How to bypass website and service blocking without losing speed and anonymity

Website blocking has become a part of everyday reality for millions of users. LinkedIn has been blocked in Russia since 2016, Discord is periodically subject to restrictions, and access to foreign streaming platforms depends on the region. At the same time, most popular bypass methods either significantly reduce connection speed or jeopardize data privacy. In this article, we will explore specific technical solutions that allow access to blocked resources while maintaining high speed and anonymity.

Why standard methods of bypassing blocks stop working

Roskomnadzor and similar regulators in other countries are constantly improving traffic filtering methods. If in 2015 it was enough to change the DNS server, now providers use Deep Packet Inspection (DPI). It analyzes not only packet headers but also their content, allowing the identification and blocking of VPN traffic, Tor, and other protocols even when encrypted.

Standard OpenVPN on port 1194 is blocked within minutes after connection — DPI easily recognizes its signature. Free browser extensions like Hola or ZenMate sell user traffic to third parties. Public proxy servers are mostly already blacklisted or operate with delays of over 500 ms.

Methods of bypassing blocks: from simple to reliable

Changing the DNS server: a quick start for simple cases

Some blocks are implemented only at the DNS level — the provider returns an incorrect IP address for the blocked domain. In such cases, a simple DNS server change helps.

The most reliable options:

• Cloudflare 1.1.1.1 — fast, does not log requests, supports DNS over HTTPS (DoH)
• Google 8.8.8.8 / 8.8.4.4 — stable, but Google collects request statistics
• Quad9 9.9.9.9 — blocks malicious domains, does not store user IPs

Setup on Windows 11: Settings → Network & Internet → Wi-Fi (or Ethernet) → Change DNS settings → manually specify IPv4 address. To protect DNS requests from interception by the provider, DNS over HTTPS should be enabled in the browser or on the router.

Method limitation: works only against DNS blocks. If the provider blocks the IP address or uses DPI, changing DNS will not help. For example, to access LinkedIn in Russia, this method will only work partially.

VPN: the choice of protocol determines everything

Not all VPNs are equally resistant to blocks. The difference is fundamental:

WireGuard — a modern protocol with high speed (up to 90% of speed without VPN on Ookla Speedtest), but easily detected by DPI due to its characteristic handshake on UDP port 51820. In countries with aggressive traffic filtering (Russia, China, Iran), it works unstably without additional obfuscation.

OpenVPN with obfuscation — adding obfs4 or scramblesuit on top of OpenVPN masks the traffic as random data flow. The speed decreases by about 20–30%, but resistance to blocks is significantly higher.

AmneziaVPN — an open-source solution developed specifically for operation under Russian blocking conditions. It uses a modified WireGuard with randomized packet headers, making the traffic indistinguishable from regular HTTPS. The speed remains high — losses are less than 10% compared to a direct connection.

AmneziaVPN: setup on your own server

The key advantage of AmneziaVPN over commercial VPN services is the use of your own server. The IP addresses of commercial VPNs are constantly blocked, while a personal server with a unique IP remains unnoticed.

Minimum server requirements: VPS with 512 MB RAM, 1 CPU core, and an external IP address. Suitable hosting options include Hetzner (Germany, from €3.29/month), DigitalOcean (USA, from $4/month), Vultr (multiple locations, from $2.50/month).

The installation process takes about 10 minutes:

1. Download the AmneziaVPN application on your computer or smartphone from the official website amnezia.org
2. In the application, select "Connect to your server" and enter the SSH data of the VPS
3. The application will automatically install the server part and create a connection profile
4. Export the configuration for other devices via QR code

The default protocol is AmneziaWG (modified WireGuard). For maximum obfuscation, it is recommended to switch to the AWG protocol with settings Junk packets: 4, Junk packet min size: 40, Junk packet max size: 70 — these parameters simulate random network noise.

VLESS + XTLS-Reality: when maximum obfuscation is needed

The Reality protocol, part of the Xray-core project, represents a fundamentally different approach to obfuscation. Instead of simulating random traffic, it disguises the VPN connection as a request to a real HTTPS site — for example, to Microsoft or Cloudflare servers.

Technically, it works like this: the client connects to your server, but in the TLS handshake specifies the SNI (Server Name Indication) of a real domain — say, www.microsoft.com. DPI sees a legitimate TLS connection with a known domain and allows it through. The traffic is fully encrypted and goes to your server.

Configuration via the 3x-ui control panel (installed on VPS with the command):

bash<(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)

After installation, an incoming connection is created in the web interface with the VLESS protocol, security: Reality, uTLS: chrome, and the fingerprint of a real website. The final configuration is imported into the v2rayNG (Android), Streisand (iOS), or v2rayN (Windows) client.

Speed indicators: on a 100 Mbps channel, losses do not exceed 5%, latency adds about 2–5 ms compared to a direct connection.

How to avoid losing speed when bypassing blocks

Choosing server geography

The physical distance to the server directly affects latency. For users from Moscow, servers in Finland (Helsinki), Germany (Frankfurt), or the Netherlands (Amsterdam) are optimal — the ping will be 30–50 ms. Servers in the USA will result in a latency of 100–140 ms, which is critical for online games and video calls.

For streaming (Netflix, YouTube Premium), latency is less critical; bandwidth is more important. Servers in Europe can handle 4K streaming with a channel of 25 Mbps.

Split Tunneling

There is no point in routing all traffic through a VPN if only certain sites are blocked. Split tunneling allows you to route only the necessary connections through the VPN, without overloading the channel with unnecessary traffic.

In AmneziaVPN, this feature is configured in the "Traffic Splitting" section — you can specify specific applications or domains. For example, only Twitter, Instagram, and LinkedIn go through the VPN, while Netflix, online banking, and Russian services operate through a direct connection. The actual speed with this approach is practically not reduced for most tasks.

UDP vs TCP Protocol

WireGuard and its modifications operate over UDP, which provides lower latency compared to TCP protocols. However, some providers block or limit UDP. In this case, VLESS+Reality over TCP with XTLS will be the best choice — XTLS provides zero overhead for double encryption, as it uses native TLS instead of re-encryption.

Anonymity: what really protects and what does not

DNS leaks: a hidden threat

A common problem when using a VPN is that DNS requests go not through the encrypted tunnel but directly to the provider. You can check for leaks on the dnsleaktest.com website: if the results show your internet provider's DNS server instead of the VPN servers, there is a leak.

Solution: in the VPN client settings, enable the option "Use only VPN DNS servers" (Kill Switch by DNS). In AmneziaVPN, this is called "Only through the tunnel."

WebRTC leaks in the browser

The WebRTC technology used in video calls and browser games can reveal the real IP address even with an active VPN. The Chrome browser is particularly vulnerable to this.

Check: open browserleaks.com/webrtc with the VPN active. If the real IP is displayed — the leak is confirmed.

Fix: in Firefox, enter about:config in the address bar and set media.peerconnection.enabled to false. In Chrome — install the WebRTC Network Limiter extension from Google. In Brave, WebRTC protection is enabled by default.

Fingerprinting and browser metadata

The IP address is just one of the identification parameters. A browser fingerprint includes the browser version, installed fonts, screen resolution, time zone, interface languages, and a list of plugins. The combination of these parameters is unique for most users even without knowing the IP.

For tasks requiring complete anonymity, the Tor Browser is used — it standardizes all fingerprint parameters and routes traffic through three nodes. The price is a speed of 2–5 Mbps and latency of 200 ms. The Mullvad browser with fingerprinting protection enabled is a compromise option between speed and anonymity.

Router solutions: protecting all devices at once

Setting up a VPN or proxy on each device separately is a labor-intensive process. A router with custom firmware support allows you to handle all traffic processing at one level.

OpenWrt + AmneziaVPN

Routers with OpenWrt firmware support the installation of the AmneziaWG client. Compatible devices: GL.iNet Beryl AX (GL-MT3000), TP-Link Archer C7, Xiaomi AX3200. After installing the amneziawg-tools package and importing the configuration, all traffic from the home network automatically goes through the encrypted tunnel — including smart TVs, gaming consoles, and IoT devices that do not support VPN clients.

Keenetic with VPN integration

Keenetic routers have built-in support for WireGuard without the need for third-party firmware. The setup takes about 15 minutes through the web interface. The "Connection Policies" feature allows you to assign different tunnels to specific devices — for example, a work laptop goes through the VPN to access blocked resources, while a smart TV connects directly to receive Russian geo-content.

Comparison of methods: summary table

Practical scenarios and recommendations

For the average user

If you need access to LinkedIn, Instagram, or foreign news sites — start with AmneziaVPN on a rented VPS. The rental price for a server at Hetzner is 3.29 €/month, setup through the app takes 10–15 minutes and does not require technical knowledge. The speed will remain high, the IP address will be unique and not blacklisted.

For developers and technical specialists

VLESS + XTLS-Reality through the 3x-ui panel will provide maximum resistance to blocking with minimal speed loss. One server can be shared with colleagues via importing configuration links — the infrastructure supports 10–20 users without noticeable load on a VPS with 1 vCPU.

For those working with sensitive data

The combination of VLESS+Reality for everyday tasks and Tor Browser for critically important operations is the optimal balance. Tor Browser leaves no traces on the device and provides multi-layered anonymity, although at the cost of speed. For financial transactions and the transfer of confidential documents, this price is justified.

Legal aspect

Using VPNs and tools to bypass blocks for personal purposes is not criminally punishable in most countries. In Russia, the law restricting VPN services from 2017 targets VPN providers that have not connected to the registry of banned sites, not end users. However, the legal situation is changing — it is important to keep track of current changes in the legislation of your country and use the described tools solely for legal purposes.