services”. On January 6, 2025, the services of MTS, T-Bank, Sberbank VK, Yandex, Beeline ceased to open, and after only eight days, the problems in addition touched Tiktok, Google and Twitch. The malfunctions were repeated on March 20, and then on May 15.

All of these failures combine three factors. Firstly, they were not observed all over the world, but only in Russia. Secondly, the malfunctions were short-lived and were observed both in foreign and Russian services. Thirdly, none of these sites was officially entered by Roskomnadzor in the register of prohibited. In June 2025, another generalizing feature of mass failures became known. The leadership of the Cloudflare web service, which serves most of the listed sites and applications, accused the Russian authorities of limiting traffic in the Russian Federation. And later it turned out that restrictions can also be associated with testing the new site regulation system - “white Internet lists”. Novyevropa tells how and why in Russia they limit the Internet sites more and more and whether this will lead to the creation of a sovereign Internet.

What is Cloudflare

The name of this company is far from IT people speaks little - however, the work of approximately 20% of all sites in the world depends on it. Cloudflare began with a simple determination of the sources of Internet spam in e-mail, and in 2009 it turned into a full-fledged cybersecurity service. The company provides advanced protection against DDOS attacks and automated phishing mailings, and also does not allow bots to go to sites and load servers.

The founders of the company argue that with Cloudflare all sites are loaded 30% faster, since they do not need to serve bots.

In addition to Cloudflare cyber protection, its own servers are rented at different points in the world. The company's data centers are located in 125 countries, including China. And site owners, providers and corporations can be connected to the global Cloudflare network directly without adjusting the traffic manually. Simply put, the current CloudFlare provides almost everything that is needed for convenient management of the site or web service.

At the same time, Cloudflare remains invisible to most of users. The fact that any site uses Cloudflare services can only be found out when showing a special page for checking the browser. On this, the interaction with the service usually ends.

This is how the browser verification page looks like Cloudflare verification. Source: Cloudflare

Among the company’s clients are Apple , a gaming social network for Discord calls, a website for Canva designers, a network of supermarkets Walmart , Openai , which created the neural network of Chatgpt, and many others. Hundreds of VPN, Steam, Twitch, DeepSeek and Duolingo digital store are not without access to Cloudflare.

Among Russian companies using Cloudflare services are T-Bank, Ozon, Cyan, TASS and Kaspersky. In 2019, Cloudflare also held a joint mitap with Yandex in Moscow, where the trends in cybersecurity were discussed. In addition, Cloudflare owns the data centers in Moscow and St. Petersburg and planned to open new servers in Novosibirsk.

Cloudflare has publicly refused to stop working in Russia and until 2024 continued to release news in its blog in Russian. The company supported Ukraine, but at the same time announced the continuation of support for Russian users.

“In addition, we received several calls with a request to stop working all Cloudflare services within Russia. We carefully examined these requests and discussed them with experts from the government and civil society. Our conclusion, made on the basis of consultations with these experts, is that Russia needs more Internet access, and not less. As the conflict continues, we are observing a sharp increase in the number of Russian networks to the world media, which reflects the desire of ordinary Russian citizens to get acquainted with world news besides those that are provided in Russia, ” said Cloudflare, Matthew Prince.

In 2025, Cloudflare first entered the list of 100 most influential companies in the world according to Time magazine. The publication noted the efforts of Cloudflare to protect public services from hacker attacks in the US presidential election in 2024.

Why RKN wants to get rid of Cloudflare

Cloudflare is not the only web service that provides services to sites. Among its famous competitors, for example, Amazon Web Services (AWS), Google Cloud and Microsoft Azure. Many companies use two services at once - for example, CloudFlare for protection and AWS for hosting.

However, Cloudflare differs from well -known analogues in that he officially worked in Russia until 2025. For example, Amazon did not have Data Centers in the Russian Federation, and in 2022 the company publicly stated that it never cooperated with the Russian authorities and no longer accepts applications for connecting from Russian and Belarusian companies. Last year, Microsoft also announced the termination of service of Russian companies.

In other words, the Russian authorities did not even have to resort to blocking these services in Russia. Cloudflare held to the last until Roskomnadzor paid attention to her in November 2024.

The department advised the owners of Russian sites to refuse Cloudflare services, referring to the company's cooperation with the US State Department. Also, the official reason for claims was the introduction of Encrypted Client Hello (Ech) technology, which allows you to anonymously use blocked sites without using VPN.

Among other things, Ech hides information from providers about which sites the user enters. Roskomnadzor said that Encrypted Client Hello violates Russian legislation, and recommended to switch to the domestic web service “National Countering DDOS Atams”, which was launched in March 2024. Since then, according to the agency, more than 5,000 Russian companies have connected to it, including banks, telecom operators and state structures.

Apparently, it was the appearance of Encrypted Time Hello technology that made Roskomnadzor take up Cloudflare blocking. But the actions of the department can hit Russian companies. Cloudflare services were used by approximately 44% of all Russian domains with DDOS attacks, including online stores and media. In the comments of Kommersant, the head of the cybersecurity department of the EDGECTRICENTR Maxim Bolshakov and the founder of the Internet Wall, Igor Bederov, noted that the blocking of Cloudflare will lead to a decrease in the level of protection against DDOS attacks, and Russian analogues cannot completely replace a foreign service and are far from so reliable.

According to Cloudflare itself, Roskomnadzor slows down all its traffic in Russia and allows users to load only the first 16 kilobytes of web resources, cutting them off from the Open Internet. Among the providers using restrictions are Rostelecom, Megafon, Vimpelcom, MTS and MGTS. Due to the restrictions on the traffic Cloudflare in Russia fell by 30%. Roskomnadzor claims that he has nothing to do with this, but advises to quickly switch to Russian analogues of the service.

How RKN wants to build sovereign Internet using "white lists"

The slowdown of Cloudflare in Russia directly affects the availability of VPN and many foreign services. Not only specialized publications like Roskomvoboda , but also entertaining ones, indicated, for example, the CyberSport and the Championship video game, and the championship video. The inaccessibility of many sites, with reference to subscribers, was also indicated by the head of the Safe Internet League Ekaterina Mizulina.

The restriction of the entire CloudFlare traffic would be impossible when using old locking methods. Earlier, the department preferred to limit the work of specific sites and services, but the lock could be circumvented using VPN and proxy. However, since April 2025, Roskomnadzor has been using the White List of foreign encryption protocols, which include 75 thousand permitted IP addresses for Russian companies.

The technical publication Digital Report believes that the agency already applies the “White List” on all Russian sites and tests with its help a closed sovereign Internet in the manner of the “Great Chinese Firevol”. The executive director of the Internet Protection Service Mikhail Klimarev and a team of experts on digital law Tech Talk wrote about testing the White Lists.

The White List is a list of all sites that allow access to a specific resource. For example, with the help of such a list, company administrators can block the entrance to corporate resources to all IP addresses that do not belong to their employees.

By the definition of Mikhail Klimarev, the “White List” implies the ban on everything that is not allowed in the list of Roskomnadzor. That is, in the worst situation, the department will not allow to enter blocked sites even using VPN.

The author of the telegram channel "Spare Airfield" Ilya Vaitsman, who specializes in the news about the restrictions on the Internet, also indicates testing of locks according to the model of "white lists". In his opinion, such hard restrictions can still be bypassed using VPN on Vlas and Trojan protocols, but the Russian authorities still “slam everything that have been able to determine at least somehow”.

Help "New-Europe"
What are the VPN Vlas and Trojan protocols?

All VPN applications work using special protocols that establish a connection between the user device and the VPN server. Each protocol differs from another in a specific set of methods of encryption and routing of traffic. The reliability and speed of VPN depends on the protocol. Simply put, the protocol acts as a virtual “tunnel” for your traffic, which allows you to connect with a certain VPN.

Vless is the latest open platform protocol for creating your own VPN V2RAY. Compared to other protocols, it loads the processor less and is better optimized. Trojan is an alternative option for the same V2ray that is more difficult to detect and block. Both protocols are considered quite effective and reliable in comparison with the outdated OpenVPN and Shadowsocks, which are already unstable in Russia.

Will the Russian authorities manage to introduce the “white lists” system?

“White lists” are far from a new idea. So, back in 2023, Turkmenistan limited the work of all foreign sites and public domains that are not included in the “white lists” of the country. Because of this, residents of the country cannot use foreign social networks Facebook and Instagram, YouTube and play popular online games like Counter-Strike 2 and GTA Online. According to Turkmen News, certain sites are included in the “white list” for bribes from 1-2 thousand dollars per month.

In addition, the “white lists” model used the military junta of Myanmar, which in 2021 banned residents of the country access on Facebook and Twitter, but allowed the use of WhatsApp, LinkedIn, Viber, Zoom and VK. Since 2020, the Internet is regulated by the “White Lists” model in Iran.

In Russia, they also thought about “white lists” - and back in 2014. Then the “Safe Internet League”, headed by Mizulina, suggested introducing a list of permitted sites for all residents under 18 years of age. In June 2017, Roskomnadzor accidentally blocked Yandex, VK and its own website. Five days later, the department compiled a “white list” of 2000 sites that cannot be blocked by providers. And in September 2017, he publicly abandoned him.

According to Mikhail Klimarev, what is happening with Cloudflare is still not directly related to “white lists”. He prefers to use the term “gray lists” - a method of random locks of certain hosting. A new type of restrictions, an expert believes, can lead to an increase in prices for hosting services in Russia, blocking many VPNs and an increase in the number of hacker attacks on Russian sites.

Ilya Vaitsman believes that even tough restrictions on “white lists” can be circumvented. He indicates that the existing equipment for blocking for providers works heterogeneous, outdated and periodically fail. The filtering system is far from perfection, since the equipment may not withstand the load and put users on blocked sites until Roskomnadzor manually configures restrictions. Also, Russia, like other countries in the world, does not have sufficient resources to regulate the entire Internet - even in China, users manage to bypass the “great firewall”.

RKN did not confirm information about the blocking of Cloudflare. But the department has already prepared the draft check sheet, which will oblige all providers to disclose through which devices the traffic passes and who has access to it. Probably, the Russian authorities still intend to censor the Internet even more.