# Current state of VPN circumvention in Russia (April 2026)

## Current state of VLESS in Russia (as of April 2026)

**The short version:** plain VLESS+Reality with TCP+Vision is still the baseline, but it's been degrading region-by-region since late 2025. The winning configuration on ntc.party right now is **VLESS + Reality + XHTTP** (often with steal-oneself), with **CIDR whitelisting** as the critical factor. Pure Reality/Vision on random hosters is the thing that's breaking.

### What's being blocked and how

TSPU is now running a whitelist based on the SNI in the TLS handshake, and has additionally started applying a whitelist based on the CIDR (IP subnets) of destination servers. This is the real story behind the "VLESS is blocked" headlines — Reality as a protocol hasn't been broken, but connections to "suspicious" subnets (Hetzner, DigitalOcean, OVH, many Cloudflare ranges) are being actively throttled or dropped during/after the handshake.

### What's working

1. **VLESS + Reality + XHTTP** (the new default). At the end of 2025, RKN began blocking the REALITY security layer in some regions. XHTTP looks like regular HTTP/2 or HTTP/3 traffic rather than raw TLS, which sidesteps the statistical fingerprinting that catches Reality-over-TCP. Canonical ntc.party thread: "Панель, XHTTP и REALITY на одном сервере с портом 443".
2. **VLESS + Reality + XHTTP + "steal oneself"**. Instead of impersonating Microsoft/Apple/Yandex, present your own real domain+cert at 443 and fall back to nginx for non-proxy traffic. Survives active probing because the server actually is that site.
3. **VLESS on whitelisted SNI + whitelisted CIDR**. Surviving SNIs: `max.ru`, `sun6-21.userapi.com`, other state-approved whitelist domains. IP must also land in a "white" CIDR — personal VPSes on OVH/Hetzner/DO get dropped even with correct SNI.
4. **Cascade through RU VPS → foreign VPS**. Small RU VPS as the whitelisted endpoint, tunnels to real foreign exit. ~80% throughput hit (500 → 90 Mbps in OP's case), needs client-side fragmentation + noise on the first hop.

### What's breaking (don't bother in 2026)

- VLESS + Reality + Vision over plain TCP on non-whitelisted CIDRs — dropping intermittently on mobile operators across Povolzhye, SPb, Yekaterinburg.
- VLESS + gRPC + nginx — fully collapsed on some connections April 10–11 2026 with servers needing reboots.
- WebSocket without Reality — detectable via statistical analysis.
- MTProto/FakeTLS for Telegram — started failing across multiple users on ntc.party around midday Moscow time on April 1, 2026.

## Non-VLESS circumvention methods in Russia (April 2026)

### Tier 1 — Actively working

- **AmneziaWG 2.0** — clear winner among WireGuard-family. As of Feb 13 2026, TSPU mass-blocking VPN protocols; WireGuard fully blocked, OpenVPN fully blocked, old AmneziaWG blocked, but AmneziaWG 2.0 and XRay still work. Amnezia founder Mazay Banzaev: over summer RKN almost completely blocked unidentified UDP traffic, which prompted the upgrade.
- **Trojan (with TLS)** — still listed as working by Amnezia team. Needs real cert on non-suspicious CIDR.
- **NaiveProxy** — HTTP/2-over-TLS disguised as Chrome traffic. Literal Chromium doing the handshake.
- **Hysteria2 / TUIC (with caveats)** — QUIC-based. Work on home fiber, flaky on mobile. Port 443/UDP mandatory, obfs padding matters.

### Tier 2 — Situational / degraded

- **Shadowsocks (2022 variant)** — old SS dead from Russia since summer 2025 (personal SS servers in NL and paid SS VPNs failing simultaneously, reachable over HTTP/SSH but SS/Outline resets). SS-2022 somewhat better but still detected via first-packet entropy. OK when tunneled inside something else.
- **Outline** — same story, it's Shadowsocks with nicer UI.
- **Cloak / ShadowTLS / ShadowQuic** — legit-website TLS cert during initial handshake. ShadowTLS v3 works on right CIDR+SNI; same CIDR whitelist problem.

### Tier 3 — Dead or dying

- **Plain WireGuard** — ~Feb 16 2026 on vdsina hosting, WG block rolled out based on initial handshake. Previously blocked only the UDP port receiving the handshake; now blocks all UDP ports except <1000.
- **OpenVPN** — fully blocked across major operators.
- **VMess** — listed among "generally still work" but community has migrated off; known statistical fingerprints.
- **MTProto / FakeTLS** — April 1 2026, multiple users reported failures midday Moscow time.
- **L2TP / IKEv2 / PPTP** — trivially DPI-detectable, blocked where it matters.

### Orthogonal tools

- **zapret / GoodbyeDPI / ByeDPI** — client-side fragmentation/TTL manipulation. No exit out of Russia, just help reach blocked resources by splitting the TLS ClientHello so TSPU's SNI matcher chokes. Active development.
- **Cascade / multihop through RU VPS** — pattern regardless of protocol. Russian VPS on "white" network first hop, foreign exit second hop.

### Practical recommendation

For a non-VLESS primary in April 2026: **AmneziaWG 2.0** for general use + **Hysteria2** as performance-optimized secondary on home connections. **Trojan-TLS** or **NaiveProxy** fallback for when UDP gets squeezed on mobile. Layer zapret on top for direct-access without tunneling.

The *protocol* matters less in 2026 than the **CIDR of your exit IP** and whether you're doing proper fingerprint obfuscation (padding, mux, fragmentation). Poorly configured VLESS+Reality dies faster than a well-configured AmneziaWG 2.0.

## Hosting recommendations (April 2026)

Framing shift from 2023-2024: pick on **CIDR survival against the TSPU whitelist** and **hoster cooperation with RKN**, not on price/latency.

### Tier 1 — Community-recommended
- **PQ.Hosting** (Moldova) — explicitly circumvention-friendly, 25+ locations, doesn't respond to RKN. Popular enough that subnets get poked at.
- **4vps.su** — small, RU-speaking support, VPN-specific. Referenced in AntiZapret-VPN deployment docs.
- **justhost.asia** — cheap experiments. Shared IPs often pre-burned; dedicated-IP works.
- **ishosting** — 40+ countries, VPN-tolerant ToS. Good for unusual geography.
- **VDSina** — Feb 16 2026 WireGuard block rolled out on their NL hosting based on handshake. OK for Xray-stack, bad for WG-family.
- **waicore, senko.digital, hshp.host** — smaller = less TSPU scrutiny = advantage.
- **u1host** — publishes detailed docs on current blocks (their Feb 2026 VPN troubleshooting page is a real-world reference).

### Tier 2 — Use with caution
- **Aeza** — Dec 3 2025 started sending clients notifications about possible service blocking for VPN use, reportedly tied to RKN-provided list from 138.124/16 subnet. Will terminate or IP-swap under pressure. OK for personal, avoid RU-resident IPs.
- **Timeweb Cloud, Selectel, REG.RU, Beget** — Russian companies, comply with RKN. Only useful as the RU-side first hop in a cascade.
- **VK Cloud** — referenced as first-hop for whitelist bypass specifically because it's inside mobile-operator whitelists. Not alone; as RU endpoint in a chain.

### Tier 3 — Avoid for new deployments
- **Hetzner, OVH, DigitalOcean, Vultr, Contabo** — entire CIDR ranges now TSPU-flagged. Circumvention from these requires intermediate node with whitelisted IP. Home-fiber still sometimes reaches.
- **Cloudflare (as origin)** — throttled/dropped on RU networks. Useful as intermediate CDN, not as endpoint.

### Selection matrix
- **Personal exit**: PQ.Hosting or 4vps.su in non-mainstream country (Moldova, Serbia, Finland beat DE/NL).
- **Cascade**: RU-side on VK Cloud/Selectel/Timeweb (small plan); foreign exit on PQ.Hosting/ishosting.
- **Budget**: justhost.asia or waicore; expect to rotate IPs.
- **Maximum stability**: ishosting or u1host dedicated IP in less-targeted country (Kazakhstan, Armenia, Serbia, Turkey).
- **IPv6-only**: underused but effective. Hetzner/OVH IPv6 plans still work where IPv4 fails.

### Buying pattern
- Treat VPS IPs as disposable. Budget for IP rotation (€1-3 or destroy/recreate).
- Version-control configs so respinning is 5 minutes.
- Health-check from an RU mobile connection every few minutes; rotate before users notice.
- **Don't bring up WireGuard/OpenVPN/Shadowsocks first on a new IP** — burns the new address immediately. Start with VLESS+Reality+XHTTP or AmneziaWG 2.0.