DPI, SNI, DNS, and IP blocking: 4 ways to break access
In Russia, access to a site can be restricted at four different levels: DNS, IP address, SNI in the TLS handshake, and DPI. These are different mechanisms, so some blocks can be bypassed by changing the DNS server, while others cannot.
All four methods are implemented by the telecom operator, mainly through TSPU (ТСПУ). They are used both separately and in combination: the same page can be subject to two blocks at once. Understanding exactly which layer is involved helps you quickly determine what happened.
Let’s go through what each type does, how it looks from the user’s side, and what characteristic symptom it produces in the browser.
In brief
- DNS blocking is the simplest layer: the operator does not return an IP address for the domain name.
- IP blocking means the operator drops packets to a specific address or subnet.
- SNI blocking means the operator terminates the TLS connection after seeing a banned domain name in the unencrypted ClientHello.
- DPI blocking is deep packet inspection that analyzes the content and behavior of traffic.
- The deeper the layer, the harder the bypass and the more resources are required on the filtering side.
- In practice, these methods are often combined: DNS + SNI or IP + DPI.
Four blocking layers: how they work
Each of these methods works at its own level of the network stack and has its own characteristic “fingerprint” for the user.
DNS blocking
The oldest and simplest method. The operator intercepts the user’s DNS query and either does not respond or returns a “stub” address. The browser shows an error such as “Could not find the server DNS address.” The bypass is switching to a third-party DNS resolver (DoH/DoT). Its weak point: it is easy to bypass and easy to identify, so it is rarely used on its own.
IP blocking
The operator blocks all traffic to a specific IP address or subnet. The symptom is that the connection hangs “nowhere” and ends with a timeout, without a DNS error. The problem with this kind of blocking is that all sites sharing the same IP are caught as collateral damage — a typical situation with large CDNs and cloud hosting providers.
SNI filtering
The TLS handshake starts with a ClientHello field, where the client sends the server name (SNI) in cleartext. TSPU reads this name and, if it is on the list, terminates the TCP connection. The symptom is that the connection immediately fails with an error such as ERR_CONNECTION_RESET, most often right after TCP is established. ECH and Encrypted ClientHello remove SNI from cleartext, but support is not yet universal.
DPI blocking
Deep packet inspection is the most “expensive” layer. TSPU analyzes the content and behavior of the flow: which ciphers are used, what packet lengths look like, and whether there are characteristic signatures of VPN protocols. The symptom is that the connection exists, but no data flows, or the connection is terminated 5–10 seconds after it is established. DPI is applied primarily to VPN traffic and circumvention tools.
How to tell which type of blocking it is
| Symptom | Type of blocking | What to check |
|---|---|---|
| The browser says “could not find DNS address” | DNS blocking | Change DNS to 1.1.1.1 / 8.8.8.8 / Quad9 |
| The connection hangs and fails with a timeout | IP blocking | Check ping and trace to the site’s IP |
| ERR_CONNECTION_RESET immediately after ClientHello | SNI filtering | Check whether the site supports ECH |
| The connection exists, but no data flows | DPI / behavioral filtering | Switch to an obfuscated protocol |
| Does not open on one operator, opens on another | Different TSPU configuration | Compare measurements by operator |
| The site opens through a proxy, but not through a VPN | Protocol signature blocking | Change the VPN protocol |
How to check right now
The easiest way to determine the type of blocking is empirically: change DNS — if it works, the issue was DNS filtering. If it does not work, check the route to the IP address. If the IP responds but the HTTPS connection is broken, that is already SNI. If the connection exists but no data flows, it is DPI.
To avoid doing this manually, you can use Freedom Checker: the service runs availability checks for sites and protocols from probes at different operators and in different regions, and shows exactly which operator triggered filtering. A detailed analysis of how TSPU works has been published on Habr.
Outage or blocking?
If a site does not open anywhere at all, with any operator and any DNS, and there are no errors such as “server not found,” it is worth checking whether the server itself is down. That is a failure on the site’s side, not blocking.
But if the site is consistently unavailable on one operator, consistently opens on another, and the symptom is always the same (RESET / timeout / DNS error), then filtering is at work. The type of blocking is determined specifically by the nature of the error.
What to pay attention to
- DNS blocking can be bypassed by changing the resolver; the others cannot.
- IP blocking often misses the target: innocent sites on the same CDN suffer.
- SNI filtering will stop working at scale when ECH is enabled everywhere.
- DPI is applied mainly to VPN traffic; ordinary sites are affected by it less often.
- Several layers can be applied at the same time — DNS + SNI or IP + DPI.
- “Does not open” is too general: always look at the specific error.
- Not all blocks are visible in the RKN (РКН) registry: TSPU can act without a public basis.
Conclusion
The four main types of blocking in Russia — DNS, IP, SNI, and DPI — work at different network layers. Each has its own characteristic symptom: a resolution error, a timeout, RESET, or a connection with no data. Understanding exactly which layer is involved helps avoid wasting time on useless bypass attempts.
The fastest way to diagnose the type of blocking is to compare measurements from different operators and check the nature of the error in the browser.