How DPI spots VPN traffic
Every connection leaves characteristic traces: packet size, the rhythm of sending them, the handshake parameters when a secure channel is set up, header quirks. DPI systems gather these signs into a single profile and compare it against known patterns. For classic protocols — OpenVPN, IKEv2, WireGuard, L2TP — that profile is very recognizable. Even if the data inside is encrypted, the very fact that “this looks like a VPN” is visible to the filter.
The connection's “fingerprint”
Packet size, sending rhythm, and handshake parameters add up to a profile that DPI compares against known VPN patterns.
Analysis without decryption
The filter doesn't need to read your data — it's enough to see the shape of the connection, just as a postman only needs a glance at the envelope.
Blocking by type
If traffic is flagged as VPN, it's either slowed to the point of being unusable or torn down entirely — even with strong encryption.
The tricky part is that DPI doesn't need to decrypt your traffic to block it. Seeing the shape of the connection is enough. So the fight isn't over the strength of encryption (that's fine) — it's over making the connection not look like a VPN at all.
What whitelists are and why they change the rules of the game
For a long time, blocking in Russia worked on “blacklists”: a specific resource is banned — so it gets shut, everything else stays available. But during shutdowns and drills the opposite principle is increasingly used — whitelists. Under this model everything is closed by default, and access remains only for pre-approved services: government portals, banks, certain Russian platforms. Any connection that's not on the approved list simply doesn't get through.
For the user it looks like this: there seems to be internet, but only a narrow set of sites opens, while most familiar services, messaging apps, and foreign platforms become unavailable. A classic VPN is often useless in this mode — its connection isn't on the whitelist and is dropped at the setup stage. The whitelist scenario has become the main challenge of recent years.
OpsVPN solves this because its traffic is indistinguishable from a request to allowed major sites over HTTPS. To the filtering system it looks not like “connecting to a VPN” but like an ordinary visit to a legitimate resource — and a whitelist lets those connections through.
VLESS, Reality, and traffic disguising
At the core of OpsVPN is the modern VLESS stack with the Reality technology on top of the XRay core. Its principle is not to hide the fact of encryption, but to fully imitate the behavior of an ordinary HTTPS connection to a real, popular site. Reality uses genuine TLS certificates of major resources, so when analyzing the handshake DPI sees a legitimate request, not a suspicious VPN tunnel.
No “VPN handshake”
From the very first packet the connection looks like a request to a large site that's on every whitelist. There's no separate handshake here that could be detected.
The cost of blocking is too high
To shut out this traffic, the filter would have to block legitimate resources used by millions along with it. That's why the disguised connection gets through.
On top of that, OpsVPN leaves no recognizable packet rhythm and doesn't use fixed marker ports that VPNs were once spotted by. All of this together makes the connection resilient where ordinary services no longer work.
How OpsVPN differs from older protocols
The difference is fundamental: old protocols try to “punch through” the filter, while OpsVPN makes it so the filter simply has nothing to block — it doesn't see a VPN.
OpenVPN and IKEv2
RecognizableThey were the standard for years, but their characteristic fingerprint has long been in DPI databases and is blocked first.
WireGuard
Fast but noticeableWorks great where there's no heavy filtering, but in whitelist mode its connection is cut off too — it doesn't disguise itself as allowed traffic.
VLESS + Reality (OpsVPN)
InvisibleIt doesn't fight the filter head-on, but makes the connection indistinguishable from an ordinary visit to a site. That's why it works even under whitelists and active blocking.
Common questions about DPI bypass
A quick rundown of what people most often ask about how a VPN works under blocking and whitelists.
Need a VPN that works under any blocking?
OpsVPN stays connected where ordinary services have already given up — connect and see for yourself.