12 min read
VPNs are classified by four criteria: by purpose (personal, corporate remote access, site-to-site, cloud ZTNA), by protocol (from the outdated PPTP to VLESS with Reality), by connection method (app, extension, router, your own server, a bot with a key) and by payment model. An ordinary person in Russia in 2026 needs a personal VPN in the form of an app, on a protocol that disguises traffic as ordinary HTTPS: OpenVPN, WireGuard and L2TP are blocked in Russia by protocol.
If you don't want to dig into settings and just want that option right away, we recommend BessyConnect: it runs on VLESS with Reality camouflage. What a VPN is in general and how it works, we explained in the article what a VPN is in simple words. Here we cover only the classification and the choice.
There is no single official classification, but any VPN can be described along four axes: purpose, protocol, connection method and payment. For example, BessyConnect is a personal VPN on VLESS + Reality in the form of an app, with a trial period.
| Type | What it's for | Pros | Cons | Example |
|---|---|---|---|---|
| Personal (consumer) | Protect traffic on public Wi-Fi, open a blocked site | Installs in minutes, servers in different countries | You trust the service with data about your connections | An app from the App Store or Google Play |
| Corporate remote access | An employee connects to the office network from home | Access to the company's internal systems | Opens only work systems, usually doesn't change the country for websites | The built-in Windows client, Cisco AnyConnect |
| Site-to-site | Join the networks of two offices | Works all the time, the user doesn't need to do anything | Configured by an administrator on routers | An IPsec tunnel between branches |
| Cloud (ZTNA) | Access to individual company apps without access to the whole network | Access is granted to a resource, not to the whole network | Requires a cloud platform and an access policy | Corporate "zero trust" platforms |
| Outdated protocol (PPTP, L2TP) | Compatibility with old equipment | Built into almost any system | PPTP is insecure, both are easily recognized by filters | Old office servers |
| Classic protocol (OpenVPN, WireGuard, IKEv2) | A fast and reliable tunnel where there's no filtering | Proven cryptography, high speed | OpenVPN and WireGuard have been blocked in Russia since 2023, IKEv2 doesn't disguise traffic | Corporate VPNs, your own servers |
| Protocol with camouflage (VLESS + Reality, Trojan, Shadowsocks, Hysteria2) | Stable operation under blocking | Traffic looks like ordinary HTTPS or HTTP/3 | Requires a compatible client, nobody can give guarantees | BessyConnect, Xray clients |
| Browser extension | Quickly change the address in one tab | No program installation needed | Protects only the browser, essentially a proxy | Extensions in the Chrome Web Store |
| VPN on a router | Protect all devices at home, including the TV | One setup for the whole network | Requires a compatible router and time to configure | Keenetic, OpenWrt |
| Your own server on a VPS | Full control over the server | Nobody but you runs the server | Administration and blocking become your problem | A rented VPS with Xray |
By purpose, VPNs are personal, corporate remote access, site-to-site and cloud-based on the zero trust model. If you're looking for a VPN for yourself, you need the first type. The other three are set up by your employer.
Personal VPN. You install an app, choose a country, and traffic goes through the service's server. Its job is to protect the connection and give access to resources that are unavailable from your network.
Corporate remote access. Microsoft's help article "VPN connection types" describes exactly this scenario: the client connects to a remote access server, which authenticates it and passes data between the client and the organization's private network. It opens the company's internal systems, not foreign websites.
Site-to-site. The tunnel is set up between the routers of two offices, and employees don't see the VPN at all.
Cloud ZTNA. The model is described in the NIST SP 800-207 standard "Zero Trust Architecture" (August 2020): a device or account isn't trusted just because it is inside the company network. Protection shifts from the network perimeter to users and specific resources.
Protocols fall into three generations: outdated (PPTP, L2TP), classic (OpenVPN, WireGuard, IKEv2/IPsec) and protocols with traffic camouflage (VLESS + Reality, Trojan, Shadowsocks, Hysteria2). For Russia in 2026, the third group remains the working option.
PPTP was described in RFC 2637 in July 1999. Apple removed it back in iOS 10 and macOS Sierra: PPTP connections were deleted from profiles during the update, and in its help documentation the company writes that it doesn't recommend it for secure communication. In October 2024, Microsoft declared PPTP and L2TP deprecated for future versions of Windows Server and recommended SSTP and IKEv2.
L2TP (RFC 2661, August 1999) on its own only builds a tunnel. Encryption is added by IPsec under RFC 3193 of November 2001, hence the L2TP/IPsec combination.
IKEv2/IPsec was standardized in RFC 7296 (October 2014) and works over UDP ports 500 and 4500. The MOBIKE extension (RFC 4555) keeps the tunnel from breaking when the address changes, for example when switching from Wi-Fi to a mobile network.
OpenVPN builds a tunnel on standard SSL/TLS and can accept clients over both TCP and UDP through a single port.
WireGuard sends packets over UDP and uses ChaCha20Poly1305 and Curve25519. The protocol author's paper for NDSS 2017 says the Linux implementation fits into fewer than 4,000 lines of code. The project's limitations page says it outright: WireGuard doesn't do traffic obfuscation, that has to be done at a layer above.
VLESS + Reality. The Xray documentation describes VLESS as a lightweight stateless transport protocol: the server checks the client's UUID every time. VLESS has no encryption of its own (the encryption field accepts only none); protection comes from an outer layer: TLS or Reality. Reality appeared in Xray-core 1.8.0 (March 9, 2023). According to the developers' description, it removes the server-side TLS fingerprint and lets you specify someone else's real website, so you don't need to buy your own domain.
Trojan performs a real TLS handshake and redirects requests without the correct password to an ordinary web server. An inspector just sees a website. Shadowsocks is called by its creators a secure proxy based on SOCKS5. Hysteria2 is built on a modified QUIC, disguises itself as HTTP/3 and is designed for lossy networks. AmneziaWG is a fork of WireGuard with junk packets before the handshake and randomized headers.
A detailed comparison of the speed and resilience of the three main protocols is in the article VLESS, OpenVPN or WireGuard: which protocol to choose, and we covered protocols with camouflage in the article Reality, Shadowsocks or Trojan.
The "VPN type" field in the system's built-in client offers only corporate protocols: IKEv2, L2TP/IPsec, SSTP and PPTP. None of them disguises traffic. This field is filled in with data from a company administrator, and a personal VPN needs a separate app.
What each system offers according to its official documentation:
| System | Built-in types | What's important to know |
|---|---|---|
| Windows | "Automatic", IKEv2, L2TP, PPTP, SSTP | "Automatic" tries protocols from the more secure to the less secure. SSTP carries data inside HTTPS |
| iPhone, iPad, Mac | IKEv2, L2TP over IPsec, Cisco IPsec | PPTP was removed in iOS 10 and macOS Sierra |
| Android | IKEv2/IPsec: with a pre-shared key, with an RSA certificate, with a username and password | The platform supports such profiles in the API from level 30 (Android 11) |
If you were given a server address, the IKEv2 type and a key, that is data for a corporate server, and that's what goes into the field. A personal VPN doesn't need the field: the app creates its own profile itself, through Network Extension on Apple or Microsoft's VPN plug-in platform, and the protocol there can be anything, including VLESS.
VPNs are delivered in five ways: an app, a browser extension, a router, your own server, or a key from a Telegram bot. The method determines which programs end up in the tunnel and who fixes it when it gets blocked.
By payment model, VPNs are free (the service earns from ads or limits speed and traffic), freemium with a trial period, subscription-based, corporate (the employer pays) and self-hosted, when you pay only for server rental. Free keys and cracked app builds carry obvious risks: an unknown server owner sees your connections, and a modified APK can contain anything.
You need a personal VPN in the form of an app, on a protocol that disguises itself as ordinary traffic, from a service that updates servers and protocols itself. Classic protocols in Russia are recognized by DPI equipment, as publications from 2023–2025 show.
What is known from publications:
Hence the honest conclusion. A protocol with camouflage is the best choice today, but no type of VPN gives guarantees. What matters is not only the protocol but also how quickly the service changes addresses and settings when the filters are updated.
Your own server makes sense only if you are ready to fix it yourself after every wave of blocking.
BessyConnect is a personal VPN in the form of an app on VLESS with Reality camouflage, which is exactly the type we recommend for Russia. To the network the connection looks like ordinary HTTPS, and protocols and servers are updated by the service's team, not by you.
Download the app:
The app isn't in the Russian App Store: installing it on an iPhone requires an Apple ID from another country. BessyConnect has no Windows app.
The honest limits. BessyConnect won't replace a corporate VPN and won't open your company's work network. It doesn't make you anonymous: websites still see your account and cookies. And it won't help when mobile internet is restricted by whitelists and no tunnel can reach foreign servers. Finally, as December 2025 showed, no protocol is protected from filter updates forever.
If you need a personal VPN on a protocol with camouflage, without manually setting up keys and servers, install BessyConnect from the download page and test it during the trial period.
Which type of VPN is the most secure? In terms of cryptography, the modern IKEv2/IPsec, OpenVPN, WireGuard and VLESS with Reality are reliable, while Apple doesn't recommend PPTP for secure communication and removed it back in iOS 10. For Russia something else matters more: whether the tunnel is noticeable to filters, and here protocols disguised as HTTPS are ahead.
How does a VPN type differ from a protocol? A protocol is the tunnel technology: WireGuard, IKEv2, VLESS. A type is a broader concept: the purpose (personal or corporate), the connection method (app, router, extension) and the payment model. One protocol can appear in different types.
Can you use PPTP in 2026? Only for compatibility with old equipment and not for anything important. Apple removed PPTP from iOS 10 and macOS Sierra, and in October 2024 Microsoft declared PPTP and L2TP deprecated for future versions of Windows Server.
Which type of VPN should I choose for my phone? A personal VPN app from an official store: it protects all of the phone's traffic, not just the browser. In Russia, choose a service on a protocol with camouflage, such as VLESS with Reality, rather than on bare WireGuard or OpenVPN.
What type of VPN is BessyConnect? A personal VPN in the form of an app on the VLESS protocol with Reality camouflage, more than 100 servers, no logs and no mandatory registration. There are apps for iPhone, iPad, Mac, Apple TV, Android and Android TV; there is no Windows version.
What a DNS leak is and how to run a dns leak test with your VPN on. Learn to check your VPN for leaks and fix them. BessyConnect — a private, leak-free VPN. More
WhatsApp alternatives for video calls in 2025: Zoom, Teams, Signal and FaceTime instead of WhatsApp & Telegram — and how to bypass blocks with BessyConnect. More
BessyConnect logs policy explained: what any VPN service technically sees, which of it we store and do not store, and five ways to check it for yourself. More
