Internet censorship in Russia has turned into an engineering race, with users deploying increasingly exotic network configurations to stay ahead of state-level blocking. VPNs don’t get past the digital Iron Curtain anymore.

Many digital services are blocked. Commercial VPNs – disrupted. Even popular VPN tunneling protocols are detected and throttled down or blocked. So what do you do to access the wider internet without being cuffed?

You build your own proxy, disguised as ordinary web traffic, that returns genuine responses from Microsoft or any other popular service when inspected by censors.

This is just one of the methods users in Russia are sharing.

In a cat-and-mouse game, Russians are building stacks that last for a few months before getting rebuilt.

Digging digital tunnels

“I’m in Russia. My adversary isn’t a random scanner – it’s the ISPs themselves, operating under a regulator that does nationwide deep packet inspection (DPI) and can null-route foreign IP ranges by geography. Assume the network operator is hostile, has full visibility,” a user under an alias DaimonGroup posted recently on a Reddit community.

The digital dissident has dug a self-hosted tunnel and shares it with a handful of other people for uncensored internet access. But it doesn’t rely on OpenVPN or WireGuard – popular protocols in Russia are detected by their handshakes or other connection “shapes.”

Here’s how it works in a nutshell:

• First, create a domestic relay/proxy server instead of connecting directly to a foreign tunnel endpoint. Ideally, a relay uses an IP range shared with government, banking, or other important services. These IPs are less likely to be blocked and get lighter filtering: “Collateral cost is the actual defense mechanism – not stealth.”
• Users connect to the proxy using ordinary HTTPS. The client hides a cryptographic public key and presents it during the initial TLS handshake (ClientHello) in the ‘service field’. That allows the server to recognize legitimate users. To external inspectors, the traffic looks normal.
• If the user is valid, the proxy server accepts the handshake itself and uses the SNI (Server Name Indication) value set to www.microsoft.com or another large site.
• If a user is someone else, the proxy server forwards the connection to the real Microsoft server and returns a genuine response.
• The proxy server relays traffic through the foreign endpoint (virtual private server). It is likely to get blocked at some point, or smth else might break “every couple of months,” therefore the user suggests planning for rebuild speed rather than permanence.

For the software stack, DaimonGroup uses VLESS with Reality (running on Xray-core). Xray is the server software that handles connections and traffic forwarding. VLESS is the tunnel protocol that authenticates users and carries data. Reality is what disguises the connection as normal TLS/HTTPS traffic by using a real website’s SNI.

“Active probing returns a genuine Microsoft response. Real cert, real chain, real content. There is no fingerprint to find,” the “self-hosted” subreddit community member explains.

“No certificate of my own to leak, no domain of my own to get registry-listed. You don’t need a domain at all.”

Is this an ideal solution to hide from an ISP? Of course not.

“It’s trivial to detect, the ISP could just check if the Russian server’s IP is listed in Microsoft's DNS records, or verify whether it is actually serving a HTTPS service with a valid Microsoft public certificate, which it’s not,” explains Aras Nazarovas, Security Researcher at Cybernews.

“I suspect the only reason why it works is that the connection originates from domestic infrastructure that receives less scrutiny – not because of SNI spoofing.”

Russians are likely choosing the least effort-requiring working solution. DaimonGroup admitted that sustained high-volume traffic to a single IP address is one of the signals that can be easily recognized.

“Just something that hasn't been prioritized against yet.”

When the rogue country blocked Telegram, leading to mass riots, even tools that use the Shadowsocks encrypted proxy protocol reportedly stopped working. Reddit users reported opting for the “AmneziaWG” protocol, a modified fork of WireGuard, or Cloak, a tool that disguises the tunnel as normal HTTPS web traffic, as well as VLESS with Reality.

Russia’s sneaky tactics poison traffic

Clever chains of proxies eventually stop working as Russia evolves its countermeasures. One Russian user with a similar VLESS/Reality stack complained that it stopped working on mobile networks, and changing SNI targets helped only briefly. Others argued that mobile operators block foreign IPs more broadly.

Russia uses a state-controlled centralized system to maintain its censorship infrastructure, according to the Human Rights Watch report.

Internet Service Providers (ISPs) in Russia are obliged to install “the technological means for countering threats” (TSPU) equipment into their networks. The included DPI technology blocks traffic based on specific content, patterns, and application types, and examines all user traffic.

The TSPU enables authorities to block all traffic that goes anywhere but “whitelisted” websites. Separately, the state maintains a blacklist of banned websites.

However, the active interference – degrading the access – is the sneakiest of the measures. Using DPI, authorities identify services, protocols, and traffic patterns, and often throttle or disrupt rather than simply block domains.

Users report that TSPU doesn’t fully block traffic but instead selectively corrupts it.

“TCP connections get injected errors, TLS handshakes get interrupted mid-way, DNS responses get poisoned. This is why VPN connections sometimes hang at ‘connecting’ indefinitely,” one user explained on Reddit.

They also suggested proxying traffic through “clean” IP ranges of Russian hosting providers that haven't been flagged by Roskomnadzor, the federal agency that censors, monitors, and controls all digital media and telecommunications.

Nazarovas explains that historically, the most effective way to hide from ISPs was to use bridges – a private or semi-secret list of proxy endpoints that users connect to first. These proxies can then be used to establish an actual VPN tunnel through a less easily identifiable entry point.

“Many VPN/proxy protocols with obfuscation in mind by design, such as V2Ray, Xray, Shadowsocks, and others, include built-in features to manipulate’traffic shape’ by including random content length padding, as well as other tricks,” he said.

Reddit discussions make it apparent that the arms race is becoming less about encryption technologies and tunneling and increasingly about metadata: who connects where, which paths remain usable, what the traffic patterns look like, how long the sessions last, and other characteristics that reveal tunnel behavior to authorities.