Why VPNs stop working: how the restrictions are built

Yesterday the connection opened everything; today it hangs while connecting or drops after a few seconds. Nothing was changed, the app is the same, the subscription is paid. The first thought is that the service is broken; the second, that something is wrong with your internet.

Most of the time nothing is broken. What changed is the configuration of equipment on the telecom operator’s side. Below is how this works: how a connection is recognized without being decrypted, why addresses rather than protocols get blocked, and when the VPN is not involved at all. This explains the mechanics; it is not advice on what to do.

Why your VPN stopped working right now

It helps to separate three different causes straight away — they have different symptoms and different remedies, none of which depend on you:

• The protocol was identified. The equipment recognized the characteristic shape of the connection and tears it down. Symptom: the connection is established and drops almost immediately, sometimes right after the first data goes through.
• The address was closed. The server’s address or an entire data-centre range is blocked. Symptom: the connection is not established at all, the server “does not answer”, while other servers of the same service are alive.
• The network itself was restricted. Mobile internet is switched off in the region or runs on a whitelist. Symptom: almost nothing opens except a handful of permitted services, and no connection method helps.

Now each of them in turn.

Why a VPN fails for some people in Russia and works for others

The equipment that takes apart passing traffic did not appear at operators by their own choice. The sovereign internet law (90-FZ of 1 May 2019, in force since 1 November 2019) obliged operators to install technical countermeasures against threats in their networks, not to interfere with their remote management and to provide uninterrupted power. Government decree No. 126 of 12 February 2020 set the rules for installing and operating them; the hardware is handed to operators free of charge, at the state’s expense. It is managed remotely, from a monitoring centre attached to Roskomnadzor’s radio frequency service.

One important feature was measured by independent researchers: in Russia this system is decentralized. A paper presented at the ACM Internet Measurement Conference in 2022 showed that the equipment sits not at a few cross-border nodes but inside the networks of individual providers, closer to the subscriber: more than a million Russian addresses across 650 autonomous systems turned out to be behind such equipment, and for 70% of devices it was no more than two network hops away. Hence the main practical conclusion: the picture genuinely differs between operators and regions — it only seems that way because it is true.

The first prominent use was the throttling of Twitter on 10 March 2021. Roskomnadzor officially called it “centralized response measures, namely an initial slowdown of the service’s speed”, and specified that the measure affected 100% of mobile and 50% of stationary devices. The technique of not blocking something but making it unbearably slow has been in regular use ever since.

How VPNs are blocked without decrypting traffic

There is no need to read the contents of a connection — how it looks from the outside is enough:

• Service fields at the start. OpenVPN has characteristic bytes at the beginning of a session. In work presented at USENIX Security in 2022, the authors identified more than 85% of OpenVPN connections at a real provider, and on top of that defeated 34 of the 41 “obfuscated” modes offered by commercial services.
• A fixed length. WireGuard’s first message is always of the same type and exactly 148 bytes long, and the reply is 92 bytes. That is enough for a one-line rule, and it catches any standard implementation.
• The port number. IKEv2 and IPsec run on ports 500 and 4500. Closing them requires no traffic inspection whatsoever.
• Data that is too random. Protocols that hide their structure completely are given away by that very uniformity. Since November 2021 China has run a system that separates out “fully encrypted” connections by the share of set bits in the first packet; the blocking is probabilistic — roughly one connection in four.
• An active check. The equipment can connect to a suspicious server itself and see how it answers. Researchers described the technique as early as 2015, and an analysis of how Shadowsocks is blocked in China showed the combination: passive analysis of the first packet, then seven types of probes from thousands of addresses.
• The fingerprint of a secure connection. The set and order of parameters at the start of a TLS connection produce a fingerprint (the JA3 method and the newer JA4). A client that uses a non-browser library produces a fingerprint that matches no real browser.
• The site name in the clear. At the start of a secure connection the site name is sent unencrypted, and filtering uses it. The ECH extension, which hides it, was restricted in Russia on 5 November 2024 — and this is a rare case where a restriction was confirmed officially: the communications monitoring centre called ECH a means of circumventing restrictions on access to prohibited information.

A timeline: what stopped working and when

Two caveats, without which this table misleads. First: Roskomnadzor almost never confirms the blocking of specific protocols — its comments are generic, and some episodes were denied outright. Nearly everything known comes from independent measurements and industry sources. Second: the phrase “the protocol is blocked” is almost always an oversimplification. In April 2026 Mediazona noted that after the December restrictions most services fairly quickly issued working settings to their users.

Why changing the address made it work again

The most common practical story: the service issued a new address and everything came back to life. That happens because the restriction often applies not to the protocol but to the destination address itself — and here no traffic inspection is needed at all.

In 2025 independent observers described a technique that illustrates this well. A connection to a foreign address is established normally but hangs after the first 15–20 kilobytes of the reply: no reset arrives, the connection simply freezes until it times out. It has been observed mainly in mobile networks, and it triggers both on ordinary secure connections and on connections that use masking. In June 2025 Cloudflare reported something similar: traffic from Russia to its network fell by roughly 30%, and connections were cut after the first 10–14 packets. Roskomnadzor called those statements untrue.

Blocking by whole ranges belongs here too. A March 2026 report puts it plainly: restrictions stopped being about protocol signatures long ago, and now build in infrastructure reputation and destination-based rules. The historical illustration of collateral damage is the blocking of Telegram in 2018, when the Microsoft app store, the PlayStation network and services hosted on Amazon’s cloud were caught in the crossfire.

What is not reliably known is how long a new address survives. There are no public measurements, and any specific figures in articles on the subject are invented.

When your VPN stopped working on your phone and the VPN is not the cause

There is a separate class of cases that is easy to mistake for a blocked connection. Since May 2025 mobile internet has been switched off across Russia on a mass scale: 69 cases in May, 655 in June, 2,099 in July, and more than 11,700 shutdowns over 2025 as a whole. For comparison: 296 such cases were counted worldwide in all of 2024.

Since 5 September 2025 a “whitelist” from the digital ministry operates during shutdowns — a list of resources that stay reachable. It started with 57 services: state portals, banks, large Russian platforms, marketplaces. In March 2026 reports appeared of tests of a stricter regime in Moscow, where only an approved subset of services remains available.

The important point: if a network passes only a few permitted addresses, no masking will help — the destinations themselves are unreachable, not the way you connect to them. The symptom is distinctive: almost nothing opens, and the connection is not established at all.

Why masking helps, but not forever

The industry’s answer to protocol detection is to make a connection look like an ordinary visit to a website. Today’s most widespread approach, VLESS with Reality masking, works like this: the server does not obtain a certificate of its own but presents an outsider with the handshake of a well-known third-party site, and on a failed check sends the visitor to that real site. Active checks then yield nothing — the prober sees the genuine certificate of someone else’s resource. The Trojan protocol solves the same task differently: it pretends to be the most common protocol of all, ordinary HTTPS.

Where the limit is. First, in 2024 USENIX Security hosted a method for spotting a nested secure connection inside an encrypted stream — regardless of protocol, despite random padding and several layers of encapsulation; it was tested on a real provider’s network with more than a million users. Second, address blocking works on top of any masking: the freeze described above also hit connections that looked like VLESS over modern TLS. Third, the client fingerprint remains.

Hence the practical outcome of December 2025 and February 2026: the restrictions reached masked connections too. Analysts call such technologies “moving targets rather than permanent solutions” — and that is an honest way to put it. A detailed look at the technology itself, if the mechanics interest you: what VLESS and Reality are, in plain English.

How this looks in other countries

• China. The most studied system: the combination of passive analysis and active probes has been running since 2019, and the separation of “fully encrypted” traffic since November 2021. The architectural difference from Russia is a relatively small number of border nodes instead of thousands of points inside providers’ networks.
• Iran. The opposite approach: an allowlist rather than a blocklist. On ports 53, 80 and 443 a connection passes only if it looks like DNS, HTTP or TLS; everything else is dropped. First switched on in February 2020, then disabled for a while, and back in 2025 in some networks.
• Turkmenistan. The emphasis is on address blocking: a 2023 study found more than 7,500 addresses under filtering on any given day — about a third of the entire address space of the national networks — while over-blocking rules incidentally affected millions of domains.

What follows from all this

• The symptom points to the cause. Drops right after connecting — the protocol was probably identified; never connects at all — the address is probably closed; almost nothing works — the network itself is restricted.
• “It stopped for everyone” is rare. Restrictions arrive in waves and unevenly: at the operator next door everything may work that same day.
• It is not your device breaking. Reinstalling the app or changing phones has no effect on restrictions inside the operator’s network.
• Promises of working forever are marketing. Any masking makes detection harder without ruling it out, and address blocking does without traffic inspection entirely.

What Russian law actually says about VPNs themselves and what people are really fined for is covered separately, document by document: is it legal to use a VPN in Russia. And how the same techniques looked in the case of a single service is covered here: the YouTube slowdown in Russia.

The short version

• There are three causes: the protocol was identified, the address was closed, or the network itself was restricted. Their symptoms differ.
• The filtering equipment sits inside operators’ networks, so the picture genuinely differs between providers and regions.
• A protocol is identified by shape: service fields, the length of the first packets, ports, the uniformity of the data, the connection fingerprint and the site name in the unencrypted part.
• Blocking by address and by range works without inspecting traffic at all — hence the “changed the server and it worked” effect.
• During mobile shutdowns and under whitelists the destinations themselves are unreachable, and the connection method plays no part.
• Masking buys time, not a guarantee: in 2024 a way was shown to spot a nested secure connection regardless of protocol.