Why VPNs in Russia now go down by whole hosting subnets

VPN users in Russia are going through another wave of outages, and the way the services fail has changed. Since August, blocks have hit not individual VPN servers but whole address ranges at the hosting companies where those servers run. On 14 October the Russian tech channel Techmedia, citing the Telegram channel Krovavaya Barynya, reported that several providers were seeing a sharp rise in restrictions: "Now they ban not individual IP addresses but entire subnets with hundreds of addresses. The number of blocks has grown many times over, market participants say." The channel named no services and gave no figures, and Roskomnadzor has not commented. Here is how this kind of blocking works and why it reaches far beyond VPNs.

From one address to hundreds

Every server on the internet has an IP address, and hosting companies hand those addresses out in blocks. The most common block, written as /24, holds 256 addresses. When a censor blocks a single VPN server's address, the operator can move the server to a neighbouring address at the same host and carry on. When the censor blocks the whole /24, one rule takes out hundreds of addresses at once, and moving within the range no longer helps.

The next step up is blocking by network. Large hosting companies announce their address space on the internet as an autonomous system, a numbered network with its own list of prefixes. In August Mikhail Klimarev of the Internet Protection Society told Euronews that the authorities, with the help of IT companies, had identified several dozen autonomous systems where VPN servers "cluster" and blocked all of their prefixes. That was the 4 August wave: the Telegram channel Exploit counted more than 20 affected services, and several, including VPN Legend, GaMMa VPN and LTVPN, reported problems.

The wave after the Duma elections

The current round began after the State Duma elections of 18 to 20 September. According to SecurityLab, one service dates its start to 21 September and another to 25 September, when the restrictions intensified. At least ten VPN services reported problems. One operator replaced eight servers in five days, and others said almost all their foreign locations had become unreachable. One service said OpenVPN connections from home routers had stopped working for many Russian users, where similar restrictions used to last a few hours.

There is no public data showing a single mechanism across all operators and regions, SecurityLab notes, and outages can also come from protocol detection or routing problems. What the services describe, though, fits range blocking: servers replaced again and again, and whole foreign locations going dark at once.

Who else gets cut off

A range block does not know what sits behind each address. The same subnet can host an online shop, a company's mail server or a CRM system, and all of them disappear for Russian users together with the VPN next door. Businesses have been complaining that their own tunnels fail: the remote server answers ping and SSH, but the encrypted VPN channel does not come up. In April Roskomnadzor said corporate VPNs used within Russian networks are not restricted, and that it had granted exceptions for tens of thousands of addresses and subnets used to reach foreign resources for work.

The government is also reshaping address space on its own side. On 31 August, according to RBC as reported by Kommersant and Vedomosti, the Ministry of Digital Development asked hosting companies, CDNs and DDoS-protection services to move the IP addresses of "whitelisted" sites into separate subnets. The whitelist covers services such as Yandex, Ozon and Gosuslugi that are meant to keep working even when mobile internet is shut down. Because sites often share addresses with other customers of the same CDN or protection service, VPNs could end up on the whitelist alongside them. The measure is backed by the FSB, Kommersant reports.

What changes for VPN operators and users

For a VPN operator, the cost of every blocked server goes up: switching an address no longer helps, and moving means changing hosting company or country. People who run their own server on a rented VPS face the same problem. If their host's range has been blocked, a new address from the same host is likely to be blocked too. For users, the result is what Russians have been describing since August: services that work one day and drop the next, frequent server switches and no clear end. The squeeze is also getting more money: Russia is doubling its budget for internet blocking and the fight against VPNs.