A Russian site says “turn off VPN,” but it’s off: what to do abroad

You’re abroad, you open Gosuslugi (Russia’s government services portal), Ozon, your bank or Russian Post — and the service asks you to turn off your VPN. Except your VPN is off, or you don’t have one at all: just ordinary hotel Wi-Fi, home internet or a local mobile network. The site won’t open, and the app won’t let you past the first screen.

Since April 15, 2026, major Russian services have restricted users with a VPN turned on, on instructions from Russia’s Ministry of Digital Development. They detect a VPN by indirect signs, and abroad, ordinary internet connections often get caught. Below: why this happens, what to do step by step, and what our test on October 3, 2026, from five countries and Russia showed.

Why a site asks you to turn off a VPN that’s already off

The service can’t see the switch on your phone. It sees the IP address the request came from, and an app also sees your device’s network settings. In the spring, the ministry sent guidelines to major internet companies; as CNews reported, citing RBC, the check works like this:

• Address. The IP address is compared “with the IP addresses considered Russian, and with the list of IP addresses blocked by Roskomnadzor,” Russia’s internet regulator. In other words, a foreign address can raise suspicion on its own.
• Phone. The app checks whether a tool for getting around blocks is turned on on the device. Android tells any app that traffic goes through a VPN; on iPhone, as the document puts it, “access to system parameters is significantly limited.”
• Address reputation. Commercial databases flag addresses that belong to data centers, hosting companies and VPN providers. Andrey Fateev of Smart Business Automation explained to ComNews that a system will almost certainly treat an address from a cloud like AWS as a VPN or proxy, and an address from a home internet provider like Deutsche Telekom as an ordinary user. Behavior counts too, such as logins from different countries.

Why the check gets it wrong abroad

“Today, it’s practically impossible to tell VPN traffic from ordinary foreign traffic,” telecom expert Eldar Murtazin told Parlamentskaya Gazeta, the Russian parliament’s newspaper. Sergey Kosmakov of Infosecurity (part of the Softline group) explained to ComNews where false positives come from: databases go out of date, address ranges get resold, and small providers use subnets originally registered to hosting companies. A person goes online from home, but the system sees a “data-center address” and asks them to turn off the VPN.

The second reason is the services’ own caution. According to Yury Bryukvin, head of the Rustelecom information agency, the platforms covered by the requirement “simply block almost all foreign traffic. Because figuring out where there’s a VPN and where there isn’t is very hard.”

Who most often gets mistaken for a VPN user

• Hotel and public Wi-Fi. In April 2026, tourists in Turkey, Egypt, Thailand and Vietnam lost access to Russian services on hotel Wi-Fi, the Association of Tour Operators of Russia told Kommersant. Hotel network addresses may be listed in databases as anything but home connections.
• Local carriers. There were complaints about local mobile networks too. No problems were reported in CIS countries in the spring, but a lot depends on the service: on October 3, Russian Post asked home networks in Armenia and Kazakhstan to make sure the VPN was off as well.
• Corporate networks. A work laptop or phone with a corporate VPN goes online through the company’s server, often in a data center or the cloud. RBC’s sources warned that the checks could hit corporate VPNs; the guidelines suggest putting them on a separate “whitelist.”
• iCloud Private Relay. With an iCloud+ subscription and Private Relay on, Safari goes online through relays run by Apple and its partners, and the site sees their address instead of yours. Apple warns that websites that filter IP addresses might try to prevent you from browsing them, and in geolocation databases such addresses can carry labels like “hosting” or “proxy.”
• A VPN profile on your phone. An app on Android sees a system VPN profile, whoever turned it on: your employer or any app that uses this mechanism.
• Data-center addresses. Most VPN services, including those with Russian addresses, and cloud proxies run from them. Databases flag these addresses first.

What to do if a site won’t open and asks you to turn off your VPN

Go step by step: the first steps take a minute and cost nothing.

1. Switch networks. Move from hotel Wi-Fi to local mobile data or another carrier: this is the ministry’s first piece of advice. If the service opens on one network and not on another, the problem is the address, not your phone.
2. Check Private Relay and VPN profiles. How to do it is in the next section.
3. Try the app instead of the website, or the other way around. Private Relay applies to Safari, while apps with a secure connection go online directly. On the other hand, an app, unlike a website, can check the phone itself: in April 2026, the Gosuslugi app demanded that users turn off their VPN while the portal’s website still opened.
4. Turn on roaming on your Russian SIM card. According to RuStore’s help center, most carriers route roaming traffic through Russia, so Russian services should work. It costs money, but a Russian SIM card in roaming also receives SMS codes. How to keep your number abroad is covered in a separate article.
5. On Android, use Connect in RuStore. It’s a free feature of the Russian app store for people outside Russia: you sign in with VK ID and open the My tab, then Connect. In July 2026, T-Bank recommended it to its customers. The feature isn’t available inside Russia, and RuStore exists only for Android.
6. Contact the service’s support. That’s what the ministry advises if you don’t use a VPN but still see the warning. What to include and where to write is covered below.

How to turn off a VPN you don’t have: what to check on your phone

iPhone, iPad and Mac: iCloud Private Relay

Private Relay is only available to iCloud+ subscribers. If it’s on, Safari goes online through relays run by Apple and its partners. Here’s what you can do:

• Go to Settings, then [your name], then iCloud, then Private Relay, and tap Turn Off Until Tomorrow: it will turn back on by itself within 24 hours.
• For one Wi-Fi network: go to Settings, then Wi-Fi, tap the More Info button next to the network, then Limit IP Address Tracking. If you turn this setting off, Private Relay stops working on that network across all your devices.
• For one website: in Safari, open the Page Menu and tap Show IP Address. On a Mac, choose View, then Reload and Show IP Address.

And if you don’t have Private Relay, does Limit IP Address Tracking matter? According to Apple, without a subscription Safari can only route requests to known trackers through its relays (the Safari setting Hide IP Address, then Trackers Only), while the site itself sees your regular address. So this switch affects VPN checks mainly through Private Relay.

Android and any phone: VPN profiles

Open the VPN section in your phone’s settings. If a work profile or an app you aren’t using right now is turned on there, turn it off while you log in. A corporate VPN on a work laptop often can’t be switched off without an administrator, so it’s easier to log in from your personal phone over mobile data. On Android, only one such connection can run at a time, so to use Connect you’ll have to turn off any other profile too.

What services say and what helps

The warning texts come from our sources and our test, translated from Russian. Services change the wording, so go by the meaning. Sometimes the request looks like a connection problem: Ozon’s page opens with “Looks like there’s no connection,” and in the spring, users with a VPN saw messages saying there was no internet when the connection was working.

Detailed guides by service: Gosuslugi abroad, SberBank Online and T-Bank (formerly Tinkoff), Wildberries and Ozon, Yandex services.

Our October 3 test: who gets “turn off VPN”

We checked how Ozon, Russian Post, Wildberries and Gosuslugi respond to different addresses. The test points come from Globalping, an open network of measurement probes: in Georgia, Armenia, Turkey, Germany and Kazakhstan, one home network and one or two data centers each, plus a home network and a data center in Russia for comparison. Separately, we checked from our own server in a data center in Tbilisi.

Our server in Tbilisi, two runs on October 3 (15:25–15:29 and 17:17–17:20 UTC): Ozon returned status 403 and “Turn off your VPN,” Russian Post returned status 417 and asked to make sure the VPN was off, Wildberries showed a browser check, and Gosuslugi showed the portal’s loading screen.

What this means. For Ozon, the “turn off VPN” request that day matched data-center addresses abroad: home networks in the same countries and both Russian addresses got an ordinary “you’re not a robot” check. For Russian Post, it matched any foreign address, home ones included: from Russia, the page opened.

How to contact support so they actually help

The ministry advises contacting support for the service that shows the warning. So you don’t get a template reply telling you to turn off the VPN, include:

• a screenshot of the warning with the date and time;
• the incident or request number, if the page shows one: on Ozon, it’s the Incident line; on Russian Post, the Request ID and Client IP address;
• your country and network: hotel Wi-Fi, a local carrier, roaming;
• where it happened — the website or the app — and what you’ve already tried.

On April 27, 2026, the ministry promised that a button for complaining about false “Turn off VPN” requests would appear on Gosuslugi “soon.” As of October 3, we found no reports of it launching.

Will a VPN with a Russian IP help?

Sometimes, if the service rejects foreign addresses specifically. In July 2026, T-Bank itself advised iPhone users to switch to a Russian IP address. But in the same complaints, users wrote that with a Russian address, the app’s VPN “detector” went off.

The reason lies in how the checks work: VPN servers usually sit in data centers, and databases flag data-center addresses first. Liberum VPS also gives you a shared Russian IP address on a server in a data center, used by many customers at once, so with it, too, a service may ask you to turn off the VPN. It’s a fallback for when a service rejects foreign addresses, not a way to make the warning go away — start by switching networks.

When it’s not about a VPN

• “Your connection is not private.” This is a certificate error. Several banks’ websites have switched to certificates issued by Russia’s Ministry of Digital Development — in our check on October 3, that was the case for Sberbank, T-Bank, VTB and Alfa-Bank — and browsers from foreign developers don’t have these certificates by default. T-Bank recommends the latest version of its app, Yandex Browser (partner link).
• Temporary limits during attacks. According to the ministry, foreign traffic may be briefly limited during large DDoS attacks; the advice is to try again later.
• The service doesn’t work in your country. Online cinemas and subscriptions have country restrictions, and a VPN has nothing to do with them: Kinopoisk, for example, offers subscription viewing only in Russia and eight other countries.

Key takeaways

• A service can’t see whether your VPN is off: it judges by your address, phone settings and behavior — and abroad, it often gets it wrong.
• Hotel Wi-Fi, corporate networks, iCloud Private Relay and data-center addresses get mistaken for VPNs most often, and some services distrust any foreign address.
• The first step is another network: local mobile data or a Russian SIM in roaming. On an iPhone, check Private Relay; on any phone, check the VPN section.
• On Android, RuStore offers a free Connect feature for people abroad.
• On October 3, 2026, Ozon showed “Turn off your VPN” to data-center addresses abroad, while Russian Post asked all foreign addresses, home ones included, to make sure the VPN was off.
• A VPN with a Russian IP, including Liberum VPS, doesn’t guarantee access: data-center addresses end up in the databases themselves.