VPN for Russia: what still gets through TSPU

Filtering happens inside Russian networks, on TSPU boxes that providers are required to install and that are managed centrally. They work on several levels at once:

• By protocol. The handshakes of classic VPNs, such as OpenVPN, WireGuard and IPsec/IKE, are recognised and dropped on many networks, whatever port they use.
• By address and name. Addresses of known VPN servers are blocked, and so are connections that announce a blocked site name.
• By behaviour. Connections to servers abroad that look like tunnels can be slowed down or cut, even when nothing in them is recognisable.
• By region. During mobile internet restrictions in some regions, only an approved list of large services stays reachable.

Rules differ between providers and between home and mobile networks, and they change without notice. That is why one fixed setup is not enough, and why the next section is an order of things to try rather than a promise that one of them always works.

1. VLESS Reality on a direct route. Start here. The connection looks like an ordinary HTTPS visit to a well-known website, and it is usually the fastest option.
2. A 2-hop route through the entry node in Russia, if connections abroad are slow or blocked on your network. Your device then only talks to a server inside Russia.
3. XHTTP, if Reality connects but stalls or drops after a while. It carries the same traffic as many ordinary-looking web requests instead of one long connection.
4. Hysteria2, if UDP gets through on your network. It is QUIC over UDP and often the quickest on lossy mobile links; where UDP is blocked it will not connect at all.
5. olcRTC, when almost nothing else works. It is slower than the others, but it looks like a video call.

Keep more than one of these in your app, especially on mobile, where what works can change from day to day and from place to place.

A 2-hop route uses two nodes: an entry node your device connects to, and an exit node abroad where your traffic reaches the internet. For Russia the entry node sits inside Russia, so the connection your provider sees goes to a Russian server. The entry passes your traffic on, still encrypted, over a tunnel between the two servers. It cannot see what you open, and the exit sees the entry’s address instead of yours.

It costs more and adds a little latency: you pay the entry node’s price plus the exit’s, plus the 20% network fee, and the marketplace shows the total before you connect. Reality, Hysteria2 and XHTTP work over 2-hop routes; olcRTC always goes directly to the exit.

The marketplace shows, for each exit, whether an entry node in Russia is online.

olcRTC carries your traffic inside a video call on a major video-conferencing service. To your provider it looks like a call with that service rather than a connection to a VPN server. The exit node joins the same call and sends your traffic to the internet from its own address. It carries UDP too, so voice calls and games work over it.

It is built for the worst case: networks where only a short list of large services still works. A video call carries far less data than a direct connection, so expect it to be slower than the other transports. It needs an olcRTC-capable client; the open-source Ghostlane is one, while Happ, Hiddify and V2RayNG cannot run it. How olcRTC works.

1. Create an account with an email address, or open the ProofKit bot in Telegram. A TON wallet is only needed to add funds.
2. Top up with TON from your wallet with TonConnect, or send a transfer to the escrow contract with the comment deposit from the wallet linked to your account.
3. Connect to an exit in the marketplace: directly, or through the entry node in Russia. Every connection becomes a server line in your app, and a line costs nothing until traffic flows through it.
4. Add your subscription link to your app once; it keeps the list up to date. In the dashboard, set Transports in subscription to All: the list for Happ, Hiddify and V2RayNG starts with Reality only. App guides: Hiddify, V2RayNG, help center.

• An exit’s address gets blocked. Connect to another exit: each is a separate server with its own address.
• The entry node in Russia goes offline. Lines through it stop working until it is back, so keep a direct line in your list as well.
• Reality works on Wi-Fi but not on mobile data, or the other way round. Keep a second transport or a 2-hop line in your list.
• Your balance reaches zero. Sessions close automatically; top up and your lines work again.
• Everything is cut in your region. During a full shutdown no VPN gets through; olcRTC helps only while the video service it uses stays reachable.

Rules on VPN use differ by country and change often. Check what applies where you are.