Current state of VPN circumvention in Russia (April 2026)

Current state of VLESS in Russia (as of April 2026)

The short version: plain VLESS+Reality with TCP+Vision is still the baseline, but it's been degrading region-by-region since late 2025. The winning configuration on ntc.party right now is VLESS + Reality + XHTTP (often with steal-oneself), with CIDR whitelisting as the critical factor. Pure Reality/Vision on random hosters is the thing that's breaking.

What's being blocked and how

TSPU is now running a whitelist based on the SNI in the TLS handshake, and has additionally started applying a whitelist based on the CIDR (IP subnets) of destination servers. This is the real story behind the "VLESS is blocked" headlines — Reality as a protocol hasn't been broken, but connections to "suspicious" subnets (Hetzner, DigitalOcean, OVH, many Cloudflare ranges) are being actively throttled or dropped during/after the handshake.

What's working

1. VLESS + Reality + XHTTP (the new default). At the end of 2025, RKN began blocking the REALITY security layer in some regions. XHTTP looks like regular HTTP/2 or HTTP/3 traffic rather than raw TLS, which sidesteps the statistical fingerprinting that catches Reality-over-TCP. Canonical ntc.party thread: "Панель, XHTTP и REALITY на одном сервере с портом 443".
2. VLESS + Reality + XHTTP + "steal oneself". Instead of impersonating Microsoft/Apple/Yandex, present your own real domain+cert at 443 and fall back to nginx for non-proxy traffic. Survives active probing because the server actually is that site.
3. VLESS on whitelisted SNI + whitelisted CIDR. Surviving SNIs: max.ru, sun6-21.userapi.com, other state-approved whitelist domains. IP must also land in a "white" CIDR — personal VPSes on OVH/Hetzner/DO get dropped even with correct SNI.
4. Cascade through RU VPS → foreign VPS. Small RU VPS as the whitelisted endpoint, tunnels to real foreign exit. ~80% throughput hit (500 → 90 Mbps in OP's case), needs client-side fragmentation + noise on the first hop.

What's breaking (don't bother in 2026)

• VLESS + Reality + Vision over plain TCP on non-whitelisted CIDRs — dropping intermittently on mobile operators across Povolzhye, SPb, Yekaterinburg.
• VLESS + gRPC + nginx — fully collapsed on some connections April 10–11 2026 with servers needing reboots.
• WebSocket without Reality — detectable via statistical analysis.
• MTProto/FakeTLS for Telegram — started failing across multiple users on ntc.party around midday Moscow time on April 1, 2026.

Non-VLESS circumvention methods in Russia (April 2026)

Tier 1 — Actively working

• AmneziaWG 2.0 — clear winner among WireGuard-family. As of Feb 13 2026, TSPU mass-blocking VPN protocols; WireGuard fully blocked, OpenVPN fully blocked, old AmneziaWG blocked, but AmneziaWG 2.0 and XRay still work. Amnezia founder Mazay Banzaev: over summer RKN almost completely blocked unidentified UDP traffic, which prompted the upgrade.
• Trojan (with TLS) — still listed as working by Amnezia team. Needs real cert on non-suspicious CIDR.
• NaiveProxy — HTTP/2-over-TLS disguised as Chrome traffic. Literal Chromium doing the handshake.
• Hysteria2 / TUIC (with caveats) — QUIC-based. Work on home fiber, flaky on mobile. Port 443/UDP mandatory, obfs padding matters.

Tier 2 — Situational / degraded

• Shadowsocks (2022 variant) — old SS dead from Russia since summer 2025 (personal SS servers in NL and paid SS VPNs failing simultaneously, reachable over HTTP/SSH but SS/Outline resets). SS-2022 somewhat better but still detected via first-packet entropy. OK when tunneled inside something else.
• Outline — same story, it's Shadowsocks with nicer UI.
• Cloak / ShadowTLS / ShadowQuic — legit-website TLS cert during initial handshake. ShadowTLS v3 works on right CIDR+SNI; same CIDR whitelist problem.

Tier 3 — Dead or dying

• Plain WireGuard — ~Feb 16 2026 on vdsina hosting, WG block rolled out based on initial handshake. Previously blocked only the UDP port receiving the handshake; now blocks all UDP ports except <1000.
• OpenVPN — fully blocked across major operators.
• VMess — listed among "generally still work" but community has migrated off; known statistical fingerprints.
• MTProto / FakeTLS — April 1 2026, multiple users reported failures midday Moscow time.
• L2TP / IKEv2 / PPTP — trivially DPI-detectable, blocked where it matters.

Orthogonal tools

• zapret / GoodbyeDPI / ByeDPI — client-side fragmentation/TTL manipulation. No exit out of Russia, just help reach blocked resources by splitting the TLS ClientHello so TSPU's SNI matcher chokes. Active development.
• Cascade / multihop through RU VPS — pattern regardless of protocol. Russian VPS on "white" network first hop, foreign exit second hop.

Practical recommendation

For a non-VLESS primary in April 2026: AmneziaWG 2.0 for general use + Hysteria2 as performance-optimized secondary on home connections. Trojan-TLS or NaiveProxy fallback for when UDP gets squeezed on mobile. Layer zapret on top for direct-access without tunneling.

The protocol matters less in 2026 than the CIDR of your exit IP and whether you're doing proper fingerprint obfuscation (padding, mux, fragmentation). Poorly configured VLESS+Reality dies faster than a well-configured AmneziaWG 2.0.

Hosting recommendations (April 2026)

Framing shift from 2023-2024: pick on CIDR survival against the TSPU whitelist and hoster cooperation with RKN, not on price/latency.

Tier 1 — Community-recommended

• PQ.Hosting (Moldova) — explicitly circumvention-friendly, 25+ locations, doesn't respond to RKN. Popular enough that subnets get poked at.
• 4vps.su — small, RU-speaking support, VPN-specific. Referenced in AntiZapret-VPN deployment docs.
• justhost.asia — cheap experiments. Shared IPs often pre-burned; dedicated-IP works.
• ishosting — 40+ countries, VPN-tolerant ToS. Good for unusual geography.
• VDSina — Feb 16 2026 WireGuard block rolled out on their NL hosting based on handshake. OK for Xray-stack, bad for WG-family.
• waicore, senko.digital, hshp.host — smaller = less TSPU scrutiny = advantage.
• u1host — publishes detailed docs on current blocks (their Feb 2026 VPN troubleshooting page is a real-world reference).

Tier 2 — Use with caution

• Aeza — Dec 3 2025 started sending clients notifications about possible service blocking for VPN use, reportedly tied to RKN-provided list from 138.124/16 subnet. Will terminate or IP-swap under pressure. OK for personal, avoid RU-resident IPs.
• Timeweb Cloud, Selectel, REG.RU, Beget — Russian companies, comply with RKN. Only useful as the RU-side first hop in a cascade.
• VK Cloud — referenced as first-hop for whitelist bypass specifically because it's inside mobile-operator whitelists. Not alone; as RU endpoint in a chain.

Tier 3 — Avoid for new deployments

• Hetzner, OVH, DigitalOcean, Vultr, Contabo — entire CIDR ranges now TSPU-flagged. Circumvention from these requires intermediate node with whitelisted IP. Home-fiber still sometimes reaches.
• Cloudflare (as origin) — throttled/dropped on RU networks. Useful as intermediate CDN, not as endpoint.

Selection matrix

• Personal exit: PQ.Hosting or 4vps.su in non-mainstream country (Moldova, Serbia, Finland beat DE/NL).
• Cascade: RU-side on VK Cloud/Selectel/Timeweb (small plan); foreign exit on PQ.Hosting/ishosting.
• Budget: justhost.asia or waicore; expect to rotate IPs.
• Maximum stability: ishosting or u1host dedicated IP in less-targeted country (Kazakhstan, Armenia, Serbia, Turkey).
• IPv6-only: underused but effective. Hetzner/OVH IPv6 plans still work where IPv4 fails.

Buying pattern

• Treat VPS IPs as disposable. Budget for IP rotation (€1-3 or destroy/recreate).
• Version-control configs so respinning is 5 minutes.
• Health-check from an RU mobile connection every few minutes; rotate before users notice.
• Don't bring up WireGuard/OpenVPN/Shadowsocks first on a new IP — burns the new address immediately. Start with VLESS+Reality+XHTTP or AmneziaWG 2.0.