Best VPN Protocol & Deployment for Russia — Final Report (October 2026)

Status: research synthesis as of 2026-10-25. Russia's censorship (ТСПУ / TSPU) changes week to week. Treat every recommendation as a starting point and test on your own ISP / mobile operator. Method: six rounds of research across Xray-core / net4people GitHub threads, Habr, te-st.org, zapret wiki, GFW Report (academic), and Iranian / Chinese circumvention experience. Confidence levels are given for each claim. 简体中文版: https://gist.github.com/nothing-holding/d7ac4d7f5ff9fd4132730c0577c0324b

TL;DR

1. How Russia blocks in 2026

TSPU is DPI hardware installed at every ISP (in-path, stateful), centrally controlled by Roskomnadzor. Unlike China's border-based GFW, it relies heavily on behaviour and IP reputation rather than protocol signatures alone.

flowchart TD
    C[Client in Russia] --> T{TSPU at ISP}
    T -->|1. Destination IP / ASN reputation| A1[Foreign datacenter ASN?
Hetzner, DO, OVH, Vultr...]
    T -->|2. TLS ClientHello scoring| A2[Fingerprint JA3/JA4
Chrome 133 / Safari / iOS flagged]
    T -->|3. Behaviour| A3[> 3 TLS handshakes to same SNI
within ~350-400 ms / 60 s]
    T -->|4. Data budget| A4[~15-20 KB / ~25 packets
from suspicious IP]
    T -->|5. Active probing| A5[Probe server; no real
website behind it = proxy]
    A1 & A2 & A3 --> F1[Silent freeze 120 s
no RST]
    A4 --> F2[TCP stalls after 16 KB]
    A5 --> F3[IP added to blocklist
whole /24 or ASN may follow]
    T -->|Mobile networks only| W[Whitelist mode:
default-deny, only approved IPs/SNIs]

Loading

Blocking timeline

timeline
    title Russian VPN blocking escalation
    Nov 2025 : First VLESS signature blocks
             : Connection-count policing on some home ISPs
    Feb 17 2026 : VLESS+REALITY over raw TCP hit on wired ISPs
                : ~16 KB randomness sampling
    May 21-25 2026 : Behavioural module rollout (Siberia, Moscow)
    Jun 5 2026 : Largest wave, cloud hosters hit
               : Fingerprint + burst freeze model
    Jul 2026 : Foreign-SIM roaming filtered like domestic
    Aug 2026 : Whole hoster subnets / ASNs blocked
             : 20+ VPN services down
    Sep 21-25 2026 : Post-election wave, subnet bans
    Oct 2026 : Default Xray chrome (Chrome 133) fingerprint targeted

Loading

Detection model (June 2026 reverse-engineering, "Siberian" model)

2. Russia vs China — why Chinese defaults fail in Russia

Key insight: Vision over raw TCP opens a new TLS connection per proxied connection — harmless in China, but exactly what TSPU's burst rule punishes. Since Sept 2025, VLESS Encryption lets Vision run over XHTTP, combining China's anti-TLS-in-TLS defence with Russia's need for few, multiplexed connections.

3. Protocol ranking

Speed under packet loss (indicative, third-party test, 100 Mbit/s VPS)

Vision has the best multi-threaded throughput; XHTTP has lower latency (multiplexed). No independent head-to-head benchmark exists — run your own.

4. Server location & routes

Hosting rules

Host selection — live probes from inside Russia (2026-10-25)

Method.

1. Live IP-block probes: 20 candidate IPs were traced through the cheburcheck.ru network of 32 probes inside Russia (Rostelecom, MTS, Beeline, Dom.ru, TTK and regional ISPs, Moscow to Yakutia), with 28 valid verdicts per IP.
2. ASN sweep: 79 hosting ASNs were checked for any ranges already in Russian block registries.
3. Terms check: 8 providers' official terms were read for VPN policy, Russia/KYC, extra IPv4 and refunds.

⚠️ This probe detects hard IP blocks only, not the 16 KB freeze — the Hetzner control (known to be frozen) passed 28/28. Test the freeze yourself after buying, inside the refund window.

flowchart LR
    A[89 'clean' hosts
not in registries] --> B{ASN has listed ranges?}
    B -->|Yes: Clouvider, LiteServer,
Worldstream, Keyweb, Webdock-HEL...| X[Deprioritise]
    B -->|No| C{Live probe
28 Russian vantage points}
    C -->|Any IP block| Y[Caution:
Creanova, Alwyzon, Webdock-DK, DEAC]
    C -->|28/28 OK| D{Terms + price}
    D --> W1[🥇 AlphaVPS Nuremberg]
    D --> W2[🥈 UpCloud Helsinki]
    D --> W3[🥉 HostHatch Stockholm/AMS]

Loading

Live probe results

ASNs with ranges already in registries (9/79): Clouvider, LiteServer (Infrastructure Group), Worldstream, Keyweb, PQ.Hosting/Aeza, RackNerd (HostPapa), RamNode (Hivelocity), WaveCom, Webdock-Helsinki (Data Room).

Terms of service (verified on official sites)

Final ranking

Recommended pair: AlphaVPS Nuremberg (primary) + UpCloud Helsinki (backup) ≈ €6/month — different countries, different ASNs, one refundable, one with instant IP rotation.

After buying: inside AlphaVPS's 14-day window, test the 16 KB freeze from Russia (hosting-checker / dpi-checkers) and run the primary profile for 2–3 minutes. Refund and switch to HostHatch if it fails. On UpCloud, redeploy for a new IP if needed.

5. Best deployment

Architecture

flowchart LR
    subgraph RU[Russia]
        H[Home broadband / Wi-Fi]
        M[Mobile, normal mode]
        MW[Mobile, whitelist mode]
        RL[Russian relay
whitelisted subnet
Yandex Cloud / VK Cloud / Timeweb]
        VC[VK Calls / Telemost
WebRTC tunnel]
        DNS[ISP / NSDI resolver
195.208.4.1, Yandex DoT]
    end
    subgraph FI[Server A — AlphaVPS Nuremberg]
        P1[① XHTTP + REALITY
+ VLESS Enc + Vision
XMUX=2, :443]
        P2[② TCP + REALITY + Vision]
    end
    subgraph NL[Server B — UpCloud Helsinki]
        P3[③ Hysteria2
Salamander + port hop]
        P4[④ NaiveProxy or AmneziaWG 3.1]
    end
    H --> P1
    H -.speed.-> P2
    M --> P1
    H -.fallback.-> P3
    M -.fallback.-> P4
    MW --> RL -->|XHTTP + VLESS Enc| P1
    MW -.emergency.-> VC --> P2
    MW -.last resort.-> DNS -->|dnstt / slipstream| NL

Loading

Failover decision flow

flowchart TD
    S([Connect]) --> Q1{Mobile whitelist active?}
    Q1 -->|No| A[① XHTTP + REALITY + Enc + Vision]
    A --> Q2{Works for 2-3 min?}
    Q2 -->|Yes| OK([Use it; Vision TCP for big downloads at home])
    Q2 -->|Freeze| W[Wait 130 s, do NOT change fingerprint]
    W --> Q3{Plain HTTP to server works?}
    Q3 -->|Yes - TLS scoring| B[Switch SNI / server; check XMUX connections]
    Q3 -->|No - IP blocked| C[③ Hysteria2 / ④ on Server B
request new IP in another /24]
    Q1 -->|Yes| D[Russian whitelisted relay → Server A]
    D --> Q4{Relay alive?}
    Q4 -->|No| E[WebRTC video-call tunnel]
    E --> Q5{Works?}
    Q5 -->|No| F[DNS tunnel via ISP/NSDI resolver]
    Q5 -->|Yes| OK
    Q4 -->|Yes| OK

Loading

Primary client outbound (Xray JSON)

{
  "protocol": "vless",
  "settings": { "vnext": [{ "address": "server-a.example", "port": 443, "users": [{
    "id": "UUID", "flow": "xtls-rprx-vision",
    "encryption": "" }] }] },
  "streamSettings": {
    "network": "xhttp",
    "xhttpSettings": { "path": "/random-path", "mode": "stream-one",
      "extra": { "xmux": { "maxConnections": 2, "cMaxReuseTimes": 0,
        "hMaxRequestTimes": "600-900", "hMaxReusableSecs": "1800-3000" } } },
    "security": "reality",
    "realitySettings": { "serverName": "same-ASN-neighbour.example",
      "fingerprint": "firefox", "publicKey": "PUBLIC_KEY", "shortId": "SHORT_ID" }
  }
}

Server checklist

Clients

6. Mobile whitelist mode

Since 2025–2026, many regions switch mobile internet to a default-deny whitelist (≈ 0.14 % of Russian IPv4 addresses reachable in one MegaFon scan). Per the Ministry of Digital Development (2026-03-21) this applies to mobile only — wired / Wi-Fi is unaffected.

7. Lessons borrowed from abroad

8. Operations playbook

1. One subscription link with all profiles; client url-test / fallback groups.
2. Test each profile 2–3 minutes, waiting 130 s and toggling airplane mode between runs. Tools: hyperion-cs/dpi-checkers, siberian-check, hosting-checker.
3. Test on the major home ISPs (Rostelecom, MTS/MGTS, ER-Telecom/Dom.ru, Beeline) and 2–3 mobile operators.
4. Never change fingerprint during a freeze — wait or switch node.
5. Distinguish failures: plain HTTP works but TLS fails → behavioural/fingerprint; nothing answers → IP blocklisted (check from abroad via check-host.net).
6. Update Xray weekly; rotate between 2–3 SNIs; keep a spare IP + redeploy script.
7. Expect tightening around elections and major events.

9. Confidence & open questions

Sources

Xray / GitHub

• Xray-core #6293 — Russia blocks 2026
• Xray-core #7131 — uTLS Chrome 133 fingerprint · Discussion #7144
• XHTTP: Beyond REALITY #4113 · XHTTP 5-in-1 #4118 · up/down split #6042
• VLESS Encryption PR #5067 · Sudoku finalmask PR #5685 · MASQUE/WARP PR #6878
• REALITY "fully broken" claim #6091 · Regression #6482 · #6547 hMinSocketInterval
• Xray-core releases

net4people & community

• #490 TCP freeze · #546 TLS connection policing · #650 mobile whitelists · #618 WebRTC carriers · #626 Iran shutdown · #603 Snowflake DTLS
• Hosts: cheburcheck.ru probing · cheburcheck-ipchecker · hosting-checker 113-host report · WonderNetwork Moscow pings · terms: AlphaVPS, UpCloud, Clouvider, HostHatch, Netcup
• pbldbl/vless-blocking-2026-guide · Friskes/vpn-infra OPERATORS.md · kulikov0/whitelist-bypass · yanpurvenes/hosting-checker
• zapret wiki: June 2026 TLS detection · VLESS Encryption · XHTTP · REALITY

Analysis & reporting

• Habr: behavioural freeze June 2026 · whitelists & 6 bypasses · TSPU overview · AmneziaWG 2.0→3.1 · ShadowTLS v3 weaknesses
• te-st.org: VLESS attack analysis #37 · Roaming won't save you
• oblako.sh — REALITY self-steal · avsisp — Three ways Russia breaks Xray
• Meduza — May 2026 methods · Meduza — DNS tunnel via NSDI · SecurityLab — ministry measures · The Moscow Times — post-election wave · Amnezia postmortem · Cloudflare on Russian throttling

Academic

• GFW Report: Fully encrypted traffic (USENIX'23) · QUIC SNI (USENIX'25) · Henan regional censorship (S&P'25) · CensorLess (PETS'26)
• Iran's Stealth Internet Blackout (arXiv)

This report is for research and digital-rights purposes. Laws on VPN use and hosting vary; assess your own legal and personal risk.