**Белые списки больше НЕ РАБОТАЮТ: Написал свой VPN — Transcript & Summary | SozAI**
Source: https://sozai.app/transcript/white-lists-no-longer-work-vpn/

IT Jin explains how traditional whitelists fail against modern VPN obfuscation and explores the evolution of internet blocking and bypass methods.

## Key Takeaways

- Traditional whitelists and blocking methods are increasingly ineffective against modern obfuscation techniques.
- Obfuscation allows bypassing DPI filters by disguising traffic patterns rather than relying solely on VPN encryption.
- Internet censorship has evolved from simple site blocking to complex, multi-layered traffic analysis.
- Community-driven development of bypass tools continues to adapt to new censorship technologies.
- Understanding the history and technical details of blocking helps in creating more effective circumvention tools.

## What the video covers

- The video discusses the proliferation of VPN protocols and the motivation behind creating a new obfuscated VPN protocol.
- Current internet blocking methods are non-linear and involve complex, stepped filtering processes.
- Historical context is given on early internet blocks, such as those targeting Librusec and Rutracker, primarily for copyright enforcement.
- Early bypass methods included mirrors and rebranded sites before the introduction of DPI (Deep Packet Inspection) technology.
- The Yarovaya law introduced advanced traffic filtering devices (TSPU boxes) that analyze and block traffic more effectively.
- Blocking of Telegram in 2018 marked a turning point, increasing public awareness and development of more complex proxy and VPN protocols.
- Obfuscation techniques confuse DPI devices by fragmenting or encrypting packets to bypass filters without using traditional VPNs.
- The video explains that no VPN is strictly necessary to bypass modern blocks; instead, tricking DPI boxes suffices.
- The presenter uploads the video using a DPI bypass tool called 'Zapret,' demonstrating practical application of these methods.
- The video hints at future developments in more sophisticated blocking and bypass technologies.

Answers

## Questions about this video

Why did IT Jin create his own VPN protocol?

IT Jin created his own obfuscated VPN protocol to bypass modern internet blocks and whitelists on various devices, providing truly free internet access.

What is Deep Packet Inspection and how does it affect internet access?

Deep Packet Inspection (DPI) is a technology used by providers to analyze and filter internet traffic based on content, enabling blocking of certain sites or services.

Are traditional VPNs still effective against modern internet censorship?

Traditional VPNs are less effective now because modern DPI devices and obfuscation techniques require more sophisticated methods to bypass blocks.

## Full Transcript — Download SRT & Markdown

00:00

Speaker A

There are already a hell of a lot of these protocols, VPNs, and basically everything under the sun as it is. Why are you sticking yours in there? What the hell is it even for? Well, unexpectedly for myself, I wrote my own obfuscated protocol. It doesn’t just let you bypass certain blocks and access specific resources or websites; it automatically bypasses whitelists on phones, routers, computers—basically, on all the devices where you actually need a truly free internet. I’ll also explain a bit more about how current blocking methods work. It’s not really a linear process at all; it’s more of a stepped one. So let’s go in order, diving into the annals of blocks and whitelists. In principle, any blocking of internet resources is a non-linear process. It started, I don't know—at least from what I saw, and maybe I'm not the oldest, but also not the youngest among those who saw some of the first blocks—like Librusec, or Rutracker, which was torrents.ru back then, I still remember that, yeah, it was called something else. Well, in general, they were blocking various sites and services even back then, and every time it was supposedly to protect intellectual property. Like, someone uploaded music somewhere, even though it was already on VK. And that was fine. You could watch porn all you wanted. Yeah, but books on Librusec? No way. That’s intellectual property, sorry, you can’t read that. Even though you could share them on other networks, that was one of the biggest ones, it turns out. Libraries on torrents—I think torrents.ru was blocked for the first time because of some movie or a few movies that were uploaded. Yeah, copyright holders complained, and that was it; instead of reaching an agreement and making some payments, you know, getting money to the rights holder, which is how it should have been done properly back then. They just said, let’s shut the whole damn thing down so people have no access at all. Well, that’s just wonderful. And everyone will be happy. Everyone will immediately go out and buy it. Yeah, there were basically no streaming services back then, so I don't know, maybe people bought things on discs. And those who remember that time well also remember that that was when the first ways to bypass these blocks appeared, through various mirrors. They’d just take the same single site. Take that same Torrents, for example. It just rebranded as Rutracker and basically continued working in the exact same way. Then mirrors started appearing, which were just the same sites relayed through other servers. And that was it. Back then, of course, there were none of these DPI devices, or TSPUs, those black FSB boxes that are now at every provider. So, before the Yarovaya law, as far as I know and remember, there was basically no centralized or decentralized traffic analysis. There were, of course, no neural networks or anything like that, nor was there the computing power currently available for analyzing or processing that traffic. VPNs, much like in the civilized world today, were used, among other things, to simply access one's remote workplace. Say you have an internal network or an office LAN, and you connect to it from home via an encrypted VPN channel. That's it, you connect to your computer and work peacefully. Or you take files from a work server on the LAN, work on them, and upload them back. It was a very common practice indeed. And so we enter the next era, after the Yarovaya law, once those TSPU boxes were installed and they started filtering traffic more or less effectively. And one of the most high-profile events was probably the blocking of Telegram in 2018. Actually, after that, more people started talking about various proxies, protocols, including VPN protocols, and how networks are structured in general. People suddenly started learning about it from everywhere; it was being shouted from every rooftop. Everyone, much like during the pandemic, had their own version of events. Everyone became a network engineer or some sort of specialist in the field. And of course, thanks to this, more complex protocols began to emerge, including various proxying schemes on how to access a given resource via some server. Take Rutracker, for example; it isn't blocked abroad. You can easily access it there. At the same time, it is blocked in Russia. Well, many people figured this out and started routing traffic in various ways just like that. That was also when the MTProto protocol appeared, which is unique to Telegram, developed specifically for it, and still works only within it. And getting closer to more modern things that surround us now, like, I don't know, YouTube, Instagram, and various other social networks, including LinkedIn, by the way, a business-type network. They didn't like that one for some reason either. Oh well. In general, when mass blocking began, more rigid responses appeared in the form of bypass tools like GoodbyeDPI. The very first "Zapret" was created based on these developments to bypass these TSPU boxes, which are called Deep Packet Inspection, I believe, right? DPI, Deep Packet Inspection. In short, it's just a box through which all of a provider's traffic passes. And, accordingly, it can be filtered in a certain way. Filters are built in there so you don't just take all this traffic, all these zeros and ones, and save it somewhere, because you just wouldn't have enough power. You need to understand what is important and what is not. Accordingly, these packet chains are analyzed, and if they are of any interest according to the filters, they go where they need to go, in short. But since these boxes are still electronic devices that can somehow be overloaded, deceived, or confused, you can provide one packet instead of another. Or you could have one packet encapsulated under another. So, the box itself won't understand that your packet is actually important, even though it is. And you can do this, essentially, with various kinds of encryption. That is what is now called obfuscation. Different ways to confuse these boxes so they don't understand where you are trying to go at all. Suppose you are trying to go to Instagram, but you actually just send it three pieces: inst, ag, com. There you go, you just throw these three pieces at it, and it doesn't understand where you're going. Maybe you're going to some "institute.ru," right, and not to Instagram, and so on. Then it all gets stitched back together to reach the final destination; I'm simplifying quite a bit. This is essentially what I talked about in the very first video, wearing a stretched-out black t-shirt here, back when no one understood anything. And, actually, that was more of a theoretical part. In short, the simplest thing you need to understand is that these are just electronic boxes that can be deceived. Wonderful. That is, in fact, what is happening right now. And no VPN, once again, is needed here. We haven't reached that point yet. I mean, you're still getting access to the resources you need by tricking or bypassing these boxes. Accordingly, yes, it still has an effect, well, not a very strong one, actually, because internet capacity and speeds have already grown enough that you can, I don't know, connect a whole bunch of devices to some router. You have a 100 Mbps plan, and at the same time, you can watch YouTube in 4K on several devices quite easily, without any effort, like even now, using this DPI bypass, you're welcome to. I'm uploading this very video not via VPN either; I'm uploading it precisely through the second Zapret, as it turns out. Well, that's kind of the core of the second Zapret; their logic is the same. This is already a whole chain of tools. And in general, developers exchange ideas and approaches with each other, and that's why we get similar products, just implemented however they see fit. And now we're getting to more interesting things, more complex blocks, when it's not just that something is blocked in Russia, but blocked.

00:12

Speaker A

obfuscated protocol. It doesn’t just let you bypass certain blocks and access specific resources or websites; it automatically bypasses whitelists on phones, routers, computers—basically, on all the devices where you actually need a truly free internet. I’ll also explain a bit more about how current

00:33

Speaker A

blocking methods work. It’s not really a linear process at all; it’s more of a stepped one. So let’s go in order, diving into the annals of blocks and whitelists. In principle, any blocking of internet resources is a non-linear process. It started, I don't

00:53

Speaker A

know—at least from what I saw, and maybe I'm not the oldest, but also not the youngest among those who saw some of the first blocks—like Librusec, or Rutracker, which was torrents.ru back then, I still remember that, yeah, it

01:10

Speaker A

was called something else. Well, in general, they were blocking various sites and services even back then, and every time it was supposedly to protect intellectual property. Like, someone uploaded music somewhere, even though it was already on VK. And that was fine

01:29

Speaker A

, you could watch porn all you wanted. Yeah, but books on Librusec? No way.

01:34

Speaker A

That’s intellectual property, sorry, you can’t read that. Even though you could share them on other networks, that was one of the biggest ones, it turns out. Libraries on torrents—I think torrents.ru was blocked for the first time because of some movie or a

01:51

Speaker A

few movies that were uploaded. Yeah, copyright holders complained, and that was it; instead of reaching an agreement and making some payments, you know, getting money to the rights holder, which is how it should have been done properly back then. They just

02:07

Speaker A

said, let’s shut the whole damn thing down so people have no access at all.

02:10

Speaker A

Well, that’s just wonderful. And everyone will be happy. Everyone will immediately go out and buy it. Yeah, there were basically no streaming services back then, so I don't know, maybe people bought things on discs.

02:22

Speaker A

And those who remember that time well also remember that that was when the first ways to bypass these blocks appeared, through various mirrors.

02:29

Speaker A

They’d just take the same single site . Take that same Torrents, for example. It just rebranded as Rutracker and basically continued working in the exact same way. Then mirrors started appearing, which were just the same sites relayed through other servers.

02:47

Speaker A

And that was it. Back then, of course, there were none of these DPI devices, or TSPUs, those black FSB boxes that are now at every provider. So, before the Yarovaya law, as far as I know and remember, there was basically no

03:04

Speaker A

centralized or decentralized traffic analysis. There were, of course, no neural networks or anything like that, nor was there the computing power currently available for analyzing or processing that traffic. VPNs, much like in the civilized world today, were used, among other things, to simply

03:27

Speaker A

access one's remote workplace. Say you have an internal network or an office LAN, and you connect to it from home via an encrypted VPN channel. That's it , you connect to your computer and work peacefully. Or you take files from a

03:46

Speaker A

work server on the LAN, work on them, and upload them back. It was a very common practice indeed. And so we enter the next era, after the Yarovaya law, once those TSPU boxes were installed and they started filtering traffic more

04:03

Speaker A

or less effectively. And one of the most high-profile events was probably the blocking of Telegram in 2018.

04:12

Speaker A

Actually, after that, more people started talking about various proxies, protocols, including VPN protocols, and how networks are structured in general.

04:24

Speaker A

People suddenly started learning about it from everywhere; it was being shouted from every rooftop. Everyone, much like during the pandemic, had their own version of events. Everyone became a network engineer or some sort of specialist in the field. And of

04:39

Speaker A

course, thanks to this, more complex protocols began to emerge, including various proxying schemes on how to access a given resource via some server . Take Rutracker, for example; it isn't blocked abroad. You can easily access it there. At the same time, it is

04:59

Speaker A

blocked in Russia. Well, many people figured this out and started routing traffic in various ways just like that.

05:06

Speaker A

That was also when the MTProto protocol appeared, which is unique to Telegram, developed specifically for it, and still works only within it. And getting closer to more modern things that surround us now, like, I don't know, YouTube, Instagram, and various other

05:22

Speaker A

social networks, including LinkedIn, by the way, a business-type network. They didn't like that one for some reason either. Oh well. In general, when mass blocking began, more rigid responses appeared in the form of bypass tools like GoodbyeDPI. The very first "Zapret

05:48

Speaker A

" was created based on these developments to bypass these TSPU boxes , which are called Deep Packet Inspection, I believe, right? DPI, Deep Packet Inspection. In short, it's just a box through which all of a provider's traffic passes. And, accordingly, it

06:09

Speaker A

can be filtered in a certain way. Filters are built in there so you don't just take all this traffic, all these zeros and ones, and save it somewhere, because you just wouldn't have enough power. You need to understand what is

06:20

Speaker A

important and what is not. Accordingly, these packet chains are analyzed, and if they are of any interest according to the filters, they go where they need to go, in short. But since these boxes are still electronic devices that can

06:39

Speaker A

somehow be overloaded, deceived, or confused, you can provide one packet instead of another. Or you could have one packet encapsulated under another.

06:51

Speaker A

So, the box itself won't understand that your packet is actually important, even though it is. And you can do this, essentially, with various kinds of encryption. That is what is now called obfuscation. Different ways to confuse these boxes so they don't understand

07:07

Speaker A

where you are trying to go at all. Suppose you are trying to go to Instagram, but you actually just send it three pieces: inst, ag, com. There you go, you just throw these three pieces at it, and it doesn't understand

07:25

Speaker A

where you're going. Maybe you're going to some "institute.ru", right, and not to Instagram, and so on. Then it all gets stitched back together to reach the final destination; I'm simplifying quite a bit. This is essentially what I talked about in the very first video,

07:43

Speaker A

wearing a stretched-out black t-shirt here, back when no one understood anything. And, actually, that was more of a theoretical part. In short, the simplest thing you need to understand is that these are just electronic boxes that can be deceived. Wonderful. That

07:58

Speaker A

is, in fact, what is happening right now. And no VPN, once again, is needed here. We haven't reached that point yet . I mean, you're still getting access to the resources you need by tricking or bypassing these boxes. Accordingly,

08:14

Speaker A

yes, it still has an effect, well, not a very strong one, actually, because internet capacity and speeds have already grown enough that you can, I don't know, connect a whole bunch of devices to some router. You have a 100

08:32

Speaker A

Mbps plan, and at the same time, you can watch YouTube in 4K on several devices quite easily, without any effort, like even now, using this DPI bypass, you're welcome to. I'm uploading this very video not via VPN either; I'm uploading it precisely

08:48

Speaker A

through the second Zapret, as it turns out. Well, that's kind of the core of the second Zapret; their logic is the same. This is already a whole chain of tools. And in general, developers exchange ideas and approaches with each

09:02

Speaker A

other, and that's why we get similar products, just implemented however they see fit. And now we're getting to more interesting things, more complex blocks , when it's not just that something is blocked in Russia, but blocked from the

09:20

Speaker A

outside. I mean, the service itself tells you from Russia to just get lost. We don't want you here. If you connect from a Russian IP, then you get lost.

09:34

Speaker A

Essentially, this is discrimination based on IP address. But since you can't determine where a person is located based on an IP address— because you can connect through some device that has a specific IP that the system determines as Russian or

09:51

Speaker A

non-Russian. Accordingly, you can be anywhere and connect through anything, obtaining any other IP address. I am again greatly simplifying this, because nowadays, not only, I don't know, something like ChatGPT doesn't just look at the IP; it, for instance, also

10:08

Speaker A

makes sure this IP looks as much like a regular home IP as possible. As if you were sitting at home, just abroad and in a country that it likes, so that you can log in and pay them money. But if

10:22

Speaker A

it identifies your IP as a data center IP, it might tell you that access is closed to you too, because you're likely a robot, not a person who, well, isn't sitting in a data center trying to log in. Based on all these methods,

10:37

Speaker A

these chains, servers, and connections through various proxies and servers, I have a separate video, or rather not even me, but on the Cyberzha channel.

10:47

Speaker A

I’ll probably leave the link as well, because there is truly important information there. I am literally showing how one can use proxies, for example, for a normal, international business. Well, and this is truly the tip of the iceberg. These are, of

11:01

Speaker A

course, the allowlists. The logic here is the opposite of these blocklists. I mean, I previously talked about how there were blocks on specific resources , blocks by IP address, from outside, from inside. Where one computer cannot connect to another computer because its

11:18

Speaker A

IP is wrong or something else, they don't like something there, and so on. Some hardware fingerprint is not quite right, and so on. But here, the logic is exactly the opposite. There are only resources that you are allowed to visit

11:30

Speaker A

, and that’s it. Everything else is forbidden. But I didn’t talk about these TSPU black boxes that appeared and traffic analysis for nothing, because the ones monitoring where people go, who can go where, and who cannot, are, of course, these boxes.

11:49

Speaker A

And, as we have already found out, their resources are not infinite. They are essentially the same as mini-computers, electronic devices that simply process traffic. And here we, in fact, approach how one can bypass the allowlists. In general, there are two

12:10

Speaker A

global approaches. The first approach is, in some way, to make sure your server, through which you access the free internet, is on this allowlist.

12:22

Speaker A

That is, it must be that specific resource, it doesn't matter which one, you simply use it to exit. You don't just sit on it to reach the free world.

12:30

Speaker A

The most important thing is for this device—usually a server—to be on it . There are even some SIM cards that constantly have this allowlisted IP, and they don't have any blocks to begin with, but that is more of an exception

12:43

Speaker A

to the rule. This can, of course, be done in various ways, because TSPU boxes are managed by people, and people love money. Accordingly, you can buy such a server that already has this allowlisted IP address. There, as a

12:57

Speaker A

rule, traffic is limited. Well, because it is probably easier to charge not by the month, but for every gigabyte of traffic that passes through it. Well, in principle, yes, one can then maximize their profit. You can take any

13:11

Speaker A

other server with an IP that is on a blocklist, rather than an allowlist, where you aren't allowed to go when these allowlists are introduced. And again, by paying money, you can make this blacklisted IP white. And then you

13:23

Speaker A

can browse the internet through this server. Again, as a rule, they charge money for traffic. I think the main downside of this approach is clear: those people and those organizations that create these whitelists and block access as they please don't warn you

13:43

Speaker A

about it in advance. With one hand they block, and with the other they take money for bypassing those very blocks.

13:55

Speaker A

This includes plenty of officials and people from various security structures , from law enforcement agencies, who just take it, use it, and sell it themselves. Take the same MTProto proxies, for example: if you type that in Telegram, the first links you'll see

14:13

Speaker A

are to them, because they explicitly state that our partners, our friends, are Telego. Well, and it's clear who developed Telego. So, the choice is yours. Either trust those people who offer this, right? Essentially, these subscriptions in various apps and such,

14:30

Speaker A

where you pay for a certain amount of traffic—I don't know, 10, 20, 50 GB of traffic—you can buy it, and it will supposedly bypass the whitelists.

14:40

Speaker A

Yes, it will actually work. It will even work quickly, because the servers themselves are located right in Russia, right near you, but they can be blocked at any moment. The information passing through these servers may remain there, and again, it may be filtered in a

14:56

Speaker A

certain way. It is unclear how it is encrypted there. Most likely, it is encrypted in such a way that any owner or renter of this server can simply filter this traffic and keep the juicy pieces of it for themselves. For most

15:11

Speaker A

people, this might not matter, but some might find that compromising material on them has surfaced out of nowhere, or that some personal correspondence has leaked. Some personal files or personal data, and it's just unclear how they could have leaked at all. Well, that is

15:25

Speaker A

exactly how they could have leaked. So, choose for yourselves and think for yourselves. The second global approach to bypassing whitelists is some kind of , let's call it, tinkering with these protocols, right? Exactly. You route traffic that is encrypted in a certain

15:42

Speaker A

way through pre-approved protocols that will always be allowed. Companies like VK will always be on the whitelist, as well as Yandex, RuTube, and so on.

15:53

Speaker A

Accordingly, you can use their own protocols and their own infrastructure to access the free internet through them, because they are on a whitelist, the internet is completely open to them , they can go wherever they want, while you can only access them. To put it

16:13

Speaker A

more crudely, you send a sort of magic packet, you ask a question to VK, to a VK server, and you get some kind of answer to that question. And you use this answer to get onto the free internet, because the response from VK

16:34

Speaker A

legitimately allows you to bypass the whitelists, since it is a response. from a whitelisted service. Yes, of course, there are certain difficulties, and the speed is quite low. Those are the downsides. As for the upsides, it is clear that you can essentially set

16:54

Speaker A

up such a server yourself and bypass these whitelists using the infrastructure of these corporations, which will always be on the whitelists.

17:04

Speaker A

And, essentially, you will be independent in this regard. Of course, things like calls, Mail.ru emails, RuTube, or VK were not created to bypass whitelists, but their infrastructure is so large that there are enough holes in it to simply hammer

17:23

Speaker A

away at this entire system. And this approach that we are seeing, bypassing through all sorts of VK calls, Yandex, or bridges and so on, is essentially the core or a part of some big idea, some big approach to, in principle,

17:41

Speaker A

hacking these proprietary corporate protocols. And this is not about VK potentially stopping its video or audio call services, or doing something else.

17:55

Speaker A

It very well might. It is more about the idea of how these corporations communicate between their departments and their internal electronic structures. How a Yandex data center in Kazakhstan communicates with a data center in Moscow. They have their own

18:14

Speaker A

protocols for doing this. Banks also have their own protocols. In essence, bank ATMs also communicate with each other in a specific language. This is what is called a protocol. So, if you apply your own filters, just like these

18:29

Speaker A

DPI boxes apply filters to analyze traffic, if you apply these approaches to analyze the protocols that the corporations themselves use to communicate, you can, accordingly, wedge yourself into this and speak their language. Accordingly, you can use this to bypass whitelists. And you

18:47

Speaker A

won't be some guy from nowhere trying to access something, only to be blocked . Instead, you will be just another ATM that is simply sending some kind of service information. And, actually, based on these foundations, on this second major approach, Meridian was

19:05

Speaker A

created. It is my brainchild, and not just mine. It was, of course, a synthesis of various ideas on how this could be implemented. And since I primarily made it for my own convenience, it turned out to be quite

19:21

Speaker A

user-friendly. Automatic. And, essentially, I called it a hybrid VPN because, unlike other VPNs, you basically don't have to do anything here. You just press a button, connect, and that's it. All the main functionality is embedded right within its core. It automatically, like those

19:41

Speaker A

very TSPU boxes, constantly analyzes traffic, probes the network, and checks which blocks are in place, whether there are whitelists, what those whitelists are, and what the blocks are , because they still differ from each other in terms of some kind of

19:56

Speaker A

gradation. And it uses one language or another for whitelists. It uses a language to bypass whitelists, and a faster language to bypass standard blocks—accordingly, for bypassing regular blocks, like the same anti-DPI protocols similar to Zapret 2. There are also several intermediate stages

20:17

Speaker A

through which it selects one bypassing language or another. If you look at the top level, when no whitelists are in place, when we have a full-fledged mobile network, in principle, as it was before, then a little obfuscation— that is, a little traffic masking of

20:40

Speaker A

those packets I talked about—is enough, and some fairly fast protocol is sufficient. In principle, WireGuard was such a protocol for a long time, which is why a whole bunch of other protocols were also made based on it— specifically on the refined WireGuard

20:59

Speaker A

core, which was created and improved over decades—where, essentially, every packet and every packet element is encrypted, and it speaks in this protocol, in a specific language, essentially, from this chain of packets . But since this protocol is one of the

21:16

Speaker A

most well-known in the world, it was one of the first to be blocked, because it's clear what its language is, how it communicates, and what the properties and core characteristics of its protocols are. Many derivative protocols of WireGuard—the same

21:31

Speaker A

Amnezia, AmneziaWG, then just Amnezia, then they started being called AmneziaWG and Amnezia again—although it’s unclear what there is more of: WireGuard or their own developments— they went down the path of even more obfuscation, that is, even more masking

21:49

Speaker A

, even more of this entanglement and protocol weight. Yes, it is, of course, quite bulletproof. It will be difficult if you have, I don't know, different obfuscation parameters on different servers. There are thousands, if not millions, of these servers, and with

22:07

Speaker A

different parameters on them, you won't be able to block them all because you simply won't have enough computing power in those TSPU boxes and data centers that analyze this traffic. And, of course, since it’s still the same old language—even if it's a heavily

22:23

Speaker A

modified, significantly improved WireGuard-based protocol—it is, naturally, not designed to bypass whitelists. It’s not the same language that, for instance, those elements inside a corporation I mentioned use to communicate. And even that location they added, Greenland, is essentially just servers on whitelists.

22:46

Speaker A

I mean, whether they were bought or obtained somehow, I don't know, but these are clearly Russian servers, because otherwise it would be impossible to get such speeds with foreign servers. They will stir up some conspiracy theories in general. For

22:59

Speaker A

those who like this, it’s a very good method, because when those whitelists are introduced, you no longer have a choice. You just want it to work, to have at least some kind of network, even at a bare minimum. And so, at the

23:13

Speaker A

very top layer, we just need simple obfuscation, simple masking. You can build this protocol yourself, make it lightweight. It will certainly be very fast, and you will have your own parameters for this masking. Therefore, in principle, you won't be detected if,

23:32

Speaker A

I don't know, you use it, your friends and family use it, or even a few hundred people. I mean, it's not worth it to collect information about your specific masking parameters just to identify those so-called protocol signatures, which reveal that it's the

23:49

Speaker A

specific language of that protocol, and that the protocol is "enemy" and must be blocked. Let's go a bit lower, and in those same mobile networks, the UDP protocol might get throttled. UDP, like TCP, is one of the main transport

24:07

Speaker A

protocols; you could say it's like a road, a highway of sorts, that data travels along. If TCP is a fairly simple road, then UDP can be compared to some kind of high-speed freeway. So, when UDP is restricted, you naturally

24:25

Speaker A

need to switch to TCP—a simpler, perhaps slower, but still usable road. But if the TCP protocol is also throttled, meaning we essentially don't even have a dirt road, we are left with only some paths through the forest.

24:42

Speaker A

More accurately, we are entering the forest of allowlists. And here, of course, we face another difficulty, because we have a car, but our only road is this forest path. That is, these are the service channels used for transmitting information within a

25:01

Speaker A

corporation. Accordingly, there won't be any wide roads or highways there, of course. They weren't designed for that at all. But to maximize speed, we have to essentially chop down trees ourselves and widen this path somehow, in short, paving the road for ourselves

25:20

Speaker A

. So, if this corporate service channel is slow and quite narrow, you can simply aggregate these channels to create a kind of multi-stream, and through it, you can actually increase the speed. And this speed can actually be increased quite significantly. Maybe

25:41

Speaker A

not to super heights, but on the order of 10 to 20 times is possible, depending on various things: the hardware you use and how you actually wrote your protocol, how you chop down these trees. Maybe you went to clear a

26:03

Speaker A

path where there are birches, a birch grove, or perhaps where there are conifers. Well, the labor costs will differ significantly accordingly. And, of course, the protocols themselves differ; they weren't originally made for this, but we use them to bypass

26:21

Speaker A

allowlists, so they all differ from each other in relation to this task. Some corporate protocols are more suitable. That is, the individual channels through which you can get access are a bit wider there. But if you aggregate them 10 or 20 times, it

26:40

Speaker A

turns out much better than if they were very small to begin with. You may have increased it 10–20 times, but it’s still not the same as the other one.

26:52

Speaker A

Well, essentially, we briefly broke down how the protocol I conceived works in general in automatic mode. While in a regular VPN you have to switch between these locations—some have higher ping, some lower, some work faster, some slower, some don't work at

27:10

Speaker A

all or disconnect over time—here, everything is fully automated. Because the protocol itself determines the most convenient path to take: whether there is a road here or just trails, or if you simply need to clear a path through this birch or any other forest. It uses

27:31

Speaker A

whatever is available in your network to ensure you can access the open internet. Even if you have the strictest whitelists imaginable, it will still find at least one path through. You won't be left without a connection in any case. Anyway, let's

27:52

Speaker A

move from talk to practice. Let's take a look at how all this looks. As I already mentioned, this is already implemented on iPhones, Androids, routers, Kinetic OS, various routers, and even things like TP-Link, because they can be flashed with something like

28:13

Speaker A

OpenWRT. On ASUS too, because it is very similar to OpenWRT—if you take Merlin WRT, it’s a very similar system, and actually the same goes for OpenWRT, ImmortalWRT, and all those branches based on OpenWRT. In principle , the control panel on a Kinetic router

28:36

Speaker A

is not different from the OpenWRT panel . The only thing is, there is one button—well, I'll show you now. So, I have some junk here. I’ve cleaned up a bit, but tests are still ongoing.

28:48

Speaker A

They are ongoing because the scripts, by the way, can be updated. And they are ongoing because I am currently implementing a whitelist mode. I'll talk about that at the end because it is currently only in the testing stage.

29:04

Speaker A

And, well, essentially it is only suitable for devices like laptops, routers, and more stationary devices, not for mobile ones. I will talk about this separately later. Actually, here we see the basic elements that we need.

29:21

Speaker A

If we have any updates, a button lights up; you just press it, wait a few seconds, and it updates itself. Stop, start, restart. Well, it's clear: clear the junk if you have little disk space.

29:36

Speaker A

Though I doubt you will have that little space, most likely you won't. Next, there is a list of your own addresses that need to be routed.

29:46

Speaker A

Meaning, you need to gain access to them by any means necessary. As I already said, there are different paths . Some are faster, others slower, but when you don't have a highway nearby, even a small path is enough to get by.

30:03

Speaker A

This is no longer a dead end. This section covers those rather complex blocks that DPI, like NFQS2 or the second zapret, cannot bypass. That is because these services themselves block Russian IP addresses. And no matter how hard you try, you won't get access to

30:23

Speaker A

them, because it's not the TSPU box blocking you, but the services themselves—the remote server you're trying to reach—because it doesn't like you, it doesn't like your face, and it doesn't like your IP. Therefore, you won't gain access there until you

30:37

Speaker A

change your IP. You can delete, export, import, disable, scroll through the list, or add items. Next comes, perhaps , the most interesting part. It is cut off a little here. Let's fix it like this. Now that's great. Currently,

30:59

Speaker A

bypassing whitelists is done via VK Calls. These are the so-called hashes that are taken; you can get them from your own account, buy an account, steal a VK account, or pick one up somewhere.

31:14

Speaker A

They clearly still don't cost much right now. Go to VK, create a call, the link copies instantly, paste it here, add it, and check it just in case, because they can die. I mean, you can use this link, well, the call link

31:31

Speaker A

isn't permanent; sooner or later it will die, like, when you aren't calling anyone anymore, that's it, goodbye.

31:37

Speaker A

Accordingly, there is a pool for this. That is, there are five active links used for, as I mentioned, multi-threading to poke at the corporate holes and get out into the free internet. And there is a reserve.

31:54

Speaker A

Accordingly, you added them to the reserve. These links just sit there until one of these five dies. And then it just replaces it automatically.

32:05

Speaker A

Accordingly, when one dies, it is automatically removed and replaced by one from the reserve. I've been using this for, well, how long now, several months probably. No, a few months, maybe a month or two, but not a single

32:18

Speaker A

link has died yet, though, in fact, I don't even see these whitelists via cable, but, by the way, those who are already subscribed don't seem to have that issue either as far as I recall.

32:31

Speaker A

Accordingly, I made it so that these links aren't hammered unnecessarily. They aren't checked for vitality every 5 seconds or so, but only if you click "check," or if there is a real drop in performance or a drop in that channel.

32:49

Speaker A

And then it will see—the program itself will see—that one of the links has simply died. It will then take another one and ramp your channel back up to maximum speed. And, of course, there is data for support. You just

33:02

Speaker A

copy it and send it to support so they can help you. Of course, VK isn't the only company that can be used like this to bypass whitelists, as I've already mentioned. There's Rutube, there's Max, there's Yandex, which is quite large,

33:20

Speaker A

and there are several smaller players that I'll need to sit down and look at closely once I finish all this. I'll sit down and examine them to see how well they are suited for bypassing whitelists. And, in principle, they are

33:40

Speaker A

all suitable for bypassing whitelists. And I need to make it so—and I will —that even in the whitelist bypass mode, there will be, I don't know, Yandex, or some other RTE or Max, and they will select the most optimal

33:57

Speaker A

balancing based on your current network , your current environment, and the speeds on each specific channel. The beauty is in the automation; you just set it up once and that's it. So, this supply of links, even if there are

34:14

Speaker A

constant whitelists on wired connections, will likely last you more than a year. Therefore, you can simply forget about it for a year. Everything will work for you. All the sites you’ve added will work, regardless of what network you have. If they

34:31

Speaker A

introduce whitelists, you won't even care. Everything works on all devices connected to this router. Everything is wonderful. And when that dark moment arrives, when whitelists are introduced on wired connections—and some people already have them on wired connections because they have SIM cards in their

34:49

Speaker A

routers, and mobile operators in many places are introducing these whitelists one way or another. Consequently, they already have whitelists periodically enabled on their wired connections, or even permanently in place. So, what am I doing now, and what does the white

35:05

Speaker A

mode consist of? It consists of the logic being completely reversed. Just like I talk about blacklists and whitelists, yes, about regular blocks and, actually, about the most severe blocks. Here, too, there is the same reverse logic. Here we are now

35:20

Speaker A

recording those websites, those domains that we want to access in conditions where these whitelists do not exist, when, uh, only some addresses are banned, including these ones that we want to access. Fine. And when they introduce whitelists, it is most

35:39

Speaker A

convenient for us to do the opposite. That is, we should have a list here of where we should go directly. That is, the same Yandex, the same VK, or something else, and everything else should go a priori into the tunnel, and

35:51

Speaker A

then your list won't just be miles long , and it will be convenient for you.

35:55

Speaker A

Accordingly, this will be the implementation of this white mode. There are no whitelists, you have this black mode. When there are whitelists, it automatically switches to the list you have prepared in advance, with those addresses that need to be

36:11

Speaker A

accessed directly, that is, bypassing the tunnel. I've already been talking quite a lot, so I don't want to keep you too long either. And regarding mobile clients for iPhones, for iOS, for Androids. In the future, I will also make them for PC, well, like for

36:34

Speaker A

Windows, in short, and for Mac. But I will give you a little teaser. There is a repository with a mobile client that we are maintaining together with a neural network. You can, in principle, download it from here. This is a free

36:48

Speaker A

version, since I haven't uploaded it to Google Play yet. The review there has already been completed, everything has been passed. The only thing needed is a foreign legal entity, but that is in process right now, so as soon as I

37:01

Speaker A

upload it to Google Play, you can download it from here for now. This is a so-called conditionally free version.

37:08

Speaker A

Uh, 3 days are given for free. You can just take a look at what changes have been made. Well, for now, I probably won't tell you much more. Just, if anything, I'll leave a link, and you can install it yourselves, take a look,

37:21

Speaker A

and so on. As for the iOS client, I haven't uploaded it anywhere yet, it's all more complicated there. I'd rather wait until I upload it to the App Store for router clients. All the production versions are in a different repository

37:33

Speaker A

of mine. In this one, yes, this is a public mirror, so that from here you can simply, by pasting one command, install the client on the router. That is what I showed you before. This panel can be installed on OpenWRT, it can be

37:47

Speaker A

installed on Keenetics. I'll show you right now how it looks on OpenWRT, moreover, right in the OpenWRT panel itself in the Services section. This is how it looks, as it turns out. A panel within a panel. So that you don't have

38:01

Speaker A

to type anything in separately. You essentially have everything in a single-window mode. You select it in the menu, and that’s it—you have full access. Now, those who watched until this point surely want to know how to connect this miracle. Well,

38:14

Speaker A

there are two ways: use the programs that are already ready. They will certainly be refined further, but overall they are quite combat-ready and powerful enough for constant use. And there is a way to do all this through a

38:30

Speaker A

bot in Telegram. I will, of course, leave the link in the description, obviously. And through the website.

38:36

Speaker A

I’ll show the website now, but first, I’ll say a little about the bot. Why is the cost higher in the bot? Because you get my Telegram proxy, which I recently updated, and it works absolutely amazingly, just wonderfully.

38:54

Speaker A

It’s faster than any VPN because it is Telegram’s own protocol. I mean, honestly, they haven't been making garbage for, what, 8 or 9 years now.

39:06

Speaker A

There is an internal chat with like-minded people, people who themselves can do a lot with their hands and, most importantly, their brains in the current conditions. They are also testing all sorts of interesting things. By the way, I learn

39:21

Speaker A

a lot from them too, because this kind of outside experience is very interesting in that regard. How people are surviving in modern conditions. And , of course, I’ll be there too; I write there periodically, and the latest changes come out much earlier

39:37

Speaker A

than when I publish small reports on the Telegram channel or abbreviated versions in YouTube posts. Also, after paying for a subscription in the Telegram bot, you get the opportunity to buy keys not one by one, like on the

39:52

Speaker A

website—which I’ll show in a moment —but as a whole package. This is, accordingly, significantly cheaper for a family, or you could buy them for a whole village. Also, importantly, one key corresponds to one device; it gets linked to it. Just like, I don't know,

40:09

Speaker A

in Google Play, you bought a subscription for your device, linked this key, and that's it—the subscription lives on your device and is linked to it. Purchasing a key through the website, accordingly, does the same thing. But if you buy a

40:26

Speaker A

subscription through the bot, then, accordingly, you get the ability to unlink the device. That is, you get the ability to unlink a key from devices and re-link it to any other device. So, for instance, you have a key initially

40:41

Speaker A

linked to your Android phone, you unbind it via the bot, bind it to a router, then you go somewhere, move, and so on. Let’s say you need it on your iPhone, you unbind it from the router and bind it to the iPhone. That

40:54

Speaker A

is, you don’t need to have 10 keys to install them on every single device.

40:59

Speaker A

You simply take one key and rebind it. So, let’s go to the site meridianpen.org. Well, basically, it’s just a simple single-page site.

41:14

Speaker A

Although it’s not exactly a single-page site, because there’s another section here. It is, in fact, another page. Oh well. Anyway, I think you’ll look around and explore it too . Everything here is elementary, there are even answers to questions. And even

41:30

Speaker A

options for bypassing the fairly simple blocks I talked about today. There is a direct link to the post. Right now, you can only pay with crypto, but in just a few days, I hope I’ll be connected to a proper provider, so SBP will be added

41:53

Speaker A

, as well as Russian and foreign cards. But in general, they will appear too.

42:00

Speaker A

That’s all, the cost here is cheaper. If it scares you, then I don't envy you when you see how "whitelists" on cables will scare you. So, in any case, if you have the opportunity, stock up on at least one key either through the bot or

42:19

Speaker A

the website so you can stay connected. Well, a few extra VPNs wouldn't hurt either, if you'd like. If you end up without a connection at a critical moment, you won’t be able to do much about it. It is, of course, better to

42:32

Speaker A

think about this in advance and stock up on these options. You could say I’ve completely lost it and gone crazy, right? You enter your email here , and after payment, you receive an email with the key and links to where

42:48

Speaker A

you can get everything. Another important point is that the key you receive starts its duration from the moment of activation on any device, be it a router, phone, computer, it doesn’t matter. That is, you can buy a key for a certain period, say for a

43:07

Speaker A

whole year, and it will start working only when you activate it. And all this time it can just sit there waiting for the right moment to be activated. You don’t have to activate it immediately . Basically, I’ve covered all the

43:19

Speaker A

main points I wanted to. Ah, whatever feedback you have, even negative, whatever is complaining, having slaved away, goddamn, for probably 2 months making this freaking VPN. You can write about that too, I’ll read it and reply with something just as

43:36

Speaker A

negative. Also, it’s not for nothing that I urge everyone to join the Telegram channel, because that’s where I post full updates on what I’m working on, what I’m improving, what I’m doing, and so on. As for, well, right now I’m mainly just working on

43:52

Speaker A

the VPN, but in fact, there will be a lot of other interesting things coming up later. The first chapter of the book will be published soon in the form of an audiovisual novel. There will be four chapters in total. I hope to voice

44:07

Speaker A

the first chapter soon; once I finish all these tests with the light mode, I’ll finally record the first chapter and release it, because the art and everything else is already done. Also, there will be a series of games based

44:19

Speaker A

on the book. I’ll start with one, of course, but the series and the universe are quite interesting, so I hope you might like it too. And in Telegram, we have a fairly cozy and kind, though not always, community. I don’t know, in

44:36

Speaker A

just about two or three hours, I probably gathered the necessary number of people for closed testing on Google Play. To publish a production version and get access to it, you need at least 14 days with at least 20 testers who

44:50

Speaker A

have provided their email, whom you’ve added to the list, and only then do they become testers. After that , they also need to install the app and not delete it during those 2 weeks.

45:03

Speaker A

Then you get access to the production version. And I gathered people there, many responded, and it really resonated with many of them. Now people are also writing about iPhones, like, come on, join the Apple side, let me test it,

45:19

Speaker A

and so on. Or the opposite, like, let’s do it this way on Android and keep it like that for Apple users. Well , those are just fun little things. So I hope everything goes well for you too . I will try to release the next video.

45:36

Speaker A

It will most likely be about the book. Maybe it will be a video about mobile clients. Or maybe about the light mode.

45:44

Speaker A

We’ll see, we’ll see. Or maybe it will all be together. So, stay in touch , and bye everyone.

Topics: VPN obfuscation internet censorship deep packet inspection DPI bypass Yarovaya law Telegram blocking proxy protocols internet freedom IT Jin

Study this video

- [Flashcards from this video](https://sozai.app/tools/ai-flashcard-generator/?from=transcript&id=74071)
- [Quiz on this video](https://sozai.app/tools/quiz-generator/?from=transcript&id=74071)

Free, made by AI from this transcript. No signup.


---
This is the markdown twin of https://sozai.app/transcript/white-lists-no-longer-work-vpn/ — the same content, without the markup.
Published by SozAI (https://sozai.app). Reuse and quotation are allowed with attribution and a link back.
Machine-readable index: https://sozai.app/llms.txt · data API: https://sozai.app/api/