On September 22 and 23, 2026, two days after the State Duma elections closed, Russian users in dozens of regions found their VPNs had stopped working. Complaints spiked in Moscow, Moscow Oblast, St Petersburg, Samara, Novosibirsk, Rostov, Sverdlovsk, Chelyabinsk, Yaroslavl, Tatarstan, and Yakutia. Moscow alone logged roughly 1,900 complaints on the first day and about 2,500 on the second. It wasn't a random outage. It was the latest and largest step in a crackdown that has been building all year. Here's what happened, how it works technically, and what it means for the roughly 40% of Russians who rely on a VPN.
Table of Contents
What Happened on September 22–23
Users reported failures across several VPN apps and on the major carriers Rostelecom, MTS, and Megafon. Some unrelated services, including Steam, DeepSeek, and Telegram, also had problems, which is typical when filtering rules are broad. Analysts said the pattern matched the protocol-level and hosting-level filtering seen during smaller incidents in August, when about 20 VPN providers were hit by bulk IP blocking. That points to deliberate network-level filtering, not a technical fault.
The timing fits a pattern that business papers Kommersant and RBC had reported back in May: some restrictive measures, including a planned surcharge on foreign mobile traffic, would wait until after the September elections. Observers have called it a "post-election squeeze."
The 2026 Crackdown Timeline
- February 2026: At least 469 VPNs blocked under Russia's 2017 VPN law; Google fined 22.8 million rubles (~$300,000) for not removing VPN apps.
- March 2026: Apple removed several VPN and proxy apps at Roskomnadzor's request. Major mobile operators were told to stop allowing Apple account payments through mobile billing, a common way people paid for VPNs.
- April 2026: The Ministry of Digital Development instructed more than 20 major internet companies to detect VPN users and deny them access, or lose their place on the government's "whitelist."
- June 2026: Amnezia VPN faced bulk IP blocking, phishing of its staff, and DDoS attacks, and took about six weeks to recover.
- August 2026: About 20 VPN providers were disrupted by bulk IP blocking.
- September 22–23, 2026: The multi-region blocking wave.
- October 2026: Discussion of fees aimed at heavy international 5G traffic, and of a law barring domestic hosting providers from serving VPN operators.
Human Rights Watch described the trend on September 24 as the Russian government's "escalating attacks on censorship circumvention."
How "Whitelist" Shutdowns Work
Since May 2025, mobile internet has been switched off region by region, officially to counter Ukrainian drones. Since September 2025, those cuts have often been whitelist shutdowns: instead of blocking particular sites, everything is blocked except an approved list, such as banks, government portals, Yandex, and large Russian online stores. Mobile shutdowns of this kind have been reported in 59 regions.
This matters for VPNs because a whitelist inverts the usual cat-and-mouse game. A blacklist has to find and block each VPN server. A whitelist only lets through what's approved, so any VPN server not on the list simply can't be reached. No VPN protocol can connect to a server the network won't route traffic to.
How VPN Traffic Gets Filtered
Outside full shutdowns, Russia's TSPU filtering equipment uses deep packet inspection (DPI) to recognise VPN protocols by their handshake patterns, packet sizes, and timing. Standard OpenVPN and WireGuard® have recognisable fingerprints, which is why providers serving Russia increasingly use obfuscation to make tunnels look like ordinary HTTPS. Our explainer on how VPNs deal with DPI covers the techniques. Bulk IP blocking works alongside DPI by targeting the data centres and hosting providers where VPN servers run.
What Still Works, and What Doesn't
Honestly, nothing is guaranteed in Russia right now, and any provider claiming otherwise is overselling.
- During whitelist shutdowns, VPNs generally can't connect at all on mobile networks. Home broadband is usually less affected.
- During DPI-based blocking, switching servers or protocols often helps, because blocks tend to hit specific IP ranges or fingerprints.
- Prepare in advance. Install apps while app stores and payment methods still work, and keep more than one option.
- Stay legal and informed. Using a VPN isn't illegal for individuals in Russia, but using one to look for "extremist" content can bring fines, and VPN use can count as an aggravating factor in some offences.
See our VPN for Russia guide for more practical background.
The Bigger Picture
About 57 million people in Russia, roughly 40% of the population, are estimated to use VPNs, which makes outright blocking politically and economically costly. That's why the state is going after the whole supply chain instead: app stores, payment rails, hosting providers, and the services that must now refuse VPN users to stay on the whitelist. Other governments are watching closely. The techniques in use in Russia in 2026 (whitelisting, DPI fingerprinting, pressure on app stores) are showing up in shutdown playbooks elsewhere.
Frequently Asked Questions
Are VPNs illegal in Russia?
Using a VPN is not itself illegal for individuals, but VPN providers must block state-banned sites, VPN advertising is banned, and searching for “extremist” content via a VPN can bring fines.
Why did VPNs stop working on September 22, 2026?
Analysts linked the outage to protocol-level and hosting-level filtering, similar to August incidents, timed just after the September 18–20 Duma elections.
Can any VPN work during a whitelist shutdown?
Generally no. A whitelist blocks every destination not on the approved list, so VPN servers can’t be reached on affected mobile networks regardless of protocol.
Know Your Tools Before You Need Them
CarrotVPN is a free WireGuard® VPN for Android with a kill switch and no account required. Set it up before you need it.
Download CarrotVPN Free