By mid-January 2026, Russian regulators had blocked more than 400 VPN services — 70% more than late 2025, according to Kommersant, cited in Reuters’ March 31 report on what diplomats have started calling the country’s “great crackdown.”
Digital Minister Maksut Shadayev put the policy in a single line: “The task is to reduce VPN usage.” WhatsApp is already blocked. Telegram is throttled. Mobile internet has been jammed repeatedly in Moscow and other cities.
Yet the crackdown isn’t over — it’s ongoing, and it works the way it does because of an old, boring engineering reality: modern VPN protocols were designed to be correct, not to be invisible. That difference is why the block list keeps growing.
What “blocking a VPN” means at the network layer
When people read “Russia blocked 400 VPNs,” most picture a regulator emailing a takedown to each provider. That is not what happens. What happens is that ISPs deploy Deep Packet Inspection (DPI) appliances that look at the shape of the first handshake packet and match it against a signature.
Every mainstream VPN protocol has one:
- OpenVPN opens the connection with a distinctive first byte pattern (
0x00 0x0Eopcode forP_CONTROL_HARD_RESET_CLIENT_V1). One byte, one match. - WireGuard sends a fixed 148-byte UDP handshake with magic values at offsets 0 and 4. Trivial to fingerprint.
- IPsec / IKE runs on well-known UDP ports 500 and 4500. Even without inspecting content, the port pair is a giveaway.
- L2TP rides on top of IPsec with the same tell.
Once a signature is in the DPI ruleset, every connection matching it gets a TCP RST or a silent drop. It does not matter which “brand” of VPN you paid for — under the hood most consumer VPN apps ship one of those four protocols. Block the protocol, block the app.
A ban on “400 VPNs” is often a ban on four protocols. The service names are downstream of the shape of their traffic.
Why obfuscation exists
The engineering community has known this for years, which is why entire categories of tool exist to solve it: Obfsproxy, Shadowsocks, V2Ray, Trojan. Each one wraps VPN or proxy traffic inside a payload that is designed to look like something else — usually plain TLS to a common web port.
Cloudflare’s pluggable transports work, Meek’s use of Google fronting, Tor’s Bridges — every one of these is a workaround for the same problem: the shape of the packet gives you away, not the content.
Russia’s block list catches the honest protocols. It has a harder time with the obfuscated ones, and a much harder time with a plain HTTPS request to a website.
Where a browser-tab proxy sits in this
This is the point where we can talk honestly about what a web proxy — the kind that lives in a browser tab, that you paste a URL into — actually is, on the wire.
From the network’s point of view, opening a page through a proxy at anyproxy.site looks like an ordinary HTTPS request to a normal website. The TLS handshake carries a common ClientHello. The payload is encrypted. There is no distinctive protocol byte for DPI to match on, because the payload is not a VPN protocol — it is HTTP/2 inside TLS 1.3, indistinguishable from a visit to any other site.
That does not make a web proxy a VPN replacement. It doesn’t route your whole device. It doesn’t tunnel your DNS. It doesn’t cover a mobile game or a native app. What it does do — for the specific job of opening one blocked webpage — is present a traffic shape that DPI has no signature for.
The trade-off is honest and worth stating:
| Layer | What gets blocked | What still works |
|---|---|---|
| Protocol fingerprint (Russia today) | OpenVPN, WireGuard, IPsec | Obfuscated proxies, plain HTTPS |
| Domain block | Named VPN provider domains | Mirror domains, generic HTTPS destinations |
| IP block | Specific server IPs | Any host not on the blocklist |
| Full network cut | Everything | Nothing |
The last row matters. When a country pulls the plug on mobile internet — as Russia has done repeatedly in 2026, citing anti-drone-strike measures — no tool at any layer helps. That is not a technology problem. It is a wire problem.
The cat-and-mouse pattern
Reuters observed something in that same article that any Russian internet user in 2026 can confirm: “as soon as the authorities take down one VPN, another appears, and many young Russians change their VPNs daily.”
That pattern isn’t going to stop. Every side of the crackdown is doing what its incentives push it toward. The regulator scales up DPI signature deployment. The circumvention side scales up protocol obfuscation and domain rotation. Users, caught in between, keep swapping tools.
If you are trying to open one specific page — a news site, a research paper, an outside-country email — the calculus is different from setting up a general privacy tunnel. For a single page, the browser-tab proxy is the tool with the least distinctive footprint on the wire and the fewest install steps.
Sources
- Russia goes after VPNs as ‘great crackdown’ gathers pace — Reuters, March 31, 2026.
- Kommersant, cited in the above.