Over the past few days, several events surrounding VPNs have occurred, which together are radically changing the rules of the game for millions of users.
— Several sources reported that Apple has removed a number of popular VPN and proxy clients from the Russian App Store, including Streisand, V2Box, v2RayTun, and Happ. Already installed apps continue to work, but they will no longer receive updates from the Russian region. According to "Durov's Code," the removals followed a demand related to Russian regulations.
Proof of Roskomnadzor's request: It is known that Apple hid the apps from the Russian region at the request of Roskomnadzor. The developers of v2RayTun published a screenshot of a letter from the corporation. Apple states that the app was removed from the Russian App Store because "it contains content that is illegal in Russia."
— Meanwhile, on March 28, Minister of Digital Development Maksut Shadaev held two meetings — one with telecom operators and another with the largest digital platforms, including VK, Ozon, Wildberries, and Yandex. At these meetings, businesses were asked to implement measures that would effectively make using VPNs paid and hard to access. And although the use of VPNs is not officially banned in Russia, the reality is that from May 1, 2026, access to blocked services via regular VPN apps will become very difficult or extremely expensive.
The measures agreed upon at Shadaev's meeting can be divided into three areas:
The first concerns mobile operators: they have been asked to introduce a fee for using more than 15 gigabytes of "international traffic" per month on mobile networks (and if the VPN server is located abroad, the traffic is considered international). According to officials, this is roughly the average amount consumed by VPN service users. However, experts note that this volume is barely enough for Telegram messaging and occasional calls. For watching YouTube in any decent quality, 15 GB might not even last a week. Users will have to pay for every extra gigabyte over the limit — according to various estimates, from 100 to 150 rubles. If you actively use YouTube or other video services via a VPN, the bill could run into thousands of rubles a day. It is important to note that as of March 31, this looks exactly like measures under discussion, rather than a published and enacted regulatory decision.
The second area concerns the internet platforms themselves: Companies included in the so-called "whitelists" (a list of resources that continue to work even if mobile internet is restricted) were given an ultimatum: either restrict access for users with a VPN enabled, or risk being removed from these lists. The largest Russian online services are under threat — marketplaces Wildberries and Ozon, the Yandex search engine, VK, banks, and other platforms. They will have to implement systems that detect VPN traffic and block such users. This shifts the pressure from ISPs to the platforms themselves: marketplaces, banks, ecosystem services, and large IT companies.
The third area is the most alarming news: Shadaev did not rule out the possibility of introducing administrative liability for using circumvention tools. True, the minister expressed hope that it wouldn't come to that, but the very fact that such a scenario is being discussed speaks volumes. For now, this is only a measure under discussion, but precedents in other countries show that such initiatives tend to quickly turn into laws.
Meanwhile, the official public rhetoric remains ambiguous. On March 25, TASS, citing State Duma deputy Anton Gorelkin, reported that a complete ban on VPNs in Russia is not being discussed; on March 31, Kommersant reported the words of Digital Development Minister Maksut Shadaev that the ministry is against administrative liability for using VPNs, although the authorities have tasked him with reducing the volume of use of such services. In other words, the signal is this: the technology as a class is not being banned, but the space for its application continues to be narrowed economically, infrastructurally, and at the platform level.
Many users believe that a VPN makes their traffic completely invisible to the ISP. This is not true. The operator usually cannot see the contents of your packets (what exactly you are watching or reading) inside the tunnel, but they can often see the presence of tunneling, the destination, and the nature of the network exchange — that is, the very fact of VPN usage. There are several methods for detection, and they are becoming more sophisticated every year.
The simplest method is analyzing IP addresses and traffic direction: if a device communicates steadily and for a long time not with a standard set of websites, but with a specific foreign node or a pool of addresses belonging to a hosting provider or a known VPN provider, this alone is enough for basic classification.
The next level is port analysis. Most VPN protocols have "typical" or default ports used when establishing a connection. For example, OpenVPN defaults to UDP 1194, WireGuard to UDP 51820, and IKEv2/IPsec to UDP 500 and 4500. The operator (and the TSPU equipment installed on their network) sees these ports in the packet headers and can immediately flag the traffic as suspicious. This is a primitive method, but it is still used. The problem (not for users, of course) is that it is easily bypassed — any protocol can be reconfigured to TCP 443 (the HTTPS port), but in this case, the next level of analysis kicks in.
This is where Deep Packet Inspection (DPI) comes into play — the core technology of TSPU. DPI does not read the encrypted contents of packets (which is prohibited and technically extremely difficult), but it excels at parsing structure, behavior, and signatures.
— Handshake recognition. Every VPN protocol has a characteristic "handwriting" during the connection establishment phase. WireGuard has a very compact (148 bytes long), yet highly distinctive handshake described in its official documentation; OpenVPN starts with a specific opcode in the first byte. The DPI system compares these signatures against a database and can determine the protocol with high probability within milliseconds of the connection starting.
— Statistical analysis of packet structure. DPI looks at packet sizes, intervals between them (timing), session duration, and the overall flow pattern. Regular web traffic has a pronounced asymmetry: short requests and large responses (a small request (GET/POST) → a large response (HTML + resources) → a pause → another small request), erratic intervals, and many short connections to different hosts. A VPN tunnel, on the contrary, looks like a long-lasting connection to a single node, with a more uniform distribution of packets and a steady data flow. Even if the content is encrypted, this statistical uniformity gives away the tunneling.
— TLS fingerprinting. A VPN can disguise itself as regular HTTPS (for example, by operating over TCP 443) and initiate a TLS session. But the set of ciphers, extensions, and their order in the Client Hello forms a unique client "fingerprint." Browsers (Chrome, Firefox, Safari) have predictable fingerprints, while VPN clients have different ones. Even if the traffic looks like HTTPS, the TLS fingerprint can distinguish a "real browser" from a tunnel pretending to be one.
All this together allows TSPU to detect not only classic protocols but also many disguised ones (VLESS + Reality, Shadowsocks, etc.) based on indirect signs.
An important point: DPI requires significant computing resources. Analyzing every packet in real time on backbone channels with throughput in the hundreds of terabits is a serious load on the equipment. When the number of filtering rules grows sharply (up to 40,000 a day instead of the usual 10,000–15,000), the system cannot cope and switches to bypass mode — traffic begins to pass through without any inspection. This is not a leniency measure, but a forced degradation mode: the system cannot handle the load and temporarily disables some checks.
Of course, you shouldn't count on bypass as a stable scenario. First, such modes are episodic. Second, precisely because of the high load on DPI and the complexity of pinpoint filtering, cruder but cheaper measures are used in parallel — for example, access management via the national DNS infrastructure and blocking at the domain name and IP level. For instance, in February 2026, Roskomnadzor began mass-deleting domains from the National Domain Name System (NSDI). As a result, youtube.com, whatsapp.com* (including web.whatsapp.com*), facebook.com*, instagram.com*, messenger.com*, torproject.org*, and a number of other major resources disappeared from it.
For most Russians, the consequences will be as follows:
Free and cheap VPN clients that could be downloaded from the App Store or Google Play will stop working or will work extremely unstably. Their IP addresses have long been blacklisted, and DPI systems have learned to recognize their protocols. Even if you already have a VPN app installed, using it—if the 15 GB threshold scheme is introduced—could lead to automatically exceeding the international mobile traffic limit and having money deducted from your account. A VPN will cease to be "free background" on a smartphone and will turn into a separate expense item.
The second consequence is that platforms will start blocking users with a VPN. Banks will be the first to do this (for security reasons, they already often ask for confirmation upon suspicious logins), followed by major online services. If a platform is on the "whitelist," it will be obliged to block VPN users altogether, or else risk being removed from the list. Undoubtedly, this is extremely inconvenient because it disrupts the usual seamless experience. Paying for subscriptions to foreign services via an Apple ID mobile account may become complicated as early as April.
And finally, the most unpleasant thing — the possible introduction of fines for using a VPN. This is still only being discussed, and hopefully, deputies will not approve this decision. But if the law is passed, even a single instance of VPN usage (which the operator can easily record) could become grounds for administrative punishment.
While there is no complete legislative ban on VPNs yet, technical and economic barriers will significantly complicate everyday circumvention of blocks.
Here it is important to immediately separate the scenarios. If you are an average user who uses a VPN occasionally for leisure, for example, to scroll through an Instagram* feed or watch a video from your favorite creator on YouTube, here are some fairly simple steps:
The first is the simplest and most banal (no offense) — try to do without circumvention and look for alternative channels with your favorite content or creator. Many are already duplicating content on Russian platforms, and this often turns out to be more stable than constantly fighting blocks. Check if your favorite blogger has moved to these services: often the same content appears there without delays.
However, if your favorite creator is, heaven forbid, a "foreign agent" and publishes their videos only on YouTube, or you frequently use ChatGPT, Gemini, or Grok for psychotherapy, completely doing without a VPN is, unfortunately, impossible. Here are the simplest options that don't require deep technical knowledge:
Changing DNS. As we wrote above, sometimes a website or YouTube doesn't open because your ISP blocks it at the DNS level — that is, it simply doesn't tell your computer the address of the site. This problem can be bypassed by changing the DNS server in your device settings. The most popular alternative DNS services are Comss.one, NextDNS, or similar Smart DNS.
Russian neural network aggregators. These services gather several foreign models (ChatGPT, Gemini, Grok, and others) in one interface. You register on the site, select the model you need, and use it. Payment is usually made with Russian cards in rubles, and there are free trial periods or limits. Popular ones include UniGPT, GPTunnel, BotHub, MashaGPT, GoGPT, ChadGPT, and StudyAI.
You can try to fit into 15 GB: in Telegram, you need to switch media auto-download to "Low," limit photo size to 1 MB, and allow video downloads only on tap; in YouTube, force the quality down to 480p and enable built-in data-saving modes. Using browsers with an ad blocker (like Brave) that cut out heavy banners and trackers can also help. You can also monitor the "Data Usage" section in your smartphone settings daily, BUT the data from the smartphone does not always match the data from the mobile operator.
If aggregators don't suit you, changing DNS doesn't help, and 15 GB is too little, you will still have to use a VPN. The main advice here is: don't rely on free VPN apps from the stores. Their IP addresses have long been blacklisted, and they are easily detected by the operator. Consider services with a good reputation and residential IPs, which look like regular user networks rather than data centers. Choose VPNs that offer protocols with masking (obfuscation). Look for recent reviews from March–April 2026, and try services with a 30-day money-back guarantee.
Regarding split tunneling (a feature where the VPN works only for specific apps, while the rest of the traffic goes directly). Currently, there is no definitive answer as to whether it's better to use it or not. On the one hand, it allows you to avoid routing all traffic through the VPN, be less "visible" to whitelisted platforms, and save your limit. But from a detection standpoint, such a split might look more suspicious than a full tunnel.
The main thing is not to keep the VPN turned on all the time. Turn it on only when you access the required service, and turn it off immediately. This way you will save "international traffic" and reduce the risk of the operator recording a long suspicious connection.
Returning to the scenarios. If you are a professional user (developer, marketer, analyst) who actively uses formerly familiar, but now blocked, foreign services for work. Here you should think about more resilient solutions, because a simple VPN might not be stable enough.
First, consider your own infrastructure. Deploying a personal VPS outside of Russia with modern masking protocols gives you control over the IP address. The main thing is to avoid popular data centers, choose less noticeable ranges, and regularly update your masking settings. Use a system-wide VPN (not just a browser extension) — this reduces the risk of DNS, IPv6, and WebRTC leaks.
Second, use advanced masking protocols that mimic regular HTTPS traffic with a Chrome or Firefox browser fingerprint. An example is the VLESS protocol paired with Reality technology: it masks your traffic as a connection to a real website (for example, google.com), which complicates DPI work. Avoid classic signatures. A full tunnel (without split tunneling) often looks more natural for long-term work. Check your configuration for leaks on specialized test sites.
For teamwork, it's better not to rely solely on a personal browser. Create a corporate perimeter: API access via the company's backend, a remote desktop environment (VDI), or infrastructure in a jurisdiction where services are officially available. Employees in Russia connect to the company's internal perimeter, which then interacts with external tools. This is more stable and legally clearer. Russian officials have repeatedly emphasized that a VPN remains an important and legal tool specifically for corporate tunneling and data protection.
Separate "access" from "data" in advance. Duplicate chat histories, prompts, and artifacts in an independent repository, and describe key processes so they can be quickly transferred to alternative tools. Then the temporary unavailability of a service won't stop work.
If lighter options without a VPN tunnel work, try:
In any case, regularly check the relevance of the methods — rules and detection techniques are changing. For mission-critical tasks, combine multiple approaches and monitor traffic consumption, especially after the introduction of new tariff restrictions.
English
Русский