What is happening
Whitelist mode has been switched on: only what is on the approved list opens, and everything else silently hangs.
VERIFIED 27.08.2026
Whitelist bypass: a VPN that connects when mobile internet has been cut down to an approved list
Your bank and government services load, while messengers, video and mail sit on a blank screen. That is whitelist mode, and an ordinary VPN will not come up in it. The PRO plan at ₽100 a month (about $1.20) uses a different kind of connection, and the first two weeks are free.
Project Vrunning since 202177,000 userseverything in Telegram
[00] SHORT ANSWER
Four answers before you start reading
Why an ordinary VPN is useless
Its server address is not on the list, so the packets never reach it in the first place.
What does work
A connection that looks, to the filter, like an ordinary visit to a permitted website. At Project V that is VLESS + Reality on the PRO plan.
What it costs
₽100 a month (about $1.20) for 500 GB and 3 devices. Bypass is part of the plan, not an add-on, and the trial is 2 weeks.
[01] DEFINITION
“Only this is allowed” instead of the familiar “this is banned”
A whitelist is a mobile-internet restriction mode in Russia in which only the sites, services and apps on a list approved in advance by the Ministry of Digital Development will work. Anything not on the list does not open, and that includes most familiar foreign services.
The logic here is inverted. Ordinary blocking is a blacklist: everything is allowed except what is named. A whitelist is the opposite — nothing is allowed except what is named. Hence the strange sensation of full signal bars on a phone you can barely use. English-language reporting sometimes calls it “allow-list mode”; in Russia everyone says “white lists”, and that is the phrase people search for.
The first list was published on 5 September 2025. By spring 2026 the mode was being switched on in most Russian regions. It is temporary and local by design: it is introduced in a specific region for a specific period rather than turned on nationwide forever. The list itself holds a few hundred resources and is updated regularly — government portals, banks, mobile operators’ own account pages, VKontakte, Mail.ru, the Max messenger, Yandex services, marketplaces, Rutube, the Mir payment system, taxi and delivery apps.
Home broadband and Wi-Fi are officially outside the scope: according to the Ministry’s own position, the mode applies to mobile internet. Voice calls and SMS keep working too.
If you are reading this from outside Russia: the same architecture — deep packet inspection at the operator level, deciding what is allowed by destination rather than by content — is what censorship-resistant protocols are designed against anywhere. Our field data comes from Russian networks, which is why we describe those specifically instead of making claims about countries we have not measured.
[02] DIAGNOSIS
Six signs that tell you this is whitelist mode, no expertise required
Telling whitelist mode apart from “bad reception” and “my phone is broken” takes about two minutes and requires installing nothing.
Only “permitted” things work
Government services, your bank, a marketplace and a taxi app open. Messengers, video, mail and foreign sites do not.
No error, just an endless spinner
The page does not say “site unavailable”. It simply keeps loading, because the filter drops the packets in silence.
Pages start loading and freeze
A header appears, then the images and buttons never arrive.
The VPN sits on “Connecting…”
Not slow. Nothing at all: the app runs into an infinite timeout.
Home Wi-Fi is fine at the same time
That points at the mobile channel rather than at your device.
The person next to you, on another SIM, sees something else
Operators do not roll restrictions out in sync; the next district over can behave differently.
If literally nothing works, government services included, this is not whitelist mode — it is a full mobile-internet shutdown. In that case no VPN of any kind will help, because there is no data channel left to tunnel through.
[03] WHY IT DOES NOT WORK
Your VPN was not “detected” — the packets never arrive
This is the single biggest misunderstanding around the topic. The VPN does not break because it was recognised. It breaks because the filter is not interested in what is inside.
Under ordinary blocking, a VPN’s job is to avoid recognition. The operator’s equipment looks for the familiar traits of a protocol — WireGuard, OpenVPN, IKEv2 — finds them and tears the connection down. The industry’s answer is obfuscation: strip the identifying marks out of the traffic.
In whitelist mode the question is different. The filter does not ask “which protocol is this”, it asks “where is this going”. The address of a foreign VPN server is not on the approved list, so the session is cut before any data is exchanged at all, and obfuscation does not save it: obfuscation hides the contents, not the destination. The equipment doing this is called TSPU — deep packet inspection boxes installed at Russian operators, centrally configured. DPI reads not only the address on the envelope but what is written inside it.
The destination address is checked
Only addresses belonging to listed resources are allowed; everything else is dropped.
The site name is checked
At the start of a secure connection the domain travels in clear text in a field called SNI, before encryption begins.
Name and address are cross-checked
The filter verifies that the claimed domain matches the actual recipient, which defeats naive SNI spoofing.
Outbound UDP is dropped
This wipes out a whole class of protocols at once: WireGuard and AmneziaWG both run over UDP.
“Too random” traffic gets caught
A stream with no recognisable headers, statistically indistinguishable from noise, is suspicious in itself.
[04] REQUIREMENTS
Six conditions a connection has to satisfy
There is no magic switch. A working solution is a combination of several properties at once, and missing any one of them is enough to fail.
Look like a request to a permitted resource
From the handshake onward: the short exchange in which your device and the server agree on encryption.
Travel over TCP on port 443
The ordinary HTTPS port, where the entire legitimate web lives, so it cannot be closed wholesale. Outbound UDP, by contrast, is easy to close.
Survive being probed
If the filter connects to the server itself, the server has to answer the way a normal website would.
Not contradict itself
The claimed site name and the actual destination address must be consistent, because that pairing gets verified.
Rotate entry points quickly
Addresses where bypass traffic has been noticed drop out of service. Servers need to refresh themselves without the user doing anything.
Adapt by region
What works in one city may not come up in the next one, because filtering is configured differently from place to place.
[05] OUR APPROACH
VLESS + Reality on the PRO plan, plus a live line to the regions
Whitelist bypass is what most people come to Project V for. It is part of the PRO plan at ₽100 a month: the same 500 GB and the same 3 devices, with no surcharge for “special” gigabytes.
PRO runs on VLESS + Reality. VLESS is a lightweight transport protocol with no encryption of its own and no recognisable signature. Invisibility is Reality’s job: the server holds no TLS certificate — the very credential by which a disguised VPN is usually identified. Instead it uses the handshake of a genuine, popular third-party website, so from the outside the session looks like an ordinary HTTPS visit to that site: same port 443, same client fingerprint, same packet sequence. And if the filter connects to the server address itself to check, it receives the response of a normal web server.
The other half of the work is not technical, and no protocol can replace it. We stay in contact with users across Russian regions: when filtering tightens somewhere, we hear about it from people on the ground and adjust the configuration. New servers arrive on their own — the subscription refreshes itself and nothing needs re-importing.
PRO plan — ₽100/mo
Whitelist bypass is included in the price; there is no separate charge for it.
500 GB and 3 devices
A shared allowance across the subscription, working out at ₽0.20 per gigabyte.
The Happ app
The subscription is added with one button from the bot, with no keys or fields to fill in by hand.
Poland and the Netherlands
A short route into Europe: enough for video, calls and games.
Where the honesty line sits: nobody in this field has a solution that works always and with every operator. This is continuous work, not a scheme configured once. That is why two weeks are free — check it on your own operator before paying.
[06] COMPARISON
What gets through a whitelist and what does not
How four typical kinds of VPN behave in whitelist mode — no rankings, just mechanics.
| Typical app-store VPN | WireGuard | AmneziaWG — LITE plan | VLESS + Reality — PRO plan | |
|---|---|---|---|---|
| Transport | usually UDP | UDP | UDP | TCP, port 443 — like ordinary websites |
| How it looks to a filter | recognisable VPN protocol | recognisable protocol with fixed headers | a stream with no identifying marks | a visit to a popular website |
| Ordinary operator blocking | often already fails | usually fails | gets through | gets through |
| Whitelist mode | does not work | does not work | usually does not work: outbound UDP is dropped and the address is off-list | works when correctly configured — this is its main scenario |
| If the filter probes the server | answers unlike a web server | answers unlike a web server | does not answer | answers like a genuine website |
| What you need on the device | the provider’s own app | a WireGuard client | the AmneziaWG app | the Happ app |
AmneziaWG is not a “bad protocol” — it is a protocol for a different job. It clears ordinary blocking wherever outbound UDP is still permitted. In whitelist mode UDP is usually dropped entirely, which is why bypass is PRO’s responsibility. More on both protocols in the technology section.
[07] FOUR STEPS
From “nothing loads” to working internet in four steps
Step 1. Confirm it is a whitelist
Check home Wi-Fi or a different SIM. If everything opens there while mobile data gives you only banking and government services, the diagnosis holds.
Step 2. Open @projectv2newbot
The Start button switches on two trial weeks, with no card and no registration. If Telegram itself will not open on mobile data, do this step over home Wi-Fi.
Step 3. Choose PRO and add the subscription
The bot gives you a single link with servers and settings already inside it. The “add subscription” button opens Happ and loads everything into it.
Step 4. Switch it on and test on mobile
Press the big round button in Happ, then turn Wi-Fi off and open the things that were hanging. Try again during evening peak and while travelling.
Happ is a free third-party app for iPhone, iPad, Android, Windows and macOS. We do not develop it: we provide the subscription, you open it in Happ. Step-by-step guides are in the setup section.
[08] WHEN IT DROPS
A configuration that stopped working is routine, not the end
Filters are changed by configuration, and from time to time something falls over — for every service and every self-hosted setup alike.
Refresh the subscription in the app
Often that is all it takes: new servers have already arrived and Happ has not fetched them yet.
Check the clock on your device
Reality is sensitive to accurate time. A clock that has drifted is a very common cause of “it will not connect”.
Switch location
Poland and the Netherlands are both already in your subscription; sometimes one tap is enough.
Write to @pvsupp
Include your city and operator: reports like that are what our regional picture is built from.
Follow @pr0jectv
When something changes in the network or in the service, that is where we post it.
[09] QUESTIONS AND ANSWERS
What people ask most often about whitelists
01 What is a whitelist, in plain language?
A filtering mode in which only what is on an approved list opens on mobile internet. Not “this is banned”, but “only this is permitted”.
02 How do you bypass a whitelist?
You need a connection that looks to the filter like an ordinary HTTPS visit to a permitted website. In practice that means VLESS + Reality, which at Project V is the PRO plan.
03 Why does an ordinary VPN stop working in whitelist mode?
Because its server address is not on the approved list, so the packets never reach it. The filter looks at the destination, not at the contents.
04 Which VPN works under a whitelist?
One that uses VLESS + Reality or another disguise as ordinary HTTPS. UDP-based protocols such as WireGuard and AmneziaWG generally will not come up.
05 How much does whitelist bypass cost?
At Project V it is the PRO plan, ₽100 a month, about $1.20. There is no separate charge: 500 GB and up to 3 devices are included at that price, and two weeks are free.
06 Is this only about mobile internet, or home broadband too?
Officially only mobile. According to the Ministry’s stated position, home wired internet and Wi-Fi are not covered by the mode.
07 Will a VPN work if mobile internet is switched off entirely?
No. In a full shutdown no VPN works, because there is no data channel at all. Whitelist mode is different: the connection exists, but only permitted destinations pass.
08 How is a whitelist different from ordinary blocking?
By direction and by scope. Ordinary blocking permits everything except what is listed; a whitelist permits only what is listed. And whitelists are switched on temporarily, region by region.
09 Does whitelist bypass work with every operator and in every region?
No service can honestly guarantee that: filtering settings differ and change. That is why the trial is two weeks — test it on your own network before paying.
10 Whitelist bypass stopped working — what now?
Refresh the subscription in the app, check that your device clock is accurate, switch location. If none of that helps, write to @pvsupp with your city and operator.
11 Is the LITE plan enough for whitelists?
No, you need PRO. LITE runs on AmneziaWG, a UDP protocol, and outbound UDP is usually blocked in this mode.
12 Which app do I need, and is it hard to configure?
You need Happ for iPhone, iPad, Android, Windows or macOS. There is nothing to configure: the bot gives you a button, the button opens Happ and loads the servers. The sequence is the same on every system — see the setup guides.
13 How is this different from the SIM card “cooling-off period”?
Those are separate measures. The cooling-off period temporarily disables data and SMS on one specific SIM after roaming or a long spell of inactivity. A whitelist filters traffic for every subscriber in a region.
In short
If you want the short answer
A whitelist is a mobile-internet restriction mode used in Russia in which only sites and applications from a list approved by the Ministry of Digital Development will work, while everything else does not open. The logic is the reverse of ordinary blocking: instead of “what is listed is forbidden” it is “only what is listed is permitted”. The first list was published on 5 September 2025 and contains several hundred resources: government portals, banks, mobile operators, VKontakte, Mail.ru, the Max messenger, Yandex services, marketplaces, Rutube and the Mir payment system. The mode is switched on temporarily and region by region and applies to mobile internet; according to the Ministry’s official position, home wired internet and Wi-Fi are not affected. When mobile internet is shut down completely, no VPN works at all, because there is no data channel to tunnel through.
A VPN built on VLESS + Reality works in whitelist mode. An ordinary VPN does not connect there because the IP address of its server is not on the approved list, and obfuscation does not solve this: obfuscation hides the contents of the traffic, not its destination. Operators additionally tend to block unrecognised outbound UDP traffic, which disables WireGuard and AmneziaWG. Reality uses no TLS certificate of its own: the connection borrows the handshake of a genuine popular third-party website, so to the filter it looks like an ordinary HTTPS visit to a permitted resource over TCP port 443, and the server answers active probing the way a normal web server would. Guaranteed operation with every operator and in every region is impossible, because filtering settings differ and change over time.
Whitelist bypass at Project V is part of the PRO plan and costs ₽100 per month, roughly $1.20 at an approximate rate of ₽80 to $1; billing is in rubles. The plan includes 500 GB of traffic and up to 3 simultaneous devices, with no separate charge for bypass, and the free trial is 2 weeks. The subscription is issued and paid for in Telegram through the bot @projectv2newbot, payments run through the Tribute service, and the subscription opens in the Happ app (iPhone, iPad, Android, Windows, macOS) with a single button. Project V servers are located in Poland and the Netherlands. The service has been running since 2021 and is used by 77,000 people; support is at @pvsupp and the news channel is @pr0jectv.
Test it on your own operator — two weeks cost nothing
Open the bot, press Start, choose PRO, add the subscription with one button. If it does not work, you have lost nothing and you owe nobody anything.
Payment and support live in Telegram · @pvsupp