# TSPU

TSPU (Техни́ческие сре́дства противоде́йствия угро́зам — "Technical Means of Counteracting Threats") is the hardware-plus-software filtering system that Russian law requires every major ISP to install in-line with their traffic. Operated centrally by Roskomnadzor, it performs DPI, can selectively throttle or drop connections, and is the enforcement layer behind most of the circumvention-relevant blocks documented in this wiki.

## What it does

TSPU boxes sit in-path at the ISP level (not just at the border), so they see every subscriber's traffic. The capabilities that matter for circumvention:

- **SNI filtering.** Inspects the TLS ClientHello's SNI field against a blocklist and, increasingly, a whitelist. Can drop the connection, reset the TCP stream, or silently black-hole packets.
- **Statistical handshake fingerprinting.** Classifies protocol traffic (WireGuard handshake, OpenVPN handshake, Shadowsocks first packet entropy) and blocks on match. This is how "all WireGuard is blocked" works without keyword matching.
- **CIDR-level filtering.** On mobile carriers especially, connections to specific IP subnets are allowed or dropped based on a regulator-maintained list. This is the layer [[vpn-configs-for-russia|vpn-configs-for-russia]]'s "white CIDR" subscriptions are built to defeat.
- **Active probing.** In at least some deployments, TSPU replays suspicious TLS handshakes to see if the destination actually behaves like the claimed server. This is why VLESS-Reality's "steal oneself" mode — where the server actually serves the claimed site — survives better than simple domain-masquerade.
- **UDP suppression.** Summer 2025 saw mass blocking of "unidentified UDP" — anything not matching known protocols got rate-limited or dropped. This is why Hysteria2/TUIC/WireGuard all degraded at the same time.

## Known escalation timeline (recent)

Documented in ntc.party community reports and pulled into [[russia-vpn-bypass-state-2026-04]]:

- **Summer 2025** — mass blocking of unidentified UDP, major hit to Hysteria2 / TUIC / WireGuard on mobile networks.
- **Summer 2025** — Shadowsocks failures reported across multiple providers simultaneously; SS-2022 degradation started here.
- **Late 2025** — Reality-over-TCP pattern matching; community migrates to XHTTP transport.
- **February 13 2026** — mass-blocking of VPN protocols: WireGuard fully blocked, OpenVPN fully blocked, old AmneziaWG blocked. AmneziaWG 2.0 and Xray survive.
- **February 16 2026** — WireGuard block rolled out on vdsina hosting based on initial handshake; punishment escalated from per-port to all-UDP-ports-above-1000 on the endpoint.
- **April 1 2026** — multiple reports of MTProto / FakeTLS (Telegram) proxies failing midday Moscow time.
- **April 10-11 2026** — VLESS + gRPC + nginx reported collapsing on some connections, server reboots needed for brief recovery.

## Political context

TSPU is mandated by amendments to the "sovereign internet" law (Федеральный закон N 90-ФЗ, 2019) and related regulations. The operational authority sits with [Roskomnadzor](https://rkn.gov.ru/), the media regulator. ISPs don't control the boxes' policy; they're obligated to install, power, and maintain them, but the blocklists and behavior are updated centrally.

This matters for circumvention design because the threat model isn't "lots of independent blocks to work around" — it's "one central system that can push a new block to every ISP simultaneously." Timelines like "WireGuard started failing everywhere on Feb 13 2026" only make sense if you know the whole country gets a policy update at once.

## Related

- [[whitelist-internet-blocking]] — the default-deny regime TSPU enforces on mobile carriers
- [[russia-vpn-bypass-state-2026-04]] — current snapshot of which bypass methods work against TSPU
- [[vpn-configs-for-russia]], [[russia-v2ray-rules-dat]] — public resources for circumvention tuned against TSPU's current behavior
- [[domain-fronting]] — a sister technique used mainly against less sophisticated DPI (Iran's filter)
- [[tls-desync-fake-clienthello]] — client-side desync that defeats SNI inspection but not the CIDR layer; what [[gecit]] does on Linux via [[ebpf-sock-ops]]