What Is DPI Blocking of VPNs and How Does It Work
DPI blocking of VPNs is filtering at the packet-content level: the operator’s equipment looks not only at the address and port, but at the structure of the traffic itself and decides whether it looks like a VPN. If it does, the connection is cut, slowed down, or dropped by timeout.
In Russia, this filtering is widely performed by TSPU — technical means of countering threats, installed at telecom operators. This is what makes DPI different from older blocking methods: your IP address and the domain in SNI no longer matter — the system reacts to a recognizable “fingerprint” of the protocol.
That is why the answer to “why did my VPN stop working” is often: the server is alive, the route exists, but between you and it there is a TSPU that has learned to recognize this specific protocol. Below we explain how this works and which protocols pass this check, and which do not.
In short
- DPI means parsing packet contents, not just addresses and ports.
- TSPU looks for “fingerprints” of VPN protocols: the first handshake packet, lengths, timings.
- Plain WireGuard, OpenVPN UDP, and IPsec/L2TP are the easiest to detect.
- Disguised protocols (VLESS+REALITY, XTLS-Vision, Shadowsocks-2022) hold up better.
- DPI blocking looks like “the connection is up, but the internet is dead” or like a disconnect after a few seconds.
- The easiest way to check whether DPI is to blame is to switch the protocol while using the same server.
How TSPU recognizes VPNs: main techniques
The term DPI (Deep Packet Inspection) means “deep packet inspection.” A simple firewall looks at the address and port. DPI looks further — into the content and behavior of the flow. Several different layers matter for VPN blocking.
Handshake signatures
Most VPN protocols reveal themselves in the very first packet through a characteristic structure. For WireGuard, this is a short UDP packet of the fixed Initiation type. For OpenVPN, it is a header with the message type and session identifier. TSPU stores these templates and marks the connection as VPN before the first useful byte has even passed.
TLS and SNI analysis
If a VPN is disguised as HTTPS, DPI looks at the ClientHello: which ciphers are offered, the order of extensions, and which SNI is used (the domain name in the first packet). Based on a set of signals, it becomes clear that this is not a browser, but, for example, OpenVPN over TLS or an old VMess.
Behavioral analysis
Even when the encrypted content cannot be parsed, DPI evaluates behavior: packet lengths, pauses, and traffic symmetry. A constant stream of same-sized packets in both directions is a typical signature of a tunnel. Browsers do not behave that way.
How DPI differs from blocking by IP, SNI, and DNS
Blocking by IP is the crudest method: the operator simply blacklists addresses. Blocking by DNS means refusing to resolve a domain. Blocking by SNI means terminating the connection if a prohibited name appears in the open ClientHello. DPI is the next level: even if the IP is “clean,” the SNI is disguised, and DNS is substituted, filtering will still trigger if the traffic contains a recognizable VPN signature.
How to understand what exactly broke
| Symptom | Possible cause | What to check |
|---|---|---|
| The VPN connects, but after 5–10 seconds websites do not open | DPI recognized the handshake and is cutting the data | Switch to a disguised protocol (REALITY, AmneziaWG) |
| The connection hangs at “handshake / authenticating” | UDP is blocked or the signature is exposed immediately | Try a TCP variant of the protocol or a different port |
| Works on Wi-Fi, does not work on mobile data | The operator’s TSPU is cutting this specific protocol | Check blocking with a second operator |
| The same server used to work, but no longer does | Signatures were updated on TSPU | Change the protocol / port, check the service status |
| All websites are slow, but they open | Throttling, not a full block | Measure speed without the VPN and compare |
| The VPN client says “no connection to server” | The server is dead or the port is closed | Check IP and port availability from outside |
How to check right now
To separate “it is only me” from “it does not work in general,” you need measurements from different operators and regions. Freedom Checker does exactly this: it runs uniform checks of services and protocols from probes in several cities and on several operators, so you can see where access is available and where it is not.
If your protocol is unavailable at scale on one operator but works on another, DPI/TSPU has almost certainly intervened. If the protocol does not respond anywhere at all, the issue is more likely with the server or with the specific VPN service.
Failure or blocking?
A failure is when the server is down, a provider has made a routing mistake somewhere, or a specific VPN provider has an outage. Signs: the problem appeared suddenly, goes away on its own after an hour or two, and works for some users but not for others — without being tied to an operator.
DPI blocking behaves differently: the symptoms are stable, clearly tied to one or two operators, appear after a wave of new TSPU rules, and do not go away on their own. If reconnecting to another VPN server from the same provider does not help, but switching to a disguised protocol does, it is almost certainly traffic filtering.
What to pay attention to
- Open the client settings and check exactly which protocol is being used.
- Try an alternative: WireGuard → AmneziaWG / OpenVPN, VMess → VLESS+REALITY.
- Compare behavior on mobile internet and on home Wi-Fi from different providers.
- Check whether changing the port helps (443 / 8443 / non-standard).
- Do not confuse a connection setup timeout with a timeout after connection — these are different failure points.
- If one protocol is being cut across all operators, this is already signature-based blocking, not a regional failure.
- Do not trust “always working” VPNs from ads: tomorrow the signature may be added to the filter and the list will become outdated.
Conclusion
DPI is not a “list of bad websites,” but recognition of the fact of VPN traffic itself by its shape. That is why even a perfectly configured tunnel to a clean server may not work: TSPU catches the connection by signature. The more strongly a protocol is disguised as ordinary HTTPS, the longer it holds up.
If your VPN suddenly stopped working, do not rush to change services. First check exactly which protocol is being cut, and do it across several operators.