A month in Russia: the day fourteen VPNs went down

I am writing from Russia, and the first surprise is not the one I had rehearsed. For weeks I prepared for sophisticated threats, for the devices that harvest, for the networks that listen. Three hours after landing, the problem is elsewhere, dumber and more total: I simply cannot get online. Not a slowdown or a passing lag, but a complete wall.

And above all, none of my VPNs answers. Mullvad, NordVPN, ExpressVPN, ProtonVPN, down one after another. Even AmneziaVPN, which I host on my own server, a tool built precisely to get around censorship, stays mute. I ended up cobbling together a shaky connection, an unlikely setup, just to slip one foot out of the country. Roaming, for its part, is off by default for the first twenty-four hours, just to get things off to a good start.

I had to try about fifteen solutions, turn on the obfuscations, the "chameleon" modes meant to disguise the traffic as something harmless, before a single one finally got through: Mullvad, and Mullvad alone. Not because it is better in theory, but because its disguise still holds where the others get spotted and cut. That is the real state of play, the one no guide gives you: in this country, your encrypted tunnel is worth exactly what its disguises are worth, and most of them no longer fool anyone.

Why do my tunnels fall one by one?

If my tunnels fall one after another, it is no accident. For years Russian carriers have been fitted with deep packet inspection boxes, the TSPU, imposed on every internet provider by the sovereign internet law of 2019 and steered directly by Roskomnadzor, the communications regulator. The nuance matters: it is no longer the carriers applying a blacklist handed down by the state, it is the state filtering the pipe itself, with no middleman.

The result comes with numbers. In February 2026, Roskomnadzor said it had restricted access to 469 VPN services, against 439 a month earlier. And the blocking no longer targets brands alone, it targets protocols. Since late November 2025, VLESS, one of the most advanced circumvention protocols, has been going down in turn; SOCKS5 and L2TP followed in December. This is no longer a blacklist being lengthened, it is a machine learning to recognise shapes of traffic. A blocked service can be reborn under another name; a protocol that has been fingerprinted is not saved by a change of signage.

The constraint reaches down to the carriers themselves. In the spring of 2026, courts in Moscow and Saint Petersburg began fining internet providers whose traffic partly escaped the TSPU: the monitoring centre tested whether a blocked site was still reachable with no matching trace on the equipment, and the provider was fined. Filtering is not an editorial policy, it is a controlled obligation of means.

Then there is the SIM card, and that is where my silent roaming finds its explanation. Since 6 October 2025, any foreign SIM card that latches onto a Russian network loses mobile internet and SMS for twenty-four hours, the official justification being to stop drones from guiding themselves on the cellular network. The measure was extended in November to Russian cards returning from abroad or left inactive for several days. What I had taken for a failure at my carrier was the rule, applied to the letter.

Part of what you open out of habit every morning is degraded or unreachable here: Western social networks, messaging apps, entire search engines slowed to the point of uselessness. Elsewhere you are politely promised that your connection is private. Here the contract is more honest: everything that passes can be read, and a leak never dies. Public wifi, needless to say, does not exist for me.

Which VPN still works in Russia in 2026?

Only one, for me, and only in disguise. The reason is technical and fits in a sentence: against a system that recognises protocol signatures, the only defence still worth anything is to stop looking like a VPN.

Mullvad has been disguising its traffic with Shadowsocks since 2019, first on OpenVPN then on WireGuard, and added QUIC obfuscation in September 2025, which wraps the tunnel in something that has every appearance of HTTP/3, that is, ordinary web traffic; the feature reached mobile in October. The provider itself writes in black and white that the majority of its servers are blocked in Russia, and advises trying several cities with QUIC or Shadowsocks turned on. That is exactly what I ended up doing, after about fifteen attempts.

Please do not take that sentence for a lasting recommendation. I am not publishing a ranking, I am describing a snapshot, in a country where the adversary iterates faster than the buying guides. The lists of "best VPNs for Russia" you will find online mostly have a shelf life shorter than a quarter, and this one will be no exception.

A word on legality, because the question always comes up. Using a VPN is not punished as such. Advertising a VPN service, however, has since 1 September 2025 carried a fine ranging from 50,000 to 500,000 rubles depending on whether the offender is an individual, a manager or a company, and the same law punishes the mere act of searching online for content listed in the federal registry of so-called extremist materials with a fine of 3,000 to 5,000 rubles. The tool is not punished, what makes it known is drained away and curiosity is made expensive. It is more effective, and it tells better.

Do you really need two phones to cross the border?

Let us start from the beginning, because none of this was improvised. The night before leaving, I did not pack a suitcase, I prepared two phones. One clean, almost empty, the one that can be demanded at the border and searched without finding anything. The other, the one that carries my life, my full digital alter ego, switched off and encrypted until I am somewhere safe. This is not fear, it is the reflex of politely paranoid people, those who have learned not to confuse caution with panic. And at the end of the trip there is no client and no mission, just family and a month ahead of us.

The border, precisely, is no longer a simple stamp in a passport. The disguised network devices, those fake antennas that pass themselves off as an ordinary relay and harvest whatever a phone hands them the moment it connects, are still there, at customs, very much present. But let us be clear, this is not a Russian speciality. You find exactly the same setup in the United States, in Israel, in plenty of countries we more readily hold up as examples. The difference is not in the technology, it is in the number of people it bothers.

And while fake antennas are hard to document by nature, device searches can be counted. In fiscal year 2025 alone, U.S. customs examined 55,318 electronic devices, 13,590 of them belonging to American citizens, up nearly 18% year on year. Set against the flow of travellers, that is still less than 0.01% of arrivals, which is precisely the point: the probability is low and the consequence, if it lands on you, is total. That is the very definition of a risk you handle through preparation rather than statistics. Hence the rule, valid everywhere: a clean device to cross, and the real one you never switch on until you are far from the counter.

Why does mobile internet go dark all at once?

There are even moments when the network shuts down entirely. In several regions, mobile internet drops all at once, and for once the reason holds up: a dead zone of a few minutes, and drones lose their bearings, unable to guide themselves or strike. The blackout is not an administrative whim, it is a shield. You learn to deal with a country that switches off its digital sky whenever it feels targeted.

The problem is that the shield has grown. The monitoring project Na Sviazi has recorded mobile internet restrictions in at least 63 regions, including far from any front line, and Moscow went through close to three weeks of blackouts in March 2026. In a country where mobile internet accounts for 50 to 70% of data traffic, this is no longer an occasional measure, it is an operating mode: losses for Moscow businesses have been estimated at around 12.5 million dollars a day.

And the blackout is never quite a blackout. Since the digital ministry's announcement in the summer of 2025, a whitelist of roughly five hundred services stays reachable during the shutdowns: carriers, federal media, the central bank, public websites, marketplaces, Russian social networks and the state messaging app. In other words, the outage does not make the country mute, it temporarily returns it to an approved internet. That is the detail I hold on to: the emergency measure has produced, as a side effect, the working mock-up of a closed national network.

The practice, for that matter, was not invented in Moscow. In 2025, at least 313 internet shutdowns were recorded in 52 countries, a record, with at least one shutdown on every day of the year. Russia is not an exception in the world, it is its most accomplished version.

What vanished from my screen: the bank card and the messaging apps

The rest comes from the same learning curve. Since 2022, Visa and Mastercard cards no longer work: both networks suspended their operations in early March, effective 10 March, and cards issued outside Russia work neither with merchants nor in ATMs. The gesture of paying without thinking, of pulling out your phone for a coffee, disappears. Back to cash, to making do, to that form of digital amputation that throws you off in the first days more than you would admit.

The messaging apps went the same way, faster. WhatsApp was blocked on 12 February 2026, a hundred million or so users at a stroke. Telegram was not cut off but throttled: on 10 February the regulator announced country-wide restrictions, and files, photos and voice messages stop loading. Meanwhile the state messaging app Max has been preinstalled at the factory on every smartphone and tablet sold in the country since 1 September 2025. It offers no end-to-end encryption and states that it passes its users' data to the authorities on request.

That is the full sequence, in three moves: block the foreign competitor, degrade the one you cannot block, preinstall your own. Nobody ever had to order anyone to switch apps.

Unreachable, and therefore present

And there is a side effect I had not anticipated, one I note without making a poem of it. From cutting everything off, from distrusting every device, I put the phone down, for good. It no longer asks for anything. What remains is the table and conversations that last because nothing comes to interrupt them. The most surveilled country on my route made me, without meaning to, unreachable, and therefore present.

What you carry weighs more than the lock

We think travel security comes down to the lock on the room and the neighbourhood you avoid at night. It comes first from what you carry. A work laptop is often worth more than everything else in a suitcase, and no one declares it at customs. The traveller has become a carrier of data before being a body to keep safe, and almost no one briefs them on that.

On my way back, the clean phone will be wiped, the other treated like everything that has spent a month on these networks: reset, compromised on principle. It sounds excessive, it is a little less so here, in a country that at least has the honesty not to pretend the network is on your side. There remains this irony I half enjoy: I built a small fortress to keep my data from leaking out, and the country, for its part, solved the problem another way, by making any connection to the outside world nearly impossible. Between me and total disconnection, all that is left is a Swedish VPN and its disguises.

---

Sources

• TSPU, the sovereign internet law of 2019, protocol blocking and fines against internet providers: Zona Media, 7 April 2026.
• 469 VPN services restricted in February 2026, against 439 in January: Izvestia, 26 February 2026 and Human Rights Watch, 12 March 2026.
• Blocking of the VLESS protocol from late November 2025: Mezha and VPN Guild.
• Twenty-four-hour block on foreign SIM cards since 6 October 2025: The Moscow Times, 8 October 2025 and The Record; extension to Russian cards returning or left inactive: Novaya Gazeta Europe, 11 November 2025.
• Shadowsocks and QUIC obfuscation, and the state of servers in Russia: Mullvad, help page on restrictive locations, Mullvad, Shadowsocks for WireGuard and Tom's Guide.
• Fines for advertising VPN services and for searching for "extremist" content, in force on 1 September 2025: Meduza, 31 July 2025 and Human Rights Watch, 24 July 2025.
• Mobile internet shutdowns, at least 63 regions affected and three weeks in Moscow: Human Rights Watch, 31 March 2026 and OSW, 17 March 2026.
• Whitelists of services reachable during the shutdowns: The Record and Ukrainska Pravda, 19 March 2026.
• 313 internet shutdowns in 52 countries in 2025: #KeepItOn annual report, Access Now, March 2026.
• Visa and Mastercard suspending operations in Russia, March 2022: The Moscow Times, 6 March 2022 and Visa press release.
• WhatsApp blocked on 12 February 2026 and preinstallation of the state messaging app Max: CNBC, 12 February 2026 and CNN, 12 February 2026.
• Restrictions announced on Telegram on 10 February 2026: Euronews and The Moscow Times.
• Searches of electronic devices by U.S. customs, fiscal year 2025: U.S. Customs and Border Protection and Statista.