VPN Blocked? 12 Ways Networks Block VPNs and What Gets Past Each One

Why is my VPN blocked?

Your VPN is blocked because something between you and the server recognised the connection. That something can look at five different things, and the fix depends on which one it is. Most guides list the same six tricks (switch server, change port, try another protocol, use obfuscation, use a proxy, use Tor) without saying which block each trick actually beats. That is how people end up changing ports for an hour against a filter that never looked at ports.

Here is the definition this page works from. A VPN block is any rule that stops a VPN tunnel from forming or from carrying traffic, and most key on one of five things: the port, the handshake, the traffic pattern, the server’s address, or the address a website sees. The 12 methods below cover those five, plus three that sit outside them: allow-lists, shutdowns and app store removals. Each row names a documented case.

Two tables follow. The first sorts the 12 methods by what gets past them. The second takes the hardest case running right now, Russia in late September 2026, where the filters changed twice in a single month. After that comes what Le VPN changed on its own network in response. The dated record of the September outages themselves is in our report on Russia’s September 2026 VPN blocking wave; this page covers the mechanics and does not repeat it.

How do networks block VPNs, and what gets past each block?

Twelve rows, five kinds of answer. The fix most guides lead with, changing the port, beats exactly one row. Obfuscation beats five, the rows that judge what the traffic looks like. A different server address beats three, and all three look at where the traffic goes. The two never substitute for each other: a disguise does nothing against an address list, and a fresh address does nothing against a handshake signature. Two rows, allow-lists and shutdowns, beat every VPN ever built.

Row 4 is the one to remember when a provider says “undetectable”. When University of Michigan and Arizona State researchers ran their framework on a router carrying 20% of an ISP’s traffic, it caught 34 of 41 configurations that providers sold as obfuscated. Obfuscation is a design problem, not a checkbox, and our guide to VPN obfuscation explains the main approaches.

How do I bypass a VPN block on Wi-Fi, at school or at work?

Managed networks block VPNs in one of the first two ways in the table. Cheap setups open only the web ports (row 1). Business firewalls identify applications and can block every tunnel at once (row 2).

Against a port filter, a VPN on TCP 443 usually connects, because a port-only rule cannot tell it from a web page. Le VPN’s OpenVPN configurations run on TCP 443, TCP 80 and UDP 53. Against application control, obfuscation sometimes gets through, but that is the wrong question to start with. On a school or work network, the administrator decided that VPNs are not allowed there, and getting past the rule may break the terms you signed. Ask for an exception, or switch to mobile data for the private task.

Hotel and café Wi-Fi is different: the block is usually a side effect of a lazy configuration, not a policy. If WireGuard will not connect, the network is probably dropping UDP. Try a protocol over TCP 443.

Why do websites still detect my VPN, and can a VPN bypass an IP ban?

When the VPN connects and the website refuses you anyway, the website is doing the blocking (row 9). It sees the VPN server's address and looks it up. Commercial IP databases sell exactly this lookup. MaxMind's Anonymous IP database marks addresses it links to anonymous VPN providers, and marks data-centre addresses as belonging to a hosting provider, which catches the VPN servers it cannot name. A site that blocks both flags blocks most VPN servers without ever examining your traffic.

That is why obfuscation does not help with websites. Stealth WireGuard disguises the path between your device and the server; the website still sees the server’s address, the same one regular WireGuard uses. For an ordinary website, a server whose address the site has not flagged can help, and the result can change from week to week. Streaming services set their own rules: Netflix’s help page says a VPN can trigger its proxy error, and that VPNs are not supported for live events or ad-supported plans. A subscription to the service is always required.

An IP ban works the same way. A VPN changes the address a site sees, so a ban tied to your home address does not apply while you are connected. A ban on your account follows the account, though, and sites that refuse all hosting addresses refuse you whatever server you pick. Some sites also check signals a VPN does not change, such as the country of your account, payment card or phone number, so a VPN alone may not get past such a check.

How does Russia block VPNs in 2026?

Russia uses eight of the twelve rows at once: row 3 and rows 6 to 12. The filtering boxes, known as TSPU, sit inside Russian ISPs' networks and take their rules centrally from the regulator. Three findings shape everything else.

The first packets decide. Researchers at Paderborn University measured Russia’s filtering of QUIC traffic from three Russian cities in March and April 2026. Once a flow’s first packet triggers a block, the filter drops everything on the same pair of addresses and ports for 420 seconds, and each new packet restarts the timer. Only traffic leaving Russia is filtered. An app that keeps retrying on the same connection keeps its own block alive, which is why disconnecting and changing server works better than hammering the reconnect button. The paper measured QUIC. In our own captures of blocked WireGuard-based sessions, the first burst got through and every retry after it vanished; we have not yet timed how long that block lasts.

Addresses are scored. A VPN developer told Meduza in August that the regulator scores servers on about 50 criteria, blocks them above 25 points, and weighs traffic volume heavily. A busy server earns points faster.

On mobile, the list wins. In allow-list mode, a volunteer scan published in April counted 63,126 reachable addresses on one major operator. Even to those, UDP on ports 443, 53 and 51820 got no reply. Kommersant reported Vigo data showing that in July 2026 only 30.5% of mobile sessions in the Central Federal District ran without restrictions, and 12% in the Bryansk, Kursk and Belgorod border regions.

Of the four kinds of tunnel in the table, two still worked on a fixed line in late September, Stealth WireGuard with our current decoys and HTTPS-disguised proxies on clean addresses, the second only in degraded form. On mobile, our internal tests confirmed that Stealth WireGuard connects. Nothing works under the allow-list itself. The DNS row matters more than it looks. Both September waves began with apps that could not load their server lists, and an app that looks up its servers through a public resolver gets the national resolver’s answer instead.

None of this makes a connection invisible. The network still sees that you are connected to a server abroad. No Russian law punishes VPN use as such, though the rules keep moving, and our table of Russian VPN law tracks who each rule binds.

What did Le VPN change in September 2026?

Our apps already fetched their decoy packets from our servers when the September waves hit. During the waves we tested our current setup from inside Russia and confirmed internally that Stealth WireGuard connects and carries traffic over both mobile and fixed-line networks. The testing also showed what decides it: moving a server to a fresh port changed nothing, while the shape of the decoy packet did. This is what we run now.

1. Decoys we can change from our side. Stealth WireGuard now sends decoy packets ahead of the handshake, and their shape is a setting the apps fetch from our servers. When a network learns one shape, we change it on the server side, without waiting for an app store review.
2. No WireGuard shapes on the wire. Handshake messages carry extra random bytes and masked headers, so WireGuard's fixed 148-byte and 92-byte messages, which make plain WireGuard easy to recognise, never appear.
3. A second interface on every server. Since September 28 the new generation runs next to the first one on every server in the network, with the same keys. The newest apps connect to it with no new configuration, the rest move over in their next versions, and apps that stay on the first generation keep connecting. Switching everyone at once would have cut off everyone who had not updated.
4. Rotate what is flagged, keep what is clean. Every server address is now checked against public blocklists, Spamhaus, Barracuda, DroneBL and AbuseIPDB among them. An address that lands on a list the hosting company will not clear is replaced, and the location keeps its name. Several locations moved to new addresses in the last week of September alone, some because the old address was flagged, others because the old server was being retired. A clean address with a long history is worth keeping, so we do not rotate for the sake of it.
5. Moves customers never see. When a location moves to a new address, we update the server list the apps download and the location's DNS name, so customers have nothing to change. In the UK, the location names point at a pool of servers and the answer changes every minute. Every address in the pool is re-tested each hour, and one that fails drops out on its own.

Server-set decoys are in the iPhone, iPad and Apple TV apps from version 3.2.1 (September 24). The Mac app uses the new interface from 3.4.0 (September 28, direct download; the Mac App Store edition follows after Apple’s review), and the iPhone, iPad, Apple TV and Apple Vision Pro apps move to it in their next versions. If Stealth WireGuard fails where it used to work, update the app first, then try another server.

What this does not do: it does not beat the mobile allow-list or a shutdown, rows 10 and 11. Nothing does. The aim is narrower and honest. Wherever a network still lets traffic leave the country, a Le VPN server should be reachable from it, with servers in more than 100 locations to choose from.

What changes next?

• Russia's hosting rule. The "Antifraud 2.0" law, signed on June 26, 2026, bars Russian hosting providers from serving services that give access to blocked resources, VPN services included (Xakep, Pravo.ru), and a draft third package published on September 30 would ban violators from Russian hosting for a year. How the rule is enforced would change rows 7 and 8.
• Russia's mobile traffic fee. On September 23 the BBC reported, via Meduza, that the government was again discussing a charge for international traffic above 50 GB a month on 5G networks; an operator source said the start date and the price were still unknown, and an earlier version of the plan had put it at about 150 rubles per GB (Meduza). A VPN does not avoid a fee charged on all traffic leaving the country.
• A machine-learning filter. Roskomnadzor's digitalisation plan, reported in January 2026, sets aside 2.27 billion rubles for a machine-learning traffic filter that experts expect to be turned on VPNs (Xakep). There is no independent evidence of it in use yet; the June behaviour in row 6 needs no neural network.
• The decoys. A decoy that works on one operator today can be learned next month. We will change it from our side when that happens, and the next Vision Pro version brings the update to the headset.

To check where your traffic appears to come from once you are connected, use our IP address test.