Okay, so I was told that we can go.
So I used this time to show this slide who am I, so that we don't spend time on this.
As yesterday I tested this presentation with my friend and the hotel.
And it became clear that I have too many slides.
So I want to focus rather on the second part, which is technical one,
then on the kind of introduction report.
But before going far there, I just want to understand the audience a little bit more.
Could those of you who used enterprise with PN corporate to PN depend to connect to your corporate network?
Could you raise your hands?
Okay, so almost everybody.
And how many of you could you also raise hands those who used actually commercial VPN?
The VPN service when you need to pay some money to okay.
So that was my understanding as well.
So also significant amount of people, but not as much.
Good.
So who is Jerry from this title?
Jerry's VPN provider with the properties described in the abstract of the presentation.
And Jerry is not my employer.
Actually, that's so important for me to mention this disclaimer.
So that during this talk, I do not represent my current employer.
So because otherwise, I say we will not get permission to have this presentation.
So and Jerry's provider, which I calculate by closely this engineering team.
And actually, I had this first credit experience to talk about.
But obviously I discussed with them what I can disclose on what I can't.
So all their identification information is prohibited.
So I cannot disclose the name, the employees, the customers.
And especially kind of limitation which I did like, but I have to agree is that I can't talk about the methods which they use today.
Because the infrastructure of the VPN still works and function in the Russian.
And it's still able to penetrate the Russian firewall.
So then that's basically what we already discussed in the first minute.
And here still I want to put a difference to describe a difference between enterprise VPN and personal or consumer commercial VPN.
So the second one is used by individuals for the reasons for different reasons.
But those reasons are very different than accessing the corporate network.
So in the enterprise VPN and personal VPN, quite different than the nation, even if the underlying protocols are the same.
So both can use IPSEC or OpenVPN, but the infrastructure around is different than the patterns of usage are different.
So why consumer VPN is really used?
So according to our experience, the most often it is used to bypass geo restrictions.
For example, you want to watch some hockey match or play some game, which is not available in your country of residence.
So then you need to have VPN and in this case VPN is used, not really for encryption purposes, but like the proxy is used.
Too high to your rail IP and to be able to get access to the service.
So but one of the interesting case is by passing sends a ship.
So accessing blocked websites and services with countries with internet sends a ship.
So like around China and obviously around Rafa.
There is also some slight deviation about VPN.
So again, just think about it when you have this presentation available.
You don't really always need VPN and especially when you're buying that personal VPN as consumer VPN, you already shift in the trust from your internet service provider to the VPN provider.
If it happens in Belgium or in Finland or in Sweden, then I would rather argue that I don't really want to shift the trust from a visa or waterfall to the small VPN provider register it in.
I know kind of my own islands or whatever.
And I would rather trust the list.
But it's always about 15 on trust.
But sometimes, so marketers of VPNs don't slide the statement, but it's actually really correct.
I personally like it.
That's the shift of trust and that's what this system recommends recommendations about.
So, but there are countries where you really need where really you can't trust local ISPs.
In particular, because you do want to get access to the resources which they block.
And in this case, commercial VPN is a tool to get access to this data.
Very important to say that it's not universal solution.
And it's not Samsung which works always.
In particular, I don't know how to pronounce it correctly.
It's a one millionth problem in North Korea.
So, this is an extreme case.
And in this case, the state internet is disconnected physically from internet.
There is no connectivity.
So, if you want to get a connection to the internet, you need to go to specific rooms.
This special place, this connectivity internet.
So, in this case, of course, no VPN can help.
But in China, in Russia, and even in Iran, it's not the case.
So, now, let us focus on censorship in Russia.
In 2020, six, how does it look from end user point of view?
So, it's pretty simple.
You can access the sites and services which you can access in Belgium.
Certain services are slowed down.
For example, in Telegram, you can't really talk via Telegram Messenger.
But you can still send messages.
And sometimes, of course, devices which use block services, IOT, they fail to work properly.
So, that's how it looks from end user point of view.
So, then, let us also look into the VPN business perspective.
The perspective of VPN provider.
What a reference state is doing to basically shut down the services.
They provide it.
It's developed for them.
So, they send in a remote request to different platforms.
For example, Apple store.
They block hosting.
So, if you are known Russian legal entity, you can actually buy VPS hosting services in Russia,
which gives you a lot of opportunities for VPN business.
The obvious one.
So, then, they also catch in in cab streams.
You can advertise in the Yandex ads.
And you can actually, the card processing through VPN providers is also good.
So, in, of course, marketing changes.
My favorite one was kind of creative.
So, they launched, I believe, it was one year ago.
A couple of years ago.
It was small propaganda campaign, small in terms of time window.
Because looks like it wasn't effective and it didn't work.
But it was propaganda campaign.
Like, if you do use VPN, then your money will be stolen.
So, basically, an idea was to form and public opinion that VPN adensures,
and should be used.
Obviously, they are blocked in VPN providers websites.
And they have also the ban on popularizing VPN services.
In the beginning of 2024, there was a exception for the talks.
Like, we are having now.
But in the end of 2024, this exception is removed.
So, if you don't want to break our hand low, please leave the room.
So, then, yeah.
I can also say that, from, yeah, that's an excellent engineering point of view.
I decided to coin this term.
I don't know, I have not heard that before.
But I believe that it deserves to be called great Russian firewall.
It's not anymore the toy, which it was before 2022.
It's now a serious filtering infrastructure,
which covers the whole direction.
And all customer traffic goes through this technical measures to combat threats.
Customer traffic means, if you're connected to a local ASP,
then it means that your traffic will go through this device.
And those boxes are installed in ASP promises,
but the provider personnel they do not have control over this boxes.
I can't roll it by the state, although it is.
Another thing, especially for those who can speak Russian,
I recommend to watch this YouTube that's a link.
A bit of brands for the brutal force.
I believe he means police.
Of course, they are basically probing the internet,
testing which services have the VPN in particular, which I piece.
So, in order to be able to block IPN.
So, let's, active probing that's also known from great firewall of China,
they use this technique as well.
It's important to say that there are different settings for different
internet service providers, different regions, and different types.
So, it's flexible, it dynamic.
Don't underestimate it.
Don't think that this is something he will easily pass by.
So, then, how it looks from VPN provider point of view.
So, here I just tried to depict the simplified architecture of what you do.
If you just decided to set up your own VPN node,
for example, your perfect house in Germany.
You have a partner in Germany, and you have your relatives in Russia,
where you run, and you want them to be able to access
your internet basically.
The real one.
So, what you will do, you will just install it.
You can know it probably is standard protocols.
Like IPC, open VPN, Warregard, whatever.
And you will have several clients from the home country.
There are other types of friends who will access this VPN node.
So, the blue arrow here is those connections,
which are controlled by the firewall.
The Russian firewall, in this example,
and which can be obviously blocked by it.
Important points, there are not too much traffic usually,
coming from those clients to VPN nodes,
because you just have several customers.
So, this is always simplified the architecture of
commercial VPN provider,
as you can see it's more complicated.
So, you have obviously authentication
authorization in the account,
AA, AA, you have accounts database.
You have a set of nodes,
to which the clients are connected to nodes
are probably located in different geographical regions,
so that the customers can utilize different exit nodes,
different exit IPs.
There are many customers connecting to them
from different countries with different regions,
if you are talking about Russia.
So, in the first example,
most probably your relatives are in one or two cities.
I'll like it in one or two cities.
Here the clients are among the distributed
and the whole area in the whole Russian.
So, they are from URL, TIL, Moscow.
And they are there.
So, you expect to have super nodes,
which actually will deliver to the clients
some part of information, which is required to connect.
So, that clients will not have hard-coded IP addresses
of those nodes,
but they will be, for example, distributed to the clients
by super nodes.
And all those blue arrows are still all those blue errors
are still subject to be blocked by the GRIF.
So, they have different attacks, vector attacks.
So, that's observation.
It's very proximate.
And this is based on one we can provide the experience.
So, don't take it to the kind of truth,
but that's what we observed.
So, before 2022, there are no depend blocks
that it was a paradise.
Again, maybe they were,
but we have not tested them.
2022 something happened.
The war started.
And Russian states decided that it's now
which is time to finally block
everything which they can block.
So, then they started from
blocked by DNS names,
blocked by IPs.
And in 2023, it was clear that
it started to be used to the packet inspection.
And after that,
PPP, L2TP, OpenVPN,
Standard OpenVPN,
they stopped to work.
So, in 2025,
only they finally managed to fix
the issue with X or application.
So, there is this OpenVPN,
a famous patch called X or application.
In additional region,
I have linked to the article about this.
And it actually worked for PPP a long time.
So, that the state was not able,
the Russian fireball was not able to block it.
So, then, in 2025, quite recently,
then you think a PIT,
so it was a white list,
a TIS white list.
So, it basically means that
the users I allowed to connect
only to specific IP addresses
usually belonging to the Russian clouds,
like my low cloud, the antics cloud.
And they just simply can't access anything else.
Not only CNN.com, but whatever.
So, usually this is activated
for a very limited time during some events.
Military events,
I mean, military attacks,
also visits of the Mr. Putin himself
to the cities,
so then, as activated kind of region.
Now, let us switch to some real stories
about this jury.
Okay, good.
So, the first, the strategy,
don't try to combat them.
Russian fireball directly.
The goal is to maximize false negatives.
So, Russian fireball should think that this is
a legitimate connection.
If it thinks that the connection
is illegitimate,
or if it thinks that it can't understand
that this connection will be blocked.
So, the two types of blocks,
full block,
and no traffic comes to the all the ports,
except for for free.
And in this case, you can still do something.
So, in basically, in the second case,
it looks like that Russian fireball
is not really sure that this is the prohibited service.
Because they also are very keen on it.
They are afraid of dropping down,
stretching down some important service.
So, they do want to have kind of
confidence that this is illegitimate service
from that point of view.
So, and now, several stories.
The first, you face, it was SNI by the blocker,
blocking.
So, you know till as hello,
SNI field,
and by analyzing the SNI field,
you can understand which service,
which is several.
We connected two,
and that's a very efficient way to block
to block
supernotes, for example.
By the way, TLSCH,
which is supposed to be the answer for this,
Russians also understand it,
and they just prohibits TLSCH,
and blocked.
That's my greetings to colleagues from Mozilla,
who talked about this age this morning.
So, GNS basic detection.
We had previously, each we can note,
had this domain names.
I can figure it out.
Several days can't.
Passes, and it disappears.
I mean, it blocks.
It is blocked.
So, it looks like that they actually
were doing the checks.
And of course, there were no reverses.
It was from the regular DNS.
It didn't help.
So, if you use DNS,
and if this DNS part of DNS name points to the VPN provider,
then they will find the way and they will look at it.
So, another one,
if you run any standard VPN protocol,
like OpenVPN, L2TP, something which can be,
classified as VPN,
detect as VPN,
then it will also poison your server,
and it will be marked as VPN server,
and it will be marked.
So, you really can use standard protocols
on the server which is supposed to work in Russia.
Then, it's sort of a application that was a long saga,
and it was an evolution.
So, in the beginning, it was enough to switch ports,
then it was enough to switch application,
mask.
But then, they started to work very efficiently.
So, several hours, and they detected,
and they stopped it.
They blocked.
So, but for the whole year, it was possible to
utilize Windows of opportunities.
Then, widely, it's described in general,
very challenging for gerend alike,
but it's still possible to go through.
So, how many of you to do ahead?
Okay.
So, then, regional and operator difference,
are very important.
If you have VPN provider,
and you start to get the blocked request from your support,
from your users in remote areas,
then be prepared to get the same from the capital's very soon.
So, that's recommendation for VPN providers,
which, ideally, if you don't cover here,
because I have less than one minute,
important thing, fly under the radar as much as possible.
Don't think that if you are detected,
they can't find you, then they will go after you.
The only way to fly under the radar,
is to find nice false positives.
And, that's kind of last.
The future is dark, slight.
So, I think that there are two scenarios for Russian internet
and fusion.
So, the one is most probable for, in my personal opinion,
so this is quite beyond internet.
So, that Russian internet will be totally disconnected
from internet.
And in this case, it will be end of the game,
for VPN providers and Russian.
For the reasons I described, in the case with North Korea.
And the slightly better scenario,
that it will be great China's far more.
And in this case, it will just be more sophisticated
more mature.
But this terminology or a game will continue
because if there is a connection,
then there is a way to benefit it.
So, that's it.
I hope I managed to keep the time.
Thank you.
Can you question this?
Where was it?
Test.
Hello.
Thanks for a very good presentation.
How in this scenario, how does V2ray or X-ray
VLS and reality protocols would work?
That's exactly the point
which I was not allowed to cover.
But you have straight to the point.
Okay, we're running out of time.
I'm sorry.