After the detection event triggers on Beeline (AS16345), the connection is restricted to exactly one destination: the government-approved MAX messenger (max.ru), while all other Russian domestic whitelist domains (ok.ru, vk.ru, ya.ru, mail.ru) are also blocked. This response is enforced at the ISP/TSPU level and persists until the LTE router is restarted, indicating a stateful per-subscriber penalty state rather than simple packet-level blocking.

The detection event on Beeline (AS16345) exhibits a 5–15 minute delay between TUN activation and connection degradation onset, followed by a further delay before full blocking, consistent with a behavioral or statistical classifier rather than a signature-based real-time inspector. The graduated timeline (partial degradation → near-total block) suggests a threshold-based scoring system rather than an immediate signature match.

Issue body detection

On Beeline mobile internet (AS16345, Russia), enabling TUN mode with a VLESS+REALITY proxy consistently triggers ISP-level connection degradation after 5–15 minutes, while using the same proxy in HTTP/SOCKS5 proxy mode produces no such effect. The detection is reproducible across two independent GUI clients (v2rayN and Throne) with stock settings, suggesting the DPI trigger is the TUN traffic pattern rather than a client-specific artifact.

Issue body detection

The reporter notes the phenomenon began several months prior to the September 2026 report and has only one corroborating data point (a Telegram message describing similar Beeline behavior), suggesting the TSPU capability is narrowly deployed — possibly in a single region or in a trial phase — rather than nationally rolled out. The reporter explicitly flags uncertainty about whether this is a TSPU experiment or a misconfiguration in their VPN client.

Issue body evaluation

The TUN-mode detection occurs exclusively on Windows 10 and does not manifest on Android using the same VLESS+REALITY server and Beeline SIM, nor when running as a system proxy on Windows. The effect is also observed to impact all devices sharing the Windows hotspot simultaneously, ruling out endpoint-local causes and confirming the classification occurs upstream at the ISP/TSPU layer.

Issue body detection

In April 2026, Russia nearly completely blocked Telegram, reducing availability without VPN to 5% during the first ten days; Russia's VPN user base was estimated at no less than 40% of the population. Beginning in mid-April, over 20 major Russian websites and platforms (including Gosuslugi, Ozon, Yandex, Sberbank, VK) began restricting access for VPN users, and Russia introduced a whitelist-based service model permitting only state-approved services under certain network restriction states.

2026-anon-2026-27-vpn §4 (俄罗斯 Telegram / OSW section) ip-blockingdpithrottling

Article 19 documents that Iran's National Information Network (NIN / SHOMA) was designed with explicit reference to China's Great Firewall as a model, with institutional mirroring: Iran's Supreme Council of Cyberspace parallels China's Cyberspace Administration of China, and both governments share a "cyber sovereignty" doctrine used to justify domestic content controls and cross-border technology transfer. The report frames Iran's filtering infrastructure as deliberately architected to replicate GFW capabilities, not as an independently developed system.

2026-article19-tightening-the-net §2, §3 dpisni-blockingdns-poisoningip-blockingbgp-hijackthrottling

Article 19 documents that Iran combines technical filtering with formal coercion of major foreign platforms (including Telegram, Instagram, and WhatsApp) to comply with content removal orders under threat of full blocking. The report notes that Iran's 2022 Women Life Freedom protests accelerated platform blocking when foreign operators refused compliance, demonstrating that the censorship system operates in two modes: coerce-and-allow for compliant platforms, block for non-compliant ones. Domain fronting via these platforms is therefore subject to sudden revocation if political conditions change.

2026-article19-tightening-the-net §6 ip-blockingdns-poisoningthrottling

The April 2026 enforcement cycle created a resource-scarcity feedback loop: upstream providers cut lines with no obligation to refund resellers, newly acquired replacement resources can themselves be reported and cut within days, and stable-resource availability windows are described as "越来越短" (increasingly short) while costs rise concurrently. The overall effect is systemic capacity contraction forecast to continue through at least May 2026.

2026-ermao-april-airport-outage §这轮波动到底发生了什么 / §四月后的趋势判断 ip-blockingasn-blackholingthrottling

A proposed circumvention technique nests an outbound tunnel inside a legitimate 回国VPN (return-to-China service): the China-IP endpoint of the outer tunnel acts as a relay, with a VPS outside China pushing data back through it in reverse. The theoretical benefit is that 回国VPN services are officially permitted and reportedly not throttled by the GFW.

2026-hellosummer61-possible-exploit-vpn Issue body throttlingip-blocking

回国VPN services are legitimate commercial products designed to give Chinese diaspora enterprises access to Chinese-hosted services, creating tunnels inbound from the open internet to servers inside China. Their legitimacy and preferential GFW treatment are directionally specific — they are sanctioned for inbound-to-China use, not for outbound circumvention.

2026-hellosummer61-possible-exploit-vpn Original post (OP) and abstract throttlingip-blocking