Russia's Internet Restrictions Expand: Roskomnadzor Tactics in Mid-2026

Russia's state internet regulator, Roskomnadzor, has continued escalating blocking measures through the first half of 2026, adding thousands of IP addresses and domains to its blacklist while employing deeper packet inspection techniques against circumvention tools. The expansion reflects a shift toward more granular technical controls rather than wholesale platform bans.

Roskomnadzor's legal authority derives from the 2012 Law on Information, Information Technologies and Information Security (often called the "blacklist law"), amended repeatedly to broaden blocking powers. The agency maintains a centralized registry of banned IP addresses and domains accessible to ISPs. As of June 2026, publicly available reports indicate the list contained over 25 million IP addresses, though the actual functional impact remains difficult to verify without comprehensive network measurement.

The blocking infrastructure relies on multiple complementary techniques. Primary among these is DNS filtering: ISPs intercept DNS queries for blacklisted domains and return null or redirection responses. This method is cheap to implement and transparent to Roskomnadzor's oversight, but trivial to circumvent using alternative resolvers. A second layer involves IP-level blacklisting at major internet exchange points, where packets destined for listed addresses are dropped. The third, more recent addition, is deep packet inspection (DPI) that examines TLS ClientHello packets for Server Name Indication (SNI) values matching banned domains, allowing blockade even when DNS is bypassed or when users specify IP addresses directly.

Throughout spring and early summer 2026, Roskomnadzor expanded its targeting of foreign platforms. According to accessible reports, additions to the blacklist included IP ranges associated with cloud hosting providers widely used by news outlets, encrypted messaging services, and circumvention-tool hosting. In May 2026, regional mobile operators reported implementing application-level throttling—degrading connection speeds specifically for encrypted traffic or traffic matching DPI signatures associated with VPN protocols. These throttling measures do not constitute complete blockade but render certain services unusable in practice by introducing packet loss and latency above 500ms.

Regional internet shutdowns occurred sporadically. In June, mobile internet access in Dagestan was reportedly restricted for several hours during a public demonstration, consistent with patterns documented by KeepItOn in prior years. Unlike wholesale shutdowns, these appear targeted and temporary, suggesting coordination between regional authorities and local ISPs rather than centralized Roskomnadzor directives.

Roskomnadzor has simultaneously escalated enforcement against circumvention-tool providers. In April 2026, the agency issued formal warnings to hosting providers and domain registrars regarding services offering VPN, proxy, and Tor exit node hosting. Several registrars responded by suspending domains associated with circumvention projects, though many simply migrated to registries outside Russian jurisdiction. The agency has not yet successfully obtained court orders compelling DNS registrars to revoke .ru domains for circumvention tools, but administrative pressure on Russian-based service providers has proven effective.

OONI network measurement data from Russia remains sparse due to technical and legal risks for researchers, but available probes suggest SNI-based blocking is now responsible for a larger proportion of observed blockades than DNS filtering alone. This shift indicates ISPs have moved beyond passive DNS filtering toward more sophisticated middlebox inspection, likely using commercial DPI appliances manufactured by Rostelecom subsidiary or imported devices configured by Roskomnadzor specifications.

Circumvention at this technical level requires careful protocol selection. Standard VPN protocols using TLS handshakes with unobfuscated SNI remain vulnerable to SNI inspection. OpenVPN in obfs4-wrapped mode provides obfuscation of the TLS handshake itself, rendering SNI inspection less effective, though at computational cost. REALITY (a variant of the Shadowsocks protocol framework) and Shadowsocks with Obfs4 similarly obfuscate initial traffic patterns, making DPI heuristics less reliable. More recent approaches like MASQUE (Multiplexed Application Substrate over QUIC Encryption) and WebTunnel-based Tor pluggable transports attempt to disguise circumvention traffic as legitimate HTTPS or WebRTC, though effectiveness depends on ISP DPI configuration sophistication.

WireGuard, despite its speed and efficiency advantages, transmits its protocol identifier in plaintext packet headers, making it straightforward to identify and block via DPI without inspecting encrypted payloads. Users relying on WireGuard should assume ISPs can detect its use, though blocking would require additional policy enforcement. OpenVPN with certificate-based authentication remains harder to distinguish from HTTPS traffic under basic DPI, provided ports and handshake patterns are configured to blend with benign encrypted traffic.

The landscape as of June 2026 reflects a mature blocking regime emphasizing technical depth over breadth. Complete internet shutdowns remain rare; instead, Russia's authorities have invested in selective blockade, application-level throttling, and legal pressure on infrastructure providers. Circumvention remains possible but increasingly requires technical sophistication and acceptance of the pseudonymous, not anonymous, protections these tools offer.