In 2026, many familiar VPNs stopped working in Russia: operators now filter not just server addresses but the protocols themselves. We break down how the filtering works, which protocols usually get through it, how a personal server differs from a shared one, and how to pay for a subscription with a Russian card or via SBP.
This article is not legal advice and does not promise that anything will work under every restriction. It describes what technically happens to traffic and which solutions tend to hold up better in practice.
How VPN traffic filtering works in Russia
Just a few years ago, blocking came down to lists of IP addresses and domains: a server ended up in the registry and the connection to it was cut off. Change the address, and everything worked again. Now the main tool is different: operator networks run technical measures for countering threats (TSPU) with deep packet inspection, DPI.
DPI looks not at the address but at the content and shape of the traffic. Every protocol has a characteristic handshake: the length of the first packets, the order of the exchange, fixed bytes in the headers. If packets look like WireGuard or OpenVPN, the connection is throttled to the point of being unusable or is simply reset. The server’s address can be brand new — that changes nothing.
The second layer is behavioral signals. The system can flag addresses that receive a suspiciously uniform encrypted stream and start restricting them after a while. That’s exactly why shared VPN servers with thousands of users get “burned” faster than personal ones.
Important: filtering on mobile networks is generally stricter than on home wired internet. The same protocol can work at home and fail to connect from a phone on LTE.
Why WireGuard and OpenVPN often fail to connect
WireGuard, OpenVPN and IKEv2 are good protocols for securing a channel, but they weren’t designed to be stealthy. Their developers were solving for encryption and speed, not for disguising traffic as something else.
WireGuard
The WireGuard handshake consists of fixed-length UDP packets with a known first byte. For DPI, that’s almost a signature. As a result, “plain” WireGuard in 2026 most often either fails to establish a connection at all or loses it within a few minutes.
OpenVPN
OpenVPN over UDP is recognized by its service headers, and over TCP by the structure of the TLS session, which doesn’t look like a browser’s. Extra obfuscation tools help, but they need to be supported on both the server and the client.
IKEv2 and other built-in protocols
IKEv2/IPsec uses the fixed ports 500 and 4500 and a well-known packet format. It’s convenient because it’s built into iOS and macOS, but on filtered networks it connects less reliably than the others.
Which protocols usually work in 2026
The general principle: traffic needs to look like an ordinary HTTPS connection to an ordinary website, or have no recognizable structure at all. Below are the protocols MeduzaVPN enables on every personal server, and what’s worth knowing about each of them.
| Protocol | How it’s disguised | When to choose it |
|---|---|---|
| MeduzaVPN ULTRA | A proprietary transport that’s indistinguishable from ordinary encrypted web traffic to DPI; parameters change between sessions. | The main choice on mobile networks and anywhere nothing else connects. |
| VLESS / Xray with REALITY | Mimics a TLS connection to a real, large website; the server responds as that website would if checked. | A resilient option for home Wi‑Fi and computers. |
| Shadowsocks | An encrypted stream with no headers, which DPI has a hard time classifying. | A lightweight protocol for older devices and routers. |
| MeduzaVPN | An obfuscated version of the classic tunnel: the handshake is hidden and noise is added to packets. | When you need high speed and the network filters only moderately. |
MeduzaVPN ULTRA
ULTRA was designed specifically for today’s filtering systems. It has no fixed signatures, and its stream’s packet lengths and timing resemble ordinary website browsing. The app picks the parameters automatically.
VLESS with REALITY
VLESS combined with Xray and REALITY uses a genuine browser TLS fingerprint and “hides behind” a real, existing website. If DPI decides to probe the server, it responds as that website would. This makes the protocol one of the most resilient available today.
Shadowsocks
Shadowsocks is older than REALITY, and on some networks operators have learned to restrict it based on traffic statistics. But it’s undemanding on resources and still useful as a fallback option.
The key point: you don’t need to guess in advance. On a personal MeduzaVPN server, all these protocols run at the same time, and switching between them takes a few seconds in the app.
Personal server or shared VPN
Mass-market VPN services put hundreds or thousands of users on a single server. Under blocking, that works against them: the address quickly gets restricted, and services like banks and streaming platforms see one IP with thousands of accounts and start triggering checks.
MeduzaVPN deploys a separate server with its own IP address in the chosen location for every customer. Nobody else uses that address, the channel’s speed isn’t shared, and the IP’s reputation depends only on you. For more on what that means, see the article on what a VPN server is.
- more than 60 locations: Amsterdam, Frankfurt, Helsinki, London, Paris, Warsaw, Stockholm, Zurich, Istanbul, Almaty, Dubai, Tokyo, Singapore, New York and others.
- All protocols on one server, switched right in the app.
- Split tunneling: some apps or websites bypass the VPN.
- A kill switch that blocks traffic if the tunnel drops.
- Access can be shared with family — one server, several devices.
For connections from Russia, the nearest European locations are usually the best choice — the Netherlands, Finland, Germany: latency is lower and speed is higher. A country overview is on the VPN for Russia page.
How to pay for a VPN from Russia
Paying through the App Store and Google Play from Russia is generally unavailable: the stores don’t accept Russian cards, and not everyone has a foreign card. That’s why MeduzaVPN accepts payment on its website, with the subscription linked to the same account you use to sign in to the app.
Available payment methods:
- SBP — payment by QR code or through a banking app;
- Russian bank cards, including Mir, and foreign cards;
- SberPay, T-Pay, Mir Pay, YooMoney;
- UnionPay, Apple Pay, Google Pay, Samsung Pay, PayPal;
- cryptocurrency.
Plans: 5.99 USD per month, 16.99 for three months, 31.99 for six months and 54.99 for a year. The amount is converted to rubles at the exchange rate at the time of payment — around 504 ₽ per month. A 15-day money-back guarantee applies. All plans and payment methods are listed on the pricing and subscriptions page.
Apps for every device
MeduzaVPN apps are available for iPhone and iPad, Android (through Google Play or as an APK from the website), macOS, Windows and Linux, as well as for Apple TV, Android TV and Fire TV. Ready-made configurations are available for routers running OpenWrt. One account works on all your devices with no limit on how many.
If Google Play is restricted in your region, install the APK from the website: it’s signed with the same key and updates itself. For a home network, it’s more convenient to set up the VPN on a router — that way every device is protected at once, including the TV and set-top box.
How to get started: 7 days without payment
- Install the app for your platform from the downloads page or from a store.
- Sign in with Apple, Google or email and password — the same account works on the website.
- Choose a location; the server is deployed within a few minutes.
- Connect. If there’s no connection, switch the protocol to ULTRA or VLESS.
- Test the connection on mobile data and on Wi‑Fi separately — filtering differs between them.
- If needed, turn on split tunneling for banking apps.
When you set up a subscription, nothing is charged for the first seven days — enough time to test it on all your networks. If something won’t connect, contact support: we’ll check exactly what your operator is filtering and help you pick a protocol. You can compare the terms on the personal VPN pricing page.
FAQ
Why did my VPN stop connecting in 2026 when it used to work?
Most likely, your operator started filtering the protocol itself rather than the server’s address. Deep packet inspection systems recognize the WireGuard, OpenVPN or IKEv2 handshake by its characteristic features and drop the connection. Switching to a protocol with disguise helps: MeduzaVPN ULTRA, VLESS with REALITY or Shadowsocks.
Which protocol most often works on Russian mobile networks?
Filtering on mobile networks is usually stricter than on home Wi-Fi. In our experience, MeduzaVPN ULTRA and VLESS with REALITY hold up best, because their traffic looks like ordinary HTTPS to a popular website. If one of them won’t connect, switch to the other in the app — the server stays the same.
Can I pay for MeduzaVPN with a Russian bank card?
Yes. The website accepts Russian cards, SBP, SberPay, T-Pay, Mir Pay and YooMoney, as well as foreign cards, PayPal and cryptocurrency. Payment on the website is linked to the same account you sign in with in the app.
What does “7 days without payment” mean?
When you set up a subscription, nothing is charged for the first seven days. You get your personal VPN right away, check the speed and connection on your own networks, and then decide whether to continue. If you cancel the subscription before that period ends, no charge is made.
How is a personal server better than a shared VPN under network restrictions?
A personal server has its own IP that isn’t “burned” by thousands of other people’s connections. Addresses like this end up on blocklists less often and trigger fewer CAPTCHAs and checks from banks and services. On top of that, the server’s speed isn’t shared with other users.
Does MeduzaVPN guarantee it will work under any network restrictions?
No, no service can guarantee that: filtering methods keep changing. MeduzaVPN provides several protocols on one server and updates them as new detection methods appear. In practice, switching the protocol in the app resolves most connection problems.
Do I need a separate account for each device?
No. One account works on iPhone, Android, macOS, Windows, Linux, Apple TV, Android TV and a router, with no limit on the number of devices. Signing in with Apple, Google or email and password is the same in the app and on the website.