They cut the internet.
Except the whitelist.
Since 2025, Russian regions shut down mobile internet for whole days — only sites on a government "whitelist" stay reachable. Most VPNs go silent. Here's why, and what to do about it.
A whitelist is a mode where the carrier allows only a small list of approved resources and blocks everything else. It kicks in during mobile-internet shutdowns: since spring 2025 such shutdowns hit dozens of regions, and the Ministry regularly publishes the list of services that "should work".
Technically the filtering runs on TSPU — carrier equipment in a drop-all mode: everything is cut by default, only pre-approved addresses and site names pass. The list usually covers government services, big banks, marketplaces and a couple of messengers. Anything not on it is unreachable.
- The filter works "deny by default": not "what to block" but "what to allow"
- Both the IP address and the site name at the start of the secure handshake (SNI) are checked
- The list changes and differs region to region — no stability
Its server isn't on the list — so it doesn't exist
An ordinary VPN connects to its own server abroad. But in whitelist mode that foreign address simply isn't among the allowed ones — and the connection is cut before it even begins. Switching protocols in the app or cycling servers doesn't help: the problem isn't encryption, it's that the server is unreachable at all.
That's why during shutdowns the chats fill with the same lines: "installed a VPN — won't connect", "only government sites load". That's not a broken VPN. That's a whitelist working as designed.
Not "one more server". A different approach.
Masquerades as ordinary HTTPS
Vexin traffic is indistinguishable from a normal visit to a major site. The filter has nothing to latch onto — it sees no "VPN".
Auto-switching
The client finds a live node and changes its masquerade when the filter tightens. No manual fiddling.
Built against the filters
Vexin was built against TSPU from the start, not assembled from a template. Where an ordinary VPN dies instantly, it keeps working.
Honestly: whitelist mode is the harshest thing TSPU does. There's no universal "magic button" here — for anyone. But Vexin is built for exactly this scenario and holds the connection where mass-market VPNs give up first. How TSPU actually kills VPNs →
In whitelist mode the carrier only passes approved addresses. An ordinary VPN server sits abroad and is not on the list, so the connection is blocked before it can start. It is the mode, not the app.
Only sites on the government whitelist: state services, big banks, some marketplaces and services. The list changes and varies by region.
Vexin is built for harsh TSPU filtering: it masquerades traffic as ordinary HTTPS and switches to live nodes by itself. It holds the connection where mass-market VPNs drop first. If it does not work for you — 7-day refund.
Vexin is a privacy and stable-connection service. We keep no browsing history, DNS or traffic content. How you use the service is your responsibility in your jurisdiction.