VPN blocks in fall 2026: how Roskomnadzor looks for VLESS and what to do
A look at the September wave of VPN blocks in Russia: how DPI detects VLESS, why servers get actively scanned, and why mobile data fails more often than home broadband.
In September 2026 several major VPN services in Russia stopped working, including ones built on VLESS. Below is how filtering works now, why mobile data fails more often than a home connection, and what still keeps access working.
What happened in September
Outages did not start in every region at once. Mobile users complained first. A few days later, customers of some home ISPs joined them. More than ten well-known services were restricted. The timing matched the end of the autumn elections, after which filtering is usually tightened.
The regulator made no public announcement. People find out from the symptoms: the app connects, but sites do not load, or the session drops after a minute or two.
Where filtering is heading
Plans for the next few years are in public documents from the relevant agencies. By 2030 they want to block about 92% of circumvention tools and cover almost the entire Russian internet — about 98% — with traffic analysis. Separate budget lines are set aside for this, and the amount grows every year.
VLESS has a particular history. The protocol appeared in 2020 and was left alone for a long time: the traffic looked like ordinary HTTPS. Attempts to tell it apart by signatures started in autumn 2025. From the start of 2026, filters at major operators learned to look not only at packet contents but at indirect signs of a connection. In spring, the VLESS TLS handshake on standard ports came under inspection as well.
If you are not sure how VLESS differs from WireGuard and OpenVPN, start with a short explainer: What the VLESS protocol is.
How DPI tells a VPN apart from a normal site
TSPU equipment — the DPI gear installed at Russian ISPs — does not always block a connection immediately. It often lets the start of the session and the first few kilobytes through, then looks at what the data stream resembles.
A normal site sends traffic in bursts: a page, images, a pause, another request. A tunnel looks different — a steady stream of data that resembles random bytes. If the profile does not match ordinary web browsing, the connection is cut. That happens in two ways:
- packets stop being forwarded, and the connection hangs with no reply;
- both sides receive a forged reset packet (TCP RST), and the client sees a disconnect.
That is the common complaint: “the VPN connected, worked for a couple of minutes, then everything froze.” The check is not instant. It runs after enough traffic has built up to analyze.
Active server scanning
Packet analysis is not the whole story. When the system notices a suspicious connection, it contacts that IP itself and looks at what answers.
If the server behaves like a real website, returns a normal page and a certificate, it passes. If it answers like a proxy, or stays silent on a normal HTTPS request, the address goes on a block list. Servers that do not disguise themselves as a real website do not last long now.
Another check is whether the domain matches the IP. At the start of the connection the client names a domain (SNI). If that name belongs to a large company and the IP belongs to a cheap VPS at a small host, the mismatch is obvious.
This filtering has a side effect: the equipment runs at its limit. Under the load, things nobody meant to block break from time to time, including banking apps.
Blocking whole subnets and data collected by apps
In summer 2026 they started closing not single addresses but whole subnets of foreign hosts where many VPN servers live. Personal servers people ran for themselves and friends went down with them.
At the same time it became clear that a noticeable share of popular Russian mobile apps checks which VPN clients are installed on the phone. Lawyers who work on digital rights link the wave of blocks to that data: it makes it easier to see which services are widely used.
Russian hosts are under pressure too. They are told not to rent capacity for proxy servers.
Why mobile data is worse
Checks from different cities show a similar picture. Home internet in large cities keeps VLESS relatively stable. On mobile networks the failures are regular.
The reason is allowlists. In some regions mobile internet is periodically switched to a mode where only approved addresses open: government services, banks, large domestic services. Any foreign server is unreachable at that moment, and the protocol does not matter. The symptom is clear: everything works on Wi-Fi, and the moment you switch to mobile data there is silence.
What an ordinary user can do
You cannot step out of the blocks entirely, but most problems are solved with simple steps.
- Use a subscription, not a single key. A subscription link updates the server list on its own. If an address is blocked, a new one arrives in the app without you doing anything.
- Refresh the subscription in the client. In Happ that is the refresh button on the profile. Do it at the first failure.
- Compare Wi-Fi and mobile data. If it fails only on mobile, an allowlist is probably on in your region. Reinstalling the app will not help.
- Reconnect after a drop. A DPI reset is often a one-off, and a new connection goes through.
- Keep the client up to date. Updates add new ways to disguise the traffic.
Setup guides for each device: Android, iPhone, Windows.
If you run your own server
If you administer your own VPN server, these checks are worth doing now.
- Check reachability in two steps. Separately: does the TCP port open, and does the full protocol handshake complete. The port can be open while VLESS is already being cut.
- Test for longer than a couple of seconds. A block often fires with a delay, so keep the connection up and send traffic for at least a few minutes.
- Check the server from outside Russia. If it works from abroad and not from Russia, the problem is filtering, not your config. Ask the host for an address from another subnet.
- Do not hide behind the domains of giant companies. An SNI that does not match the real IP is easy to spot. Your own domain, or an obscure site, is more reliable.
- Give users dynamic links. Then nobody has to change settings by hand when the server changes.
- Monitor from Russian networks. Automatic checks across several operators, home and mobile, will show a block before the complaints arrive.
How CHEBA VPN handles this
CHEBA VPN runs on VLESS and hands out access through a subscription link. If a server starts getting blocked, we replace it on our side, and the Happ client pulls the new settings when the subscription refreshes. You do not hunt for new keys by hand.
After you sign up there are 3 days of free access. No card is required for the trial, so you can check how the VPN behaves on your own network, at home and on mobile data.
Short version
Blocks are now layered: traffic analysis in the first minutes of a connection, active server scans, whole subnets closed, and allowlists on mobile networks. VLESS still works, but only with proper camouflage and regular address changes. For that a user needs a subscription that updates itself, not one static key.
Questions
Does VLESS no longer work in Russia?
It works, but not everywhere and not all the time. Servers that disguise themselves well as an ordinary website last noticeably longer. Problems show up most often on mobile data during allowlist periods, and no protocol helps there.
Why does the VPN connect and then stop after a minute?
That is what DPI usually looks like. The system lets the start of the connection through, analyzes the first kilobytes, and then drops the session. Reconnect and refresh the subscription. If the failure repeats, the server has probably already been replaced, and a refresh will put a new one on the list.
How can I tell that an allowlist is on in my region?
Turn Wi-Fi off and open any foreign site without a VPN. If nothing opens except large Russian services, the restriction is on the operator’s side. Wait, or connect to Wi-Fi.
Can apps on my phone tell that I have a VPN?
They can check whether a VPN client is installed and whether a VPN connection is on. Android and iOS allow that. The traffic inside the tunnel stays encrypted, and apps cannot see it.
