Roskomnadzor constantly blocks VPN protocols. Let's figure out what they are and which ones still work

The two most popular VPN protocols, OpenVPN and WireGuard, do not work in Russia without major modifications. It's all about recognizable signatures that Roskomnadzor easily recognizes. But what exactly are these: protocols and signatures?

The “paper” explains what to look for when choosing a protocol, why some are easy to block and others are not, and who wins the technical race between Roskomnadzor and the creators of VPNs.

What happens when you turn on the VPN and what do the protocols have to do with it?

A VPN protocol is a set of rules by which your device “talks” to a server. When connected, the VPN server and your device agree on a shared encryption and keys to it, a process called a “handshake.” After it, all your traffic is packed inside VPN packages and encrypted. The provider only sees that you are constantly “talking” to one point, that is, connected to one specific server, but does not see the content.

It is the protocol that determines how data packets are formed and encrypted, how often service messages are sent, how keys are updated, and how they are transmitted between your device and the server - via UDP or TCP.

UDP, i.e. User Datagram Protocol, and TCP, i.e. Transmission Control Protocol, are two of the most popular transport protocols. To avoid confusion with VPN protocols, we will simply call them “transports”.

TCP is a "transport" that establishes a connection, keeps track of the order of packets, and confirms delivery, so it is more reliable, but usually slower. Compared to regular transport, the TCP is a reliable bus that can easily get stuck in a traffic jam.

And UDP is simpler and more mobile, like, for example, an electric scooter. This is a fast “transport” without establishing a connection and without guarantees that the packets will arrive or arrive in order, so it is often used where speed is more important than perfect accuracy, as in streaming or voice communications.

For example, the WireGuard VPN protocol always uses UDP, and its first hello message is a UDP packet of a strictly defined length with a “one-time” 32-byte public key inside. Despite the encryption, the shape of these packets, their size and sequence form a unique “pattern”, which makes it clear that this is WireGuard, and not a regular video or browser request.

This set of repeating features of a protocol is its signature, the protocol’s fingerprint in traffic. Thanks to it, Russian deep traffic analysis systems can guess that a VPN is being used and block the connection.

Which protocols work in Russia and which no longer exist?

VPNs were originally invented for office networks so that employees could securely connect to work servers. Therefore, the first VPN protocols were designed for corporate purposes and were poorly suited for ordinary users. But at the beginning of the 2000s OpenVPN appeared.

It was invented by programmer James Yonan. According to legend, while traveling in Central Asia, he had to connect to a work server through dubious Internet providers. He didn't like it, so he decided to create a secure, yet flexible and convenient VPN.

OpenVPN is an open protocol that builds an encrypted tunnel with TLS, a special “transport” security protocol. Simply put, OpenVPN can be configured to use either UDP or TCP as a “transport”, but this will not affect security because it is protected by TLS on top.

For a long time, OpenVPN was the gold standard for commercial VPN services: it offered a good balance of speed and security, and was open - it could be tested for security and modified. But this versatility came at the cost of long code, complex configurations, and a recognizable signature.

The WireGuard protocol was invented as the opposite of OpenVPN - minimal code and modern encryption. WireGuard uses only UDP, relies on a set of “secure by default” algorithms, and usually looks like one small interface where you can register public keys. Due to this, WireGuard is more often recommended for use on mobile devices and routers, but at the same time it has a very rigid, fixed packet structure and a characteristic UDP signature.

After the advent of deep traffic analysis (DPI) systems, basic OpenVPN and WireGuard actually stopped working. The solution was obfuscation—disguising VPN traffic as regular traffic. We talked more about obfuscation and ways to bypass blocking in this material .

Along with the strengthening of the Great Firewall of China, the V2Ray project appeared in the mid-1990s. Its underlying protocol, VMess, was intended to be a proxy for blocking bypass. In 2020, V2Ray released VLESS - Very Lightweight and Efficient Stream. VLESS ideology: “simplicity is also safety.” Extra layers of encryption were removed from the protocol and only the minimum necessary authentication was left, and the camouflage was transferred to an external “transport”.

This is how we come to a modern solution - a combination of VLESS and Reality. This is done by the XRay tool, created on the basis of V2Ray. We have already talked about VLESS, but Reality is essentially a modified TLS that masquerades as a specific website. The server takes the appearance and behavior of a real resource, adjusts the handshake and certificates to match it, and for DPI the entire connection looks like a visit to a legitimate site.

What to do when any protocol can be blocked?

Over the past year, Russian authorities have been blocking even those VPN protocols that work with VLESS/Reality. They should not be treated as a magic pill - they are just another technical solution with its own shortcomings and expiration date.

Now it is impossible to bypass blocking with one good protocol or one obfuscation method. It is always a combination of different decisions.

Thus, Russian developers recently reported that Roskomnadzor has changed its approach to blocking VPN services in order to combat “cascading” VPN tunnels. To bypass blocking, they first connect to a server in Russia, and then to a foreign one.

Moreover, Roskomnadzor is actively implementing artificial intelligence and machine learning to more effectively monitor unwanted VPN traffic. In winter, Forbes wrote that they plan to spend more than 2 billion rubles on these technologies.

But VPN developers are constantly improving ways to bypass blocks. Therefore, it is important to have several VPN services and keep them updated.

Let's find out what's really going on

Make a payment in favor of the editorial office of Bumaga