6 min read
TSPU — "technical means of countering threats" — is traffic-filtering equipment installed by law on the networks of Russian telecom operators. The key difference from ordinary blocking: these devices are controlled by Roskomnadzor directly, not by the provider. The operator is obliged to route traffic through them but does not decide what gets filtered — and often does not itself know why something stopped working for its subscribers.
The old scheme looked like this: an agency adds an address to a registry, the provider downloads the list and closes access on its own network. The provider could see what it was blocking and could answer a subscriber.
TSPU works differently:
| Registry and provider-side blocking | TSPU | |
|---|---|---|
| Who decides | the agency, the provider executes | Roskomnadzor, centrally |
| What the provider sees | a list of addresses | nothing: the device is closed to them |
| What it filters on | domain, IP | plus protocol signatures and connection behaviour |
| How fast it changes | on registry update | in real time |
| Who answers a subscriber complaint | the provider | nobody you can reach by phone |
Inside TSPU, deep packet inspection is at work. It analyses not only the destination address but how the connection itself looks: which protocol, which handshake, what rhythm of packets. How that analysis works: what DPI is and how a VPN gets around blocking.
This is the main practical effect, and it is rarely written about. Filtering by protocol signature fires not on a list of addresses but on a feature — and everything resembling that feature gets caught.
Typical symptoms on ordinary, entirely permitted resources:
That last point is the most recognisable sign. TSPU devices sit at network nodes, and settings on different nodes can differ. Hence the situation where "it doesn't work for me but my friend in the same city is fine" — you are simply going through different filtering points.
The system is being expanded. According to press reports, a modernisation programme was announced in 2026: upgrading previously installed equipment and installing new units at network nodes, with a plan to double capacity over four years and a budget of around 60 billion roubles (CNews, 25 March 2026; Kabelshchik). In parallel, another package of "sovereign internet" amendments took effect on 1 March 2026.
What this means for a user in practice: filtering becomes more precise and covers more nodes. Protocols that worked a year ago are being cut off one after another — and that is an observed picture, not a hypothesis.
As of 2026 the picture is this:
Reliably cut off: classic OpenVPN, PPTP, L2TP/IPsec, plain WireGuard, Trojan, Shadowsocks in base configuration. All of them have a recognisable pattern in their first packets, and that is what identifies the connection.
Still getting through: VLESS with Reality masking, AmneziaWG, Hysteria2 with obfuscation. The shared principle across all three is the same — not to look like a VPN. Reality performs the handshake with a real site, AmneziaWG alters WireGuard's packet structure, Hysteria2 pretends to be HTTP/3 traffic.
A detailed comparison: Hysteria2, TUIC and AmneziaWG; an analysis of Reality: Reality and VLESS in plain language.
A five-minute check:
From the user's side TSPU cannot be switched off or configured — it is equipment on the operator's network. The only thing you can influence is how your traffic looks.
What works:
What does not work: changing DNS, incognito mode, disabling IPv6 and other household advice. They help against address-based blocking, not against traffic analysis.
The service runs on VLESS with Reality: the handshake is performed with a real site, so the connection has no signature of its own that could be written into a filtering rule. When a particular location does end up restricted, you switch to another — there are over a hundred servers, and that is exactly what a lone server on a rented VPS does not have.
If nothing connects at all right now, start with the diagnostics in why a VPN does not work.
Is TSPU the same thing as DPI? Not quite. DPI is a traffic-analysis technology; TSPU is specific equipment installed on Russian operators' networks, inside which that technology is applied.
Can my provider switch TSPU off if I ask? No. The equipment is managed centrally, the provider has no access to it, and its installation is mandated by law.
Why does a site open for my neighbour and not for me? Most likely you are going through different network nodes with different filtering settings. Check on mobile data — if it works there, that is the reason.
Does changing DNS help against TSPU? No. Changing DNS gets around blocking by domain name, while traffic analysis looks at the connection itself and its signature.
Will all VPNs eventually be blocked? Protocols with a recognisable pattern are what get cut off. Masking protocols work for as long as their traffic is indistinguishable from ordinary web traffic — this is a race, not a one-off event.
BessyConnect is a VPN for Telegram: restore chats and calls when Telegram isn't working. The VLESS+Reality protocol bypasses blocks and DPI on all devices. More
BessyConnect is a VPN for WhatsApp that restores voice and video calls when they're blocked. The VLESS + Reality protocol beats DPI. Get it for iOS and Android. More
BessyConnect is a VPN for Discord: get into Discord when it's blocked and restore voice, streams and screen sharing on PC and mobile. VLESS+Reality beats DPI. More
