# vpn-configs-for-russia

A repository of free, publicly-available VPN config subscriptions maintained by @igareck, auto-updated and auto-tested from a server inside Russia every 1-2 hours. Supports VLESS (including VLESS-Reality), VMess, Shadowsocks, Hysteria2, TUIC, and Trojan. Created November 2025, already at 4,054 stars, GPL-3.0.

Unlike typical "free VPN list" repos that scrape and deduplicate endpoints, the entries here pass real reachability/latency/speed checks from RF before publication. The maintainer ran tests manually for six weeks (Nov 13 – Dec 28) before scripting the pipeline. Dead configs get filtered out; live ones stay.

## The black/white split

The repo's structure mirrors Russia's two distinct blocking modes. See [[whitelist-internet-blocking]] for why these are separate problems.

**Black list subscriptions** — for "normal" Russian internet. YouTube, Roblox, and a long list of sites are blocked, but Google still works, DNS resolves freely, and the user's ISP doesn't enforce a default-deny policy. A standard VPN tunnel to any endpoint bypasses this. These are also the subscriptions useful to users outside Russia — they're the "international VPN" option.

- `BLACK_VLESS_RUS.txt` — full VLESS list
- `BLACK_VLESS_RUS_mobile.txt` — fastest 100 VLESS configs (mobile clients choke on larger lists)
- `BLACK_SS+All_RUS.txt` — Shadowsocks + Hysteria2 + VMess + Trojan combined

**White list subscriptions** — for Russia's mobile carriers (Megafon, Beeline, MTS, T2, Yota) in "whitelist mode," where only Roskomnadzor-approved destinations resolve/connect. This subscription layer exploits two specific weaknesses of the whitelist filter:

- **CIDR subscriptions** (`WHITE-CIDR-RU-all.txt`, `WHITE-CIDR-RU-checked.txt`, `Vless-Reality-White-Lists-Rus-Mobile.txt`) — the VPN endpoint lives on an IP subnet belonging to a whitelisted Russian hoster (VK, Yandex, CDNVIDEO, Beeline). Traffic to the endpoint looks like traffic to an approved destination, so the CIDR filter passes it. The `-checked` variant is restricted to the four most reliable hosters.
- **SNI subscription** (`WHITE-SNI-RU-all.txt`) — the outer TLS ClientHello's SNI is a whitelisted domain (e.g., `yandex.ru`), so DPI-level SNI filtering lets it through. Does nothing for CIDR-based filters, which operate at the IP layer before TLS.

All white-list configs use VLESS / VLESS-Reality because that's the protocol most resilient against Russia's active-probing DPI. See [[vless-subscription-format]] for the wire format.

## Operational notes from the maintainer

A few things stand out from the repo's explanatory text that are worth reading carefully:

- **"Real latency" test, not TCP/ICMP ping.** Clients often expose three different health checks; only the real latency test actually opens a connection to the proxy and measures end-to-end. TCP ping to the endpoint IP and ICMP ping tell you nothing about whether the VPN works.
- **Servers rotate in and out.** Free public endpoints go offline from overload or operator decisions, then come back. Don't delete configs that failed one check — retest a few hours later.
- **Install multiple clients.** Different clients see different available servers because they probe with different TLS fingerprints, timing, and test methodology. The maintainer explicitly recommends installing 2-3 clients and trying each.
- **Don't overuse CIDR configs.** They're scarce and specifically for people stuck in whitelist mode. Using them for regular VPN when a black-list config would do overloads them for the users who actually need them.

## Cautions for non-Russian users

The README screams this because it's counterintuitive: **don't use white-list subscriptions if you're outside Russia**. The CIDR configs route through Russian hoster IP space by design — great for the exact whitelist-bypass use case, useless (and slow) for anyone whose threat model is "DPI in Iran" or "basic geo-block on Netflix." Use only the BLACK subscriptions if you're elsewhere.

## Relationship to other tools

This repo provides the endpoint subscriptions. To actually use them, you pair them with:

- **A client.** Any of [[karing]], v2rayN, NekoBox, Throne, Streisand, Shadowrocket — all speak these subscription formats.
- **A rule file.** [[russia-v2ray-rules-dat]] provides the geoip/geosite files that tell the client *what* to route through the proxy (Russian-blocked domains) vs direct. The two repos are complementary: `vpn-configs-for-russia` is the proxy endpoints, `russia-v2ray-rules-dat` is the routing rules.

For users running their own infrastructure instead of using public configs, [[xray-tutorial]] walks through setting up a VLESS server from scratch and [[3x-ui]] is the management panel.

## Repo

https://github.com/igareck/vpn-configs-for-russia — 4,054 stars, GPL-3.0, primary language is plain text (the subscriptions are TXT files). Maintainer: @igareck (igareck@proton.me).

## Related

- [[russia-vpn-bypass-state-2026-04]] — current-state snapshot contextualizing which entries in these subscriptions survive which filters
- [[whitelist-internet-blocking]] — the blocking regime this repo's white-list subscriptions are built to bypass
- [[tspu]] — the DPI system doing the filtering
- [[russia-v2ray-rules-dat]] — companion rule files for client-side routing decisions
- [[vless-subscription-format]] — the wire format underlying every subscription file here
- [[karing]], [[happ-proxy]] — client-side tools that consume these subscriptions
- [[xray-tutorial]], [[3x-ui]], [[xkeen]] — server and router-level counterparts for users building their own