Which VPN Protocols Work in Russia in 2026

In short: WireGuard and OpenVPN in TCP mode on port 443 remain technically the most flexible under network filtering — they support configurable ports and modern encryption. IKEv2 is the most convenient option on mobile devices, built natively into iOS and Android. PPTP and L2TP without IPSec are outdated and easily detected by ISP DPI systems. The actual situation always depends on your carrier, region and server configuration. LiMP VPN supports WireGuard with optimised settings for stable connections.

The question of which VPN protocols work in Russia is often asked without specifying what "work" means. This article examines the technical properties of each protocol: how they are structured, why DPI systems analyse them differently, and what factors determine connection stability with each carrier. For a detailed breakdown of protocol types, see VPN Protocols: Types and Full Comparison. To see which protocols LiMP VPN supports, visit the features page.

Why the Protocol Determines VPN Connection Stability

A VPN protocol is a set of rules by which the client and server establish an encrypted tunnel: which transport layer (TCP or UDP) to use, on which ports, which encryption algorithm to apply and how to exchange keys. These technical parameters determine how ISP systems "see" your traffic and how closely it resembles normal HTTPS.

Two VPN connections to the same server can behave fundamentally differently depending on the protocol. A WireGuard connection over UDP 51820 has a characteristic packet signature that DPI can detect. An OpenVPN connection over TCP 443 looks externally like HTTPS — the ISP's DPI system must perform a deeper analysis to identify it. This does not mean "better" or "worse" — it means different behaviour under different types of network filtering.

VPN connection stability is determined by four factors simultaneously: the protocol choice, the transport layer (TCP/UDP), the port number, and the server configuration. There is no protocol that "works everywhere" — there are protocols with different stability characteristics under different conditions. No protocol is technically "invisible" to modern DPI systems; the difference lies in the complexity and cost of identification.

The VPN provider also plays a significant role: optimised server settings, port selection and connection configuration affect stability just as much as the protocol itself. A well-tuned WireGuard server will behave differently from WireGuard running on default settings.

How DPI Systems Analyse VPN Traffic

DPI (Deep Packet Inspection) is a network traffic analysis technology that Russian ISPs are required to implement as part of the TSPU (technical counter-threat measures) framework mandated by Roskomnadzor. The system analyses not only packet headers but also their content — to the extent that it is unencrypted at the moment of analysis.

For a detailed explanation of how DPI systems work, see What Is DPI (Deep Packet Inspection) and How VPN Is Blocked in Russia. Here we focus specifically on how DPI applies to each VPN protocol.

Signature Analysis

Every VPN protocol has characteristic patterns in its packet headers — "signatures". A DPI system compares incoming traffic headers against a database of known signatures and identifies the protocol type before even reading the encrypted content. This is the first and fastest layer of analysis.

• WireGuard has a characteristic initiation handshake with fixed packet structure. The first handshake packet is always 148 bytes, the response — 92 bytes. This fixed structure is unambiguously identified by DPI without needing to inspect encrypted content.
• OpenVPN in UDP mode has a characteristic TLS-over-UDP pattern with a distinguishable OpenVPN packet opcode byte. In TCP mode on port 443, the first packets are indistinguishable from ordinary TLS — deeper analysis is required to identify it.
• IKEv2/IPSec uses fixed ports UDP 500 and 4500 with characteristic ISAKMP packet exchanges. DPI easily identifies IKEv2 from the port and packet structure combination.
• L2TP/IPSec uses fixed port UDP 1701 with an identifiable L2TP header — relatively straightforward detection.
• PPTP uses TCP 1723 and IP protocol GRE (protocol number 47) — a unique combination unambiguously identified by any DPI system without additional analysis.

Behavioural Analysis

Even when the traffic signature is modified or does not match a known pattern, second- and third-generation DPI systems use behavioural analysis. They examine not the content of packets but their metadata: size, inter-packet timing, direction and the overall session pattern.

VPN traffic has several characteristic behavioural traits that distinguish it from normal web traffic:

• Constant symmetrical flow. A VPN tunnel generates a continuous bidirectional packet stream — unlike browser HTTP/2 traffic, which is predominantly downlink (downloading data from server).
• Specific packet size distribution. Encryption adds predictable overhead: packets grow by the fixed AEAD authentication tag size. This creates a characteristic distribution different from ordinary HTTP traffic.
• Long sessions without typical "pauses". Browser traffic has characteristic time gaps between user requests. A VPN tunnel maintains keepalive packets and generates traffic regardless of user activity.
• Upload/download ratio. Sending data through VPN has significantly higher upload than ordinary web browsing — due to tunnel header encapsulation and overhead.

UDP and TCP traffic behave differently under behavioural analysis. UDP does not guarantee packet delivery and operates without pre-establishing a connection — each packet is independent. TCP connections on port 443 merge with an enormous volume of legitimate HTTPS, making behavioural identification among the general stream significantly harder.

SNI Filtering

SNI (Server Name Indication) is a field in the TLS handshake that specifies which domain the client is connecting to. In standard HTTPS it is transmitted in plaintext before encryption is established. DPI systems read SNI to determine connection destinations and apply policies.

OpenVPN on TCP 443 resembles HTTPS externally but has one significant characteristic: the OpenVPN TLS handshake contains no SNI field — the connection goes directly to the server's IP address without specifying a domain name. For DPI this is a meaningful signal: the vast majority of legitimate HTTPS connections contain SNI, while a VPN server typically does not. This is not a guaranteed detection method but is one of several signals used in behavioural analysis.

ECH (Encrypted Client Hello) is a technology that encrypts the SNI field in TLS — a privacy tool for browser traffic. ECH operates at the browser level and is not directly related to VPN protocols: when VPN is active, the SNI inside the tunnel is already invisible to the ISP.

VPN Protocol Comparison: Properties and Characteristics

Below is a comparison of five major protocols by key technical parameters, based on official IETF specifications: WireGuard (RFC 9470), IKEv2 (RFC 7296) and the published OpenVPN specification.

Protocol	Transport	Default Port	Encryption	Code Size	Mobile Support
WireGuard	UDP	51820 (configurable)	ChaCha20-Poly1305	~4,000 lines	iOS, Android native
OpenVPN	TCP/UDP	1194 / 443	AES-256-GCM	~70,000 lines	third-party clients
IKEv2/IPSec	UDP	500, 4500	AES-256	built into OS	iOS/Android native
L2TP/IPSec	UDP	1701, 500	AES-128	built into OS	iOS/Android native
PPTP	TCP	1723	MPPE (outdated)	deprecated	deprecated

WireGuard

WireGuard is a modern protocol developed by Jason Donenfeld and merged into the Linux kernel (version 5.6, March 2020). Its primary advantage over competitors is a radically small codebase — approximately 4,000 lines versus 70,000 for OpenVPN. Less code means a smaller attack surface and simpler independent security audits.

For encryption, WireGuard uses ChaCha20-Poly1305 (symmetric encryption), Curve25519 for key exchange (elliptic curve cryptography) and BLAKE2s for hashing. These algorithms are optimised for ARM processors in mobile devices. On hardware without AES acceleration, ChaCha20 outperforms AES-256 in raw encryption speed — a practical advantage for smartphones. For technical details, see WireGuard Protocol: Architecture and Security.

WireGuard's default port is UDP 51820, but this can be changed to any UDP port at the server level — for example, UDP 443, which is associated with QUIC/HTTP3 traffic. One important technical limitation: WireGuard only operates over UDP. If a network blocks outgoing UDP traffic on non-standard ports (common in corporate networks and some public hotspots), WireGuard will not connect — unlike OpenVPN, it has no TCP fallback mode.

💡 Note: WireGuard supports port switching — moving from UDP 51820 to UDP 443 is possible in the server configuration. UDP 443 is associated with QUIC/HTTP3 traffic, making it less conspicuous. However, QUIC traffic is less common than TCP HTTPS, and some DPI systems analyse UDP 443 separately from TCP 443.

OpenVPN

OpenVPN is one of the oldest commercial VPN protocols (first release 2001, by James Yonan). Its main strengths are maturity, versatility and support for both transport protocols (TCP and UDP). The protocol has undergone multiple independent security audits (Cure53 in 2017, OSTIF in 2022). For a technical deep-dive, see What Is OpenVPN.

OpenVPN's key property from a network filtering perspective is TCP 443 mode. In this mode, traffic flows through port 443 over TCP — the same port used by all legitimate HTTPS traffic. The ISP's DPI system must perform deep analysis to distinguish OpenVPN from ordinary TLS: at the first level of signature analysis the pattern is indistinguishable from legitimate HTTPS. This makes OpenVPN TCP 443 one of the technically most stable options under strict network filtering.

Drawbacks of OpenVPN: higher overhead and lower throughput than WireGuard, due to the 70,000-line codebase and more complex architecture. In TCP mode, additional latency arises from the well-known "TCP over TCP" problem: a VPN tunnel over a TCP connection creates a double flow-control mechanism that degrades throughput under high packet loss or network instability.

OpenVPN requires third-party client applications on mobile (OpenVPN Connect, Tunnelblick) — there is no native OS support in iOS or Android. This is less convenient than IKEv2 but allows more flexible connection configuration.

IKEv2/IPSec

IKEv2 (Internet Key Exchange version 2, RFC 7296) combined with IPSec is an enterprise standard co-developed by Microsoft and Cisco. Its key advantage for mobile users is native support in iOS (since iOS 8) and Android — no third-party clients needed, just create a profile in the device's system settings.

The protocol supports MOBIKE (RFC 4555, Mobility and Multihoming Protocol for IKE) — a mechanism that automatically re-establishes the VPN connection when switching networks (Wi-Fi to LTE and back) without dropping active sessions. This makes IKEv2 particularly convenient for mobile users constantly changing access points.

From a network filtering perspective: IKEv2 uses UDP 500 (IKE key exchange phase) and UDP 4500 (data tunnelling with NAT-traversal via ESP). These ports are specific to IPSec/IKEv2 and well-known to DPI systems. Some corporate networks and public hotspots block UDP 500/4500 as a standard policy — IKEv2 will not work in such environments.

L2TP/IPSec and PPTP: Why These Protocols Are Outdated

L2TP (Layer 2 Tunneling Protocol) without IPSec has no encryption of its own and must not be used for data protection. Combined with IPSec it provides reliable cryptographic protection based on AES-128/256, but is architecturally heavier and slower than IKEv2. L2TP appears in corporate configurations as a legacy solution; new deployments should prefer IKEv2.

PPTP (Point-to-Point Tunneling Protocol) is the most outdated of the protocols reviewed here. Its MPPE encryption is based on RC4, officially declared cryptographically weak in 2013 (RFC 7465 prohibits RC4 in TLS). The MS-CHAPv2 authentication used by PPTP was broken in 2012; the chapcrack attack allows decryption of traffic in practical time. Microsoft deprecated PPTP for modern use in 2012. All modern VPN services have abandoned it.

⚠️ Important warning: A common misconception holds that "PPTP/L2TP work better because DPI ignores them." This is incorrect. DPI identifies PPTP and L2TP faster than any other protocol — fixed ports and characteristic signatures make them trivially detectable. If PPTP "works" in a specific context, this is due to the configuration of that particular network, not because the protocol is less visible. At the same time, PPTP provides significantly weaker data protection than any modern protocol.

Which Protocol Is Technically Stable Under Network Filtering?

An important caveat: "stable" means technically stable based on the protocol's inherent properties. The actual situation always depends on the carrier, region, time of day and server configuration. DPI systems update constantly, and no protocol provides a 100% guarantee of stable operation — this is an objective technical limitation.

The Role of the Transport Protocol: TCP vs UDP

The choice between TCP and UDP is one of the key factors in VPN stability analysis. The difference is fundamental both in technical characteristics and in network filtering behaviour.

TCP (Transmission Control Protocol) guarantees packet delivery: each packet is acknowledged by the receiver, and lost packets are retransmitted. Traffic on TCP port 443 merges with an enormous volume of legitimate HTTPS — on average 40–50% of web traffic passes through port 443. Blocking TCP 443 without completely destroying web access is technically impossible. OpenVPN TCP 443 exploits this property.

UDP (User Datagram Protocol) provides no delivery guarantees and establishes no prior connection — each packet is independent. This gives lower latency (critical for video calls, streaming and gaming) but makes UDP traffic more distinguishable and potentially filterable. A DPI system can block UDP on a specific port (e.g. 51820) without affecting web traffic — significantly cheaper in terms of resources than deep analysis of TCP 443.

Practical guidance for protocol selection:

• If stability matters more than speed — OpenVPN TCP 443 or WireGuard with UDP 443.
• If maximum speed is needed on a standard network — WireGuard UDP 51820 or IKEv2.
• In corporate networks with strict restrictions — IKEv2 (good NAT traversal) or OpenVPN TCP 443.

Encryption and Packet Size

AES-256-GCM and ChaCha20-Poly1305 are equally secure from a cryptographic standpoint — both are considered resistant to attacks for at least 30 years. The difference for users is purely in performance:

• ChaCha20-Poly1305 is faster on devices without hardware AES acceleration — most mobile ARM processors (Snapdragon, MediaTek, Exynos). On these devices WireGuard outperforms OpenVPN in raw encryption speed.
• AES-256-GCM is faster on devices with hardware AES-NI support — modern desktop Intel/AMD processors and Apple Silicon (M1/M2/M3/M4). OpenVPN or IKEv2 do not lose in encryption speed on such hardware.

From a traffic analysis perspective: encryption adds predictable overhead to each packet — the AEAD authentication tag plus tunnel headers. WireGuard adds approximately 32 bytes overhead per packet; OpenVPN adds more due to its complex header structure. This overhead creates a characteristic packet size distribution that DPI behavioural analysis uses as an additional signal — though not a conclusive identifier on its own.

Carrier Differences: MTS, Beeline, Rostelecom, Tele2

One of the most important and rarely discussed aspects: VPN connection stability depends not only on the protocol but on the specific carrier and region. The same VPN client with the same settings may work stably on one network and be unstable on another.

Rostelecom is Russia's largest ISP and simultaneously the state provider of TSPU (technical counter-threat measures) infrastructure. Rostelecom's network uses DPI systems with active UDP traffic inspection. Users report intermittent issues with WireGuard on default settings in various regions — particularly during evening peak hours when DPI systems are under higher load. IKEv2 and OpenVPN TCP 443 are generally more stable under these conditions.

MTS deploys equivalent TSPU infrastructure. Reports indicate instability with UDP 51820 (WireGuard) in certain regions, while IKEv2 and OpenVPN TCP 443 perform more stably under the same conditions. Recommendation for MTS users: when experiencing WireGuard issues, the first step is to switch to IKEv2 in the client settings.

Beeline has historically maintained less aggressive VPN traffic filtering at the protocol level. Users generally report fewer VPN connection issues compared to MTS and Rostelecom. However, the situation is changing: Beeline is gradually deploying TSPU infrastructure in compliance with regulatory requirements, and filtering policies may change at any time.

Tele2 operates on infrastructure similar to MTS (the carriers share technical solutions in several regions). The pattern of issues with UDP-based protocols mirrors the MTS experience.

Key practical conclusion: if a VPN connection is unstable with a specific carrier — the first step is not to switch services, but to try a different protocol or different port in the current client settings. LiMP VPN allows switching between WireGuard and IKEv2 directly in the app without reinstalling or losing configuration.

A second important factor is geography: within the same carrier, DPI filtering behaviour can vary between regions. Moscow and St Petersburg receive TSPU policy updates before other regions. The situation with a specific protocol in Novosibirsk and Moscow with the same carrier can differ significantly.

VPN in Corporate Networks: Special Protocol Requirements

The corporate use case for VPN is fundamentally different from personal use. A corporate VPN's purpose is to provide employees with secure remote access to company resources and protect transmitted data from interception on public and home networks.

IKEv2/IPSec is the de facto enterprise standard for several reasons:

• Built into macOS, iOS, Windows and Android — no additional software needed on employee devices, simplifying deployment and reducing support costs.
• Supported by Active Directory and enterprise IdP solutions (SAML, RADIUS, LDAP) — IT administrators can centrally manage access and enforce security policies.
• MOBIKE provides automatic reconnection on network change — employees maintain sessions when switching between Wi-Fi and mobile data.
• Standardised by IETF (RFC 7296) — no compatibility issues between equipment from different vendors (Cisco, Juniper, Palo Alto, Fortinet).
• Supports multi-factor authentication via X.509 certificates.

WireGuard is gaining traction in enterprise scenarios too: its configuration simplicity and high performance appeal to companies managing VPN infrastructure themselves. However, WireGuard management tooling (key rotation, IdP integration) is less mature than enterprise-grade IKEv2 solutions.

For office-to-office connectivity (site-to-site VPN), IPSec in tunnel mode is used — encrypting entire network routes rather than individual client connections. For details, see Site-to-Site VPN: What It Is and How It Works. For small and mid-sized businesses needing a managed VPN service without building their own server infrastructure, LiMP VPN for Business is available.

What Russian Law Says About VPN Protocols

The legal context matters for understanding what is actually regulated. The key conclusion: Russian legislation regulates VPN services as entities, not the underlying technical protocols or their use by private individuals.

Federal Law No. 149-FZ "On Information, Information Technologies and Information Protection" establishes obligations for VPN services and anonymisers — they must connect to Roskomnadzor's Federal State Information System (FGIS RKN) and restrict access to resources on the prohibited register. This requirement is addressed to service operators, not end users.

Roskomnadzor Order No. 126 sets technical requirements for equipment implementing TSPU — a regulatory document for ISPs required to connect TSPU infrastructure to their networks. Order No. 126's requirements do not apply to VPN users.

None of the current information technology regulations prohibit individuals from using VPN technology to protect personal data and privacy. The technical standards of the protocols themselves — WireGuard (RFC 9470), OpenVPN, IKEv2 (RFC 7296) — are open IETF specifications and are not subject to legislative restrictions.

For detailed legal analysis, see Is Using VPN in Russia Legal? and VPN Fines in Russia: What the Law Says.

How to Switch Protocol in LiMP VPN

LiMP VPN supports WireGuard and IKEv2, allowing you to choose the optimal protocol for your conditions. Switching takes a few seconds directly in the app — without reinstalling or losing your settings.

iOS:

1. Open the LiMP VPN app.
2. Go to Settings (gear icon in the lower right corner).
3. Tap "Protocol" and switch between WireGuard and IKEv2.
4. Reconnect — the new protocol activates automatically.

Android:

1. Open the LiMP VPN app.
2. Tap the settings icon on the main screen.
3. Select "Connection Protocol" and switch to the desired option.
4. The connection will re-establish with the new protocol.

Recommendation for unstable connections: start with WireGuard (optimal speed and simplicity), then switch to IKEv2 if it is unstable. If both protocols are unstable on a specific network, this may indicate UDP traffic restrictions. In that case, contact LiMP VPN support — specialists will help configure optimal settings for your carrier.

See all available features and supported protocols on the LiMP VPN features page. Compare plans on the pricing page.

Frequently Asked Questions

Which VPN protocols work in Russia in 2026?

WireGuard and OpenVPN (TCP mode on port 443) remain technically the most flexible — they support configurable ports and modern encryption. IKEv2 is convenient on mobile devices and built natively into iOS and Android. The specific situation depends on your carrier and region.

Which VPN protocol is not blocked?

No protocol provides a 100% guarantee — DPI systems update continuously. Technically, OpenVPN TCP on port 443 (harder to distinguish from regular HTTPS) and WireGuard on a non-standard port are the most stable. The outcome depends on your specific carrier.

How does WireGuard differ from OpenVPN?

WireGuard is a modern protocol (~4,000 lines of code, ChaCha20 encryption, UDP only) — faster and simpler to audit. OpenVPN is a mature protocol (~70,000 lines, AES-256, TCP and UDP), available since 2001, supports TCP mode on port 443 which provides additional stability under strict network filtering.

How does DPI detect VPN traffic?

DPI analyses packet headers (signature analysis), packet sizes and timing (behavioural analysis), and the SNI field in TLS handshakes. Each protocol has characteristic patterns — the ISP system compares traffic against a signature database and statistical models of normal traffic.

What should I do if VPN is unstable with MTS or Rostelecom?

Try switching the protocol in your VPN client settings (WireGuard → IKEv2 or vice versa). If available, change the port or use TCP mode instead of UDP. The issue may be region-specific — filtering behaviour can vary between regions with the same carrier.

Is using VPN in Russia legal?

Using VPN to protect personal data is not prohibited by Russian law for private individuals. Law 149-FZ regulates VPN service obligations (registration with the RKN registry), not user actions.

Does PPTP work in Russia?

PPTP technically connects, but it is strongly not recommended: MPPE encryption based on RC4 is outdated and insecure — the protocol is vulnerable to attacks that allow traffic decryption. All modern VPN services have abandoned PPTP.