Russia — Sovereign Internet / TSPU#
Overview#
Russia’s censorship system, known as the Sovereign Internet Law or TSPU (Technical Means of Countering Threats), enforces blocklisting of prohibited content at the ISP level using DPI equipment installed within the national network infrastructure.
What It Blocks#
- Social media platforms and news sites designated as extremist
- VPN and proxy provider websites and their installation packages
- Tor network nodes (known entry and bridge IPs)
- Certain messaging protocols (some VoIP and encrypted messengers)
- DNS queries to non-government-approved resolvers
What Works#
- VLESS + REALITY — Highly effective; TLS handshake mimicry evades TSPU inspection.
- VMess + WebSocket + TLS — Works when combined with CDN fronting or non-standard ports.
- Hysteria2 — QUIC-based traffic evades many DPI signatures.
- Obfuscated WireGuard — Using tools like AmneziaWG to scramble WireGuard handshake.
- Tor bridges — With obfuscation (obfs4, snowflake), though bridge discovery is a challenge.
What Usually Does Not Work#
- Standard OpenVPN and vanilla WireGuard.
- Known VPN provider IPs that are in the blocklist.
- Tor without bridges or obfuscation.
- Direct connections to IPs hosting banned content.
Tips#
- Prefer hosting your server outside Russian jurisdiction.
- Use censorship-resistant app stores or direct downloads to obtain client software before it is blocked.
- Consider using a CDN to further obscure server location.
- Bridge discovery for Tor requires out-of-band methods (email, Telegram bots).
Caveats#
- The government can force ISPs to block any IP or protocol.
- DPI equipment is installed at the network core — traffic cannot bypass it by switching providers.
- Legal risks exist for both operating and using circumvention tools.