By mid-January 2026, Russia had blocked more than 400 VPN services, 70% more than late 2025, according to the newspaper Kommersant, cited in Reuters’ 31 March 2026 report on what diplomats have called the country’s “great crackdown.” By late February, Roskomnadzor itself said it was restricting access to 469 VPN services (Profile, 26 February 2026).
Digital Minister Maksut Shadayev put the policy in a single line, quoted by Reuters: “The task is reduce VPN usage.” The same months saw the messengers squeezed:
- 10 February 2026: Roskomnadzor confirmed it had started slowing Telegram across Russia (Meduza).
- 12 February 2026: WhatsApp said the Russian government had “attempted to fully block” it, to push users to the state messenger Max (Bloomberg).
- 14–15 March 2026: Telegram became largely inaccessible across Russia, two weeks before a full block reported for 1 April; Meduza found no public confirmation from Roskomnadzor (Meduza, 17 March 2026).
Reuters also reported repeated mobile internet shutdowns in Moscow and other regions, which the Kremlin describes as countermeasures against Ukrainian drones. Events after those dates are not covered here; check the dates on any source before relying on it.
Why does VPN blocking work at this scale? Partly because of an old engineering reality: mainstream VPN protocols were designed to be correct, not to be invisible.
What “blocking a VPN” means at the network layer
When people read “Russia blocked 400 VPNs,” many picture a regulator emailing a takedown to each provider. Roskomnadzor describes its method differently: filters at the providers recognise the distinctive “fingerprints” of VPN traffic (Profile, February 2026). Russian ISPs run that equipment, known as TSPU, under the regulator’s central management. It looks at the shape of a connection, especially its first packets, and matches it against signatures.
Mainstream VPN protocols are easy to recognise:
- OpenVPN opens with a control packet whose opcode marks a new session, a recognisable pattern in the first bytes.
- WireGuard starts with a 148-byte UDP handshake whose first byte is the message type (1) followed by three zero bytes. Every session starts the same way.
- IPsec / IKE runs on well-known UDP ports 500 and 4500. Even without inspecting content, the port pair is a giveaway.
- L2TP usually rides inside IPsec, with the same tell.
Once a signature is in the ruleset, matching connections can be reset, dropped or slowed. It does not matter which brand of VPN you paid for if, under the hood, the app speaks one of those protocols. Fingerprinting is not limited to them, either: Profile reported that from December 2025 blocking was extended to SOCKS5, VLESS and L2TP.
Why obfuscation exists
This has been known for years, which is why whole categories of tool exist to solve it: obfs4, Shadowsocks, V2Ray/VLESS, Trojan. Each one wraps traffic so that it looks like something else, usually ordinary TLS to a common web port, or like random noise.
Tor’s pluggable transports and bridges, and meek’s use of large cloud front ends, come from the same idea: the shape of the traffic gives you away, not the content. It is an arms race, not a solved problem; the extension of blocking to VLESS shows that obfuscated protocols get fingerprinted too.
Where a browser-tab proxy sits in this
This is the point where we can talk honestly about what a web proxy, the kind that lives in a browser tab, looks like on the wire.
From the network’s point of view, opening a page through anyproxy.site is an ordinary HTTPS connection to a website: a TLS handshake and encrypted HTTP inside. There is no VPN protocol for a fingerprint to match. But it is not invisible. The handshake names the site you are connecting to (the SNI field), for example anyproxy.site or a regional server such as sg.anyproxy.site, so a regulator does not need a protocol signature: it can add the proxy’s domains to its register, as it does with any website. Russia has also shown it will block whole address ranges and newer privacy features: in November 2024 it began blocking Cloudflare connections that used Encrypted Client Hello (Risky Biz News).
We have not tested AnyProxy from inside Russia, and we do not know whether its domains are on Roskomnadzor’s register. That does not make a web proxy a VPN replacement either. It does not route your whole device, it does not cover a mobile app such as Telegram or WhatsApp, and the proxy operator handles everything you open through it.
| Layer | What gets blocked | What still works, for now |
|---|---|---|
| Protocol fingerprint | OpenVPN, WireGuard, IPsec; reportedly SOCKS5 and VLESS since December 2025 | Protocols without a matching signature yet |
| Domain block (register, SNI) | Named VPN and proxy domains | Domains not yet on the register |
| IP block | Specific server addresses or whole ranges | Hosts outside the blocked ranges |
| Full network cut | Everything | Nothing |
The last row matters. When mobile internet is switched off, as Reuters reported for Moscow and other regions, no tool at any layer helps. That is not a technology problem. It is a wire problem.
The cat-and-mouse pattern
Reuters observed what the numbers suggest: when the authorities take one VPN down, another appears, and many young Russians switch between VPN services to keep access.
Every side does what its incentives push it toward. The regulator adds signatures and domains. Circumvention tools add obfuscation and new domains. Users, caught in between, keep swapping tools.
Sources
- Russia goes after VPNs as ‘great crackdown’ gathers pace, Reuters, 31 March 2026 (Kommersant figure, Shadayev quote, mobile shutdowns).
- Roskomnadzor restricts 469 VPN services, Profile (in Russian), 26 February 2026.
- Russia begins slowing Telegram nationwide, Meduza, 10 February 2026.
- WhatsApp says Russia has tried to block its messaging service, Bloomberg, 12 February 2026.
- Russia was expected to block Telegram in April. It appears to have done it two weeks early, Meduza, 17 March 2026.
- Russia blocks Cloudflare ECH connections, Risky Biz News, November 2024.