Yandex recorded 12.3 million queries with the word "VPN" in December 2025, an absolute record for the entire observation period. Three years ago, four out of a hundred people used the technology. By 2025, it was already forty-two out of a hundred. The technology itself hasn't changed by a single line of code during this time. What has changed is the reason people are flocking to it.
VPN stands for Virtual Private Network, and it is neither a panacea nor an invisibility cloak. It is a rather boring engineering trick: a data packet is wrapped in an encrypted shell and sent through an intermediary. Boring, but precisely because of that, reliable. Let's figure out how it works inside, where it breaks down, and why in 2026 this topic concerns not just paranoids and IT specialists.
"Virtual" here is not just for show. No one is pulling a separate wire between your laptop and a hypothetical Netflix; the channel exists only in software logic. "Private" because exactly two parties are able to look inside: the device and the VPN server. Everyone else, including the ISP, gets a view of an impenetrable encrypted envelope.
The technology plugs two different holes, and they should not be confused. The first hole concerns the content of the traffic, which is hidden by encryption. The second hole concerns the original IP address, which is replaced by the server's address. The site at the other end sees a request from the intermediary, not from you, and that's all the magic there is.
At its core lies tunneling, a technique where one packet is hidden entirely inside another. The original data is encrypted and packed into an outer packet with the VPN server's address. Along the way, the ISP reads only the label on the outer envelope; the contents remain white noise to them.
This unfolds in several steps. The client on the device knocks on the server's door and undergoes verification via a password, certificate, or pre-issued key. The parties agree on a cipher and exchange keys; the tunnel is established. The client encrypts and wraps each outgoing packet in an outer shell, which is all the ISP sees. The server removes the wrapper, decrypts the packet, and sends it to the open internet under its own name. The response travels back the same way, in reverse order.
Since the site considers the server to be the source of the request, it also determines the country based on the server. Place a node in Germany, and for a hypothetical streaming service, you are already in Frankfurt. There is no separate "bypass blocking" button inside the protocol; it is simply a side effect of address substitution.
Encryption grinds readable data into a set that cannot be put back together without a key. A VPN uses two different schemes simultaneously, each at its own stage.
At the start, during the handshake, an asymmetric key pair is used. The public key encrypts, and the private key decrypts. The pair has one task: to securely agree on a session key through a channel that no one has protected yet.
Next, symmetric encryption kicks in, where both sides use a single shared key. It is faster than asymmetric encryption, so all subsequent data flow goes through it. The industry standard is AES-256; WireGuard uses ChaCha20 paired with Poly1305 for authentication instead.
Security hinges on the key length. A 256-bit AES key cannot be cracked by brute force on existing hardware; we are talking about timeframes that are incomprehensible to the human mind. Therefore, attacks target not the cipher itself, but what is around it: stolen keys, misconfigured servers, or implementation flaws. We will analyze a telling example a bit later, regarding a protocol that was bypassed in exactly this way.
The protocol sets the rules by which the tunnel is built. Speed, security, and how easily a filtering system can recognize your traffic by the characteristic fingerprint of its headers depend on it.
| Protocol | Speed | Security | Distinguishing features |
|---|---|---|---|
| WireGuard | Very high | High | Less than 4,000 lines of code compared to 100,000+ in OpenVPN, modern cryptography, instant connection |
| OpenVPN | Medium | High | Open source, fine-tuning, works over both TCP and UDP |
| IKEv2 / IPSec | High | High | Does not drop the tunnel when switching from Wi-Fi to cellular network, hence its popularity on smartphones |
| L2TP / IPSec | Medium | Medium | Double data encapsulation slows down the channel, the combination is morally obsolete |
| PPTP | High | Low | Authentication has been publicly broken, unsuitable for protection |
The story with PPTP is specific, not an abstract "encryption was broken long ago". In 2012, at the DEFCON 20 conference, researchers Moxie Marlinspike and David Hulton showed that the combination of PPTP and the MS-CHAPv2 authentication protocol breaks with a 100% guarantee, reducing the task to brute-forcing a single DES key. The commercial service CloudCracker was launched right after. You upload the intercepted traffic, pay $200, and get the password within a day. It doesn't matter how complex a password the user chose (it sounds like a joke, but this is a real case, not a scare story for a security lecture). After this, PPTP disappeared from serious recommendations completely.
In practice, the choice in 2026 narrows down to a couple of options. WireGuard is chosen for its speed and low CPU load; moreover, the protocol stays silent at rest and does not give itself away with packets when there is nothing to transmit. OpenVPN is kept when flexible configuration and masking as regular HTTPS traffic are needed. IKEv2 is a lifesaver on phones: you switch from home Wi-Fi to a mobile network, and the tunnel doesn't drop, so you don't have to re-establish the connection.
There is also a more distant horizon. In August 2024, the US National Institute of Standards and Technology (NIST) approved the first post-quantum encryption standards: FIPS 203 with the ML-KEM key exchange mechanism and FIPS 204 with the ML-DSA digital signature. The idea is that encrypted traffic intercepted today can be stored and decrypted later when a sufficiently powerful quantum computer becomes available. This approach is aptly named "harvest now, decrypt later". Hybrid schemes, where classical X25519 works in tandem with post-quantum ML-KEM, are already being incorporated into the TLS 1.3, IKEv2, and WireGuard specifications. For now, this is more of a foundation for the future than everyday practice for mass-market VPN services, but ignoring the topic in a couple of years will no longer be possible.
Architecturally, VPNs are divided into two fundamentally different scenarios, and they should not be confused, as their tasks are different. Client-to-site, the option for individuals and remote workers. A client is installed on the device, which establishes a tunnel to the gateway; this is how a home laptop connects to a corporate network or a consumer service changes its IP.
Site-to-site is structured differently; the tunnel stitches together not a user, but two entire networks at once. A company with offices in different cities channels the local networks of its branches into a single encrypted channel between gateways, while the end workstations are completely unaware of the tunnel's existence; the edge routers do all the work.
The third option, SSL VPN, operates without installing a thick client; access is through a browser, using the same mechanism that encrypts regular HTTPS. It comes in handy when an employee needs to access a narrow set of resources from any device, including a personal phone in a cafe.
The same protocol can be deployed in different ways, and the method determines exactly what will be protected. A separate application on the device encrypts the traffic of all programs at once, which is the most reliable option for a single machine. A browser extension, on the contrary, only covers what goes through the browser itself, while messengers, games, and system services reach the network bypassing the tunnel and remain exposed, something many users simply don't think about.
A VPN on a router establishes a tunnel at the level of the entire home network, instantly protecting all devices, including a TV and a smart speaker, where a client cannot physically be installed. The corporate version is configured by the IT department; an ordinary employee has no admin rights, and the company logs data transmission on its end. On a smartphone, the principle is the same: both Android and iOS handle the VPN at the operating system level, intercepting all network traffic entirely.
Formally, VPNs are not banned in Russia; Roskomnadzor has been repeating this position throughout 2025 and continues to do so in 2026. In fact, the infrastructure around the technology is being methodically dismantled, quarter by quarter. By October 2023, 167 services had been blocked. By October 2025, it was already 258, a 31% increase over the year. By the end of February 2026, it reached 469. Since December 2025, Roskomnadzor has been more actively cutting not only the services themselves but also protocols like SOCKS5, VLESS, and L2TP.
And since March 1, 2026, machine learning algorithms costing 2.3 billion rubles have been integrated into the technical means of countering threats; they recognize VPN traffic by behavioral connection patterns, not by protocol signatures. This means that masking as HTTPS, discussed above, is no longer a guarantee. The system looks not at the headers, but at exactly how the channel behaves.
The corporate segment has also been affected, although formally it is protected by an exception in Article 15.8 of the "On Information" law, which applies to systems with a predefined circle of users. In practice, since 2023, business VPNs have been massively blocked alongside consumer ones, forcing companies to whitelist their server IP addresses through the Roskomnadzor portal. By April 2025, 75,000 addresses had already been added there, a sixfold increase in a year and a half. Meanwhile, Apple is actively complying with the regulator's demands; by March 2026, 717 apps in the "Utilities" category, including ProtonVPN and NordVPN, have been removed from the Russian App Store.
The irony of the situation in numbers is this: the share of VPN users among Russians grew from 4% in 2021 to 42% in 2025, and the active user base of the top 5 VPN apps in the country jumped from 247,000 to over 6 million people in the third quarter of 2025. The tighter the blocks, the higher the demand; an effect as predictable as it is paradoxical for those who devised these blocks.
Since September 1, 2025, a separate Article 13.53 of the Code of Administrative Offenses (KoAP) has also been in effect. Intentional access to materials from the extremist registry via circumvention tools is punishable by a fine of 3,000 to 5,000 rubles for citizens. The use of the VPN itself is not considered an aggravating circumstance, but it confirms that the person consciously bypassed filters for specific content. The difference is subtle, legally significant, and clearly not the last amendment on this topic.
A VPN secures the communication channel and does not touch the device itself. The layers of protection are different; substituting one for the other is a typical mistake. It does not replace an antivirus. If a Trojan or ransomware gets onto the disk, the encrypted tunnel is absolutely no obstacle to it; it will steal or corrupt data locally, regardless of whether the VPN is on or not.
A VPN also does not provide anonymity. Cookies, browser fingerprints, and logging into your own accounts give the user away completely, no matter how many servers stand between them and the site. And trust in the ISP simply shifts to the VPN service owner; the server itself sees all traffic in plain text, so questions about logs and the provider's reputation arise exactly where questions about the ISP used to be.
A separate headache is tunnel drops. Without a kill switch function, traffic at that moment will go directly and openly for a few seconds, and no one will notice until it's too late. The function monitors the tunnel's state and cuts off the network until it is restored. It is also worth checking for DNS leaks; domain names must be resolved inside the tunnel, not on the ISP's servers, otherwise the entire meaning of encryption is partially nullified by one unsealed loophole.
What is a VPN in simple terms
A VPN wraps each packet in an encrypted shell and sends it through its own server. The ISP and Wi-Fi owner see only this shell with the server's address, not the content of the requests or the real IP.
Does a VPN replace an antivirus
No. A VPN encrypts the channel but does not touch files on the disk. A Trojan or ransomware will execute on the device with any active tunnel; this is the antivirus's job, not the VPN's.
Which VPN protocol is the fastest
WireGuard. Less than 4,000 lines of code, modern cryptography, the connection establishes faster than OpenVPN or L2TP/IPSec, and it loads the CPU less.
Will VPNs be completely blocked in Russia
Roskomnadzor officially denies this. By the end of February 2026, access to 469 individual services has been restricted, but the agency does not confirm a complete ban on direct connections to foreign VPN servers.
English
Русский