The Russian Censorship Circumvention, Tom's Traps, and Jerry's VPN: A 5-Year Journey#

Vitaly Repin

• Why: A rare first-hand, five-year longitudinal account of state-level DPI censorship versus a commercial VPN provider (150+ servers, millions of users) — and the speaker expects these techniques to spread to other states. Directly relevant to anyone thinking about protocol fingerprinting and traffic obfuscation defensively.
• What: The evolution of the "Great Russian Firewall": pre-2022 no VPN blocks → 2022–23 DNS/IP blocks → 2023 DPI blocking of standard VPN protocols (PPTP, L2TP, OpenVPN) → 2025 DPI detection of OpenVPN-with-XOR obfuscation within hours → 2025 white lists (only pre-approved IP/port traffic allowed). Non-technical pressure runs in parallel: app-store deplatforming, hosting bans, ad/payment cutoffs, and a 2024 law criminalizing VPN promotion.
• How: Detection mechanisms detailed: SNI-based blocking (with ECH declared illegal in Russia in Nov 2024), DNS/reputation-driven detection of VPN infrastructure (services like spur.us flagging IPs), and partial blocks (all ports except 443) that reveal the censor's confidence level. The speaker frames evasion as statistical hypothesis testing — the provider's goal is maximizing the censor's false-negative rate — and notes that user reports from "unimportant" regions are early-warning telemetry for new blocking capabilities being beta-tested.
• Where applicable: Censorship circumvention design, and more broadly any protocol that must resist adversarial traffic classification. The provider withheld current evasion methods, so this is a threat-model history, not a how-to.