Why VPNs stop working in Russia

A tunnel may complete its initial handshake but carry no data, work on one operator and fail on another, or stop after several days. These symptoms do not point to one universal “VPN blocked” switch. The cause can sit at the server IP, DNS, transport protocol, handshake metadata, traffic pattern or international route.

First rule out ordinary causes: an expired account, an unavailable server, incorrect device time, captive Wi-Fi, broken DNS or no base Internet. Only then compare filtering or routing hypotheses.

Russian federal laws adopted in 2017 and 2019 form part of the legal and operational context for restricting access and centrally managing the public communications network under defined conditions. Measurement research presented at ACM IMC 2022 examined TSPU equipment in provider networks and observed triggers involving SNI, IP, QUIC and stateful behaviour.

The study measured more than one million endpoints across hundreds of autonomous systems behind the examined infrastructure, but it is not a permanent map of every connection in Russia. Equipment location, configuration, operator policy and routing mean that two users can see different results at the same time.

Encryption can protect the contents of a tunnel while leaving observable metadata. A network device may still see source and destination addresses, ports, TCP or UDP, packet sizes, order, timing and portions of an initial handshake that are not encrypted.

Traditional TLS can expose a server name through SNI. QUIC has distinct transport and handshake behaviour. The first bytes, message lengths or a server response to unusual input can also form a fingerprint. Strong cryptography and resemblance to ordinary web traffic are separate design properties.

USENIX Security 2022 research demonstrated passive and active techniques for identifying many OpenVPN flows in a studied environment. The reported detection result must not be treated as a percentage of OpenVPN blocked in Russia; it shows that encrypted protocols can still expose useful classifiers.

Plain WireGuard uses a concise UDP handshake and does not claim to provide an obfuscation layer. That does not weaken its encryption, but it can leave a transport signature. Older proxy configurations may similarly reveal high-entropy traffic, stable lengths or probe responses. Version, transport and server operation all matter.

A new server IP may not yet be classified, while repeated traffic later gives a filtering system more evidence. A provider can also update its rules, an ISP can change routing, or the VPN server can become overloaded. Switching apps while keeping the same underlying route will not necessarily change the outcome.

Resilience therefore depends on more than a protocol label. It includes transport choices, capacity, server and IP operations, monitoring across operators, and support that can distinguish a failed handshake from DNS or base-network failure. No provider can credibly promise a route that will remain available forever.