{"id":44958,"date":"2026-09-28T09:00:00","date_gmt":"2026-09-28T09:00:00","guid":{"rendered":"https:\/\/hubhide.com\/?hubhide_test=1"},"modified":"2026-09-30T14:07:38","modified_gmt":"2026-09-30T14:07:38","slug":"internet-allowlist-2026","status":"publish","type":"post","link":"https:\/\/hubhide.com\/blog\/en\/internet-allowlist-2026\/","title":{"rendered":"Internet Allowlist 2026: Which Websites Work When Mobile Internet Is Restricted"},"content":{"rendered":"
\n

The signal bars are full. The 4G icon is right there. The plan is paid. Yet Telegram keeps spinning and will not send a message, maps show a gray square instead of the city, and a taxi cannot be called because the app cannot reach its server.<\/p>\n

At the same time, Gosuslugi opens instantly. The bank works. Ozon loads as usual.<\/p>\n

A quick disclosure about who is writing this: I work for a service that sells access, so I have a commercial interest here. What follows, however, is based not on press releases but on conversations with people who contact support on the exact evening their internet stops working. Those messages often paint a more honest picture than any review, because people do not mince words when they are stuck. I will also say where no VPN will help.<\/p>\n

So, this is not a broken phone. It is an allowlist: the operator lets traffic reach only approved addresses, while everything else is filtered out. The internet does not disappear completely; only a narrow slice remains accessible. That distinction is the whole point.<\/p>\n

If you are reading this on your phone and need the short version:<\/p>\n

    \n
  1. Check Wi-Fi. Fixed-line internet is usually restricted later and less aggressively \u2014 often it is still fully usable.<\/li>\n
  2. Do not waste time changing DNS, switching airplane mode on and off, or rebooting: it will not solve this, as I explain below.<\/li>\n
  3. If your VPN is installed but will not connect, change the server and protocol rather than the service itself.<\/li>\n
  4. If you do not have a VPN, installing one during restrictions can be difficult: app stores also depend on the internet. The best time to prepare was yesterday.<\/li>\n<\/ol>\n

    Why some sites work while everything else does not<\/h2>\n

    I will start with a misconception I see in roughly every other support request: people assume the operator has \u201cturned off the internet\u201d, then build their troubleshooting around that idea \u2014 if it was turned off, they need to somehow turn it back on. So they dig through network settings, toggle things they have never touched before, call support and spend twenty minutes listening to hold music. I get messages like these in batches. Nothing was actually switched off. The connection is there, the cell tower is working, and data is moving. There is simply a filter in the path, and it does not let everyone through. The filter is created at the operator’s traffic-filtering equipment level, not inside the app, which is why the rest follows: your phone is not the problem, the app is not the problem, and the Android version is not the problem. Reinstalling Telegram has about as much effect here as repainting a car has on whether a drawbridge is open.<\/p>\n

    The easiest way for me to explain it is with mail. Imagine a sorting center where all your envelopes arrive, and the sorter has a list of addresses that are allowed. An envelope to an approved address leaves the center. An envelope to any other address does not come back with \u201crecipient refused\u201d stamped on it \u2014 it simply disappears, and you are left wondering whether it ever arrived. That is why an allowlist is so easy to recognize: the app does not say \u201cno internet\u201d; it just loads forever. The phone has a network connection, but there is no response. Hence the familiar spinning wheel I see in half the screenshots people send me.<\/p>\n

    [Image: diagram \u2014 smartphone, mobile tower, traffic-filtering block, then the internet; the filter shows where traffic is cut off]<\/em><\/p>\n

    There is another unpleasant detail that gets surprisingly little attention and causes a lot of questions. Services on the allowlist are enabled by IP address and domain, while a modern website is rarely just one address: there is the site itself, a third-party CDN, fonts from somewhere else, and a CAPTCHA provider. A bank domain can be allowed \u2014 great. But the CAPTCHA on the login form may live on an address that is not on the list, leaving you with a blank login screen on a supposedly allowed service. You call the bank and they can only shrug. So \u201cworks\u201d needs a qualification here. The core service works, while the small dependencies around it can fail \u2014 and in my experience, those dependencies are often exactly what you need at that moment.<\/p>\n

    What works and what does not: snapshot for 14 September 2026<\/h2>\n

    Here is the table: what normally works when mobile internet is restricted and what does not. One thing to say before it, rather than hiding it in fine print afterward: allowlists differ by region and can change within a day. This is my snapshot based on support requests, not an official document. Checked on 14 September 2026.<\/strong><\/p>\n

    \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    Category<\/th>\nService<\/th>\nUsually available<\/th>\nWhat can still break<\/th>\n<\/tr>\n<\/thead>\n
    Government<\/td>\nGosuslugi, government agency sites, tax service<\/td>\nYes<\/td>\nExternal payment widgets, sometimes CAPTCHA<\/td>\n<\/tr>\n
    Emergency<\/td>\n112, emergency service sites<\/td>\nYes<\/td>\n\u2014<\/td>\n<\/tr>\n
    Banks<\/td>\nRussian banks and their apps<\/td>\nYes<\/td>\nPush notifications through foreign services, in-app cards<\/td>\n<\/tr>\n
    Telecom<\/td>\nOperator personal accounts<\/td>\nYes<\/td>\n\u2014<\/td>\n<\/tr>\n
    Shopping<\/td>\nOzon, Wildberries, Avito<\/td>\nYes<\/td>\nProduct photos from external CDNs, video reviews<\/td>\n<\/tr>\n
    Maps<\/td>\nYandex Maps, 2GIS<\/td>\nUsually<\/td>\nTraffic and map tiles may load slowly<\/td>\n<\/tr>\n
    Taxi and delivery<\/td>\nMajor Russian aggregators<\/td>\nPartly<\/td>\nCard payments, courier chats, tracking<\/td>\n<\/tr>\n
    Social networks<\/td>\nVK, Odnoklassniki<\/td>\nYes<\/td>\nEmbedded links to external resources<\/td>\n<\/tr>\n
    Messengers<\/td>\nNational messenger MAX<\/td>\nYes<\/td>\n\u2014<\/td>\n<\/tr>\n
    Messengers<\/td>\nTelegram, WhatsApp, Signal, Viber<\/td>\nNo<\/td>\nEverything, including calls and text messages<\/td>\n<\/tr>\n
    Video<\/td>\nYouTube<\/td>\nNo<\/td>\n\u2014<\/td>\n<\/tr>\n
    Video<\/td>\nRutube, VK Video<\/td>\nUsually<\/td>\nQuality is reduced<\/td>\n<\/tr>\n
    Social networks<\/td>\nInstagram, Facebook, X<\/td>\nNo<\/td>\n\u2014<\/td>\n<\/tr>\n
    Google<\/td>\nGmail, Drive, Google Maps, Docs<\/td>\nNo<\/td>\n\u2014<\/td>\n<\/tr>\n
    Clouds<\/td>\niCloud, Dropbox, foreign storage<\/td>\nNo<\/td>\nPhoto sync can silently stop<\/td>\n<\/tr>\n
    App stores<\/td>\nApp Store, Google Play<\/td>\nNo or partly<\/td>\nUpdates and installation of new apps<\/td>\n<\/tr>\n
    Work<\/td>\nZoom, Slack, Notion, GitHub, Figma<\/td>\nNo<\/td>\n\u2014<\/td>\n<\/tr>\n
    Gaming<\/td>\nSteam, game servers<\/td>\nNo<\/td>\n\u2014<\/td>\n<\/tr>\n
    AI<\/td>\nChatGPT, Claude, Gemini<\/td>\nNo<\/td>\n\u2014<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n

    [Image: infographic \u201cWorks \/ Does not work\u201d with service icons, alt \u201c2026 internet allowlist \u2014 which sites work\u201d]<\/em><\/p>\n

    Bookmark this page. I am not saying that out of politeness: we update the list, and finding it again over a restricted mobile connection is not much fun.<\/p>\n

    Allowlist, Roskomnadzor blocking and throttling are three different things<\/h2>\n

    They are constantly confused, and not only by readers. The distinction matters: each mode requires a different response, while a wrong diagnosis leads people to fix the wrong thing and conclude that nothing works.<\/p>\n

    Ordinary blocking<\/strong> is a blacklist: specific resources are prohibited while everything else is allowed. The set of blocked resources is limited and can normally be bypassed \u2014 see our guide to bypassing Roskomnadzor blocks<\/a>.<\/p>\n

    Throttling<\/strong> means the bandwidth is deliberately cut: formally the service is available, but video buffers, images take minutes to load, and people eventually leave. There is no clear moment when \u201cit stops working\u201d; it simply feels painfully slow, and I suspect that is the point.<\/p>\n

    An allowlist<\/strong> is the inverse. Everything is prohibited except the resources explicitly listed. It is not just a few \u201cbad websites\u201d that disappear; effectively the whole internet is affected: a work repository, a photo cloud, a conversation with your mother.<\/p>\n

    In the shortest possible version: in the first case the sorter has a long but finite list of addresses that are forbidden; in the third, it has a short list of addresses that are allowed. The difference between those lists is the difference between \u201cannoying\u201d and \u201cnothing works\u201d.<\/p>\n

    It differs by operator and by region<\/h2>\n

    There is no single switch here. Restrictions can be enabled and removed by region, and they can last from a few hours to several days. Sometimes until morning. Sometimes for a week with interruptions. I will not pretend to predict that. It can also be very local \u2014 a whole region, or sometimes individual cell towers \u2014 which creates a story I have heard dozens of times: nothing loads in your courtyard, while two bus stops away everything flies on the same operator. People assume their phone is broken and take it to a repair shop. Do not. I have seen this too many times.<\/p>\n

    The exact allowlisted set also differs: taxi payments may work for one operator and fail for another; one bank may be fully usable while another only shows the balance. The framework is similar, the edges differ. Our mobile internet guide<\/a> covers MTS, Beeline, MegaFon and Tele2. MVNOs, by the way, inherit the restrictions of their host network, which is one of the most expensive misconceptions: a virtual operator does not have its own towers or its own filtering equipment. The filtering is the same, so someone who panics and buys a SIM from another brand may simply be buying the same restrictions with a different logo. Check first, not afterward.<\/p>\n

    One separate point: allowlists are primarily a mobile-internet issue. Fixed-line connections are affected much less often.<\/p>\n

    What fails first: messengers, maps, taxis, banks, cloud services and work<\/h2>\n

    In order, from what I have found most painful.<\/p>\n

    Messengers.<\/strong> First and hardest. Telegram and WhatsApp stop sending messages and calls, and not always immediately: at first a message appears to send, then the check mark sits there for hours, and the person is effectively talking into a void. See our guide to VPN for Telegram<\/a> for ways to restore access.<\/p>\n

    Maps.<\/strong> Russian maps may keep working, but unevenly: the route builds, tiles arrive in pieces, traffic does not update. Foreign maps may stop completely. Offline maps suddenly stop looking like something only paranoid people download.<\/p>\n

    Taxis.<\/strong> The most deceptive case. The app opens, the car arrives, but the payment fails because the payment gateway lives at an address that is not on the allowlist \u2014 and you discover that while sitting in the car. The simple conclusion: carry some cash. Advice from the 2000s that I feel awkward giving, but it works.<\/p>\n

    Banks.<\/strong> The app usually works, but a push code may not arrive if the bank delivers it through a third-party service. An SMS code will arrive: SMS filtering is not affected.<\/p>\n

    Cloud services.<\/strong> A quiet failure: synchronization stops without an error, you take photos assuming they are going to the cloud, but they remain in the phone’s storage. You find out when the phone is lost. I have seen this more than once.<\/p>\n

    Work.<\/strong> Task trackers, repositories, conferences and mail hosted abroad can all become inaccessible. If the team is distributed, write the day off.<\/p>\n

    [Image: screenshots of real errors \u2014 Telegram stuck sending, a map with gray tiles, a banking app showing a payment error]<\/em><\/p>\n

    Five ways to restore full access<\/h2>\n

    Here is the honest version of each, including the downsides. The order is subjective.<\/p>\n

    1. VPN<\/h3>\n

    The only option that does not require changing hardware, operator or location: traffic goes through a tunnel to a server outside the filtering zone, and from there you use the internet as if you were connecting from that location. The serious downside is that a conventional VPN does not always establish a connection under an allowlist. That is the subject of the next section, and it is the important one.<\/p>\n

    2. Home or office Wi-Fi<\/h3>\n

    Fixed-line connections are usually restricted later and less aggressively than mobile ones, and often a home connection keeps working while mobile data is dead. The downside is obvious: you are tied to the location. It is not really a solution, just a way to wait it out.<\/p>\n

    3. Foreign eSIM<\/h3>\n

    A roaming eSIM uses a foreign operator, so the traffic may not fall under local filtering. It does not work everywhere. It is expensive over time, but useful as a backup if purchased in advance.<\/p>\n

    4. Satellite internet<\/h3>\n

    Technically it solves the problem radically; practically, there is equipment, cost and legal complexity. For an ordinary city resident, it is closer to science fiction.<\/p>\n

    5. Fixed-line internet as the primary connection<\/h3>\n

    Boring, but effective. Having a connection independent of the mobile network was sensible even before all this.<\/p>\n

    Realistically, the first two are the practical options. The others are backups.<\/p>\n

    Why a conventional VPN often fails while VLESS with Reality connects<\/h2>\n

    This is where people usually have an unpleasant realization. The scenario is familiar: install a VPN from an app store, press the button, see \u201cconnecting…\u201d, wait twenty seconds and get \u201cconnection failed\u201d. Try a second service \u2014 same thing. Try a third, now a free one because you do not want to spend money experimenting. Why people keep changing services instead of protocols, I still do not know. Then they conclude that bypassing the restrictions is impossible. That conclusion is wrong. More precisely, it is true for the protocols they tried \u2014 the problem is not the VPN concept, but the protocol it uses.<\/p>\n

    Think about it this way. The filter allows traffic to approved addresses. Your server is not on that list, so the connection has to be made in a way that makes the filter believe it is talking to something allowed. You do not need to hide the contents; they are encrypted already. You need to hide the fact that there is a tunnel.<\/p>\n

    OpenVPN and WireGuard are not designed to do that, and that is not a criticism of them. Both have recognizable fingerprints: characteristic handshakes, characteristic sizes of the first packets and a predictable exchange pattern. Nothing has to be decrypted. The shape alone can be enough.<\/p>\n

    VLESS with XTLS-Reality takes a different approach: the connection looks like ordinary HTTPS traffic to a real third-party website \u2014 not a fake site, but a genuine, major and deliberately reachable one. If the filter checks it, it sees a working resource. From the outside, it looks like a website visit rather than a VPN connection, and I still find the idea elegant. There is also obfuscation: padding and timing adjustments that make the traffic less distinctive statistically.<\/p>\n

    Does it always work? No. Some restriction modes are so aggressive that almost everything fails, and I prefer to say that plainly. The promise gets tested on the first difficult evening, and after that people stop trusting you if you oversell it. But under a typical allowlist, VLESS can connect where WireGuard and OpenVPN do not even complete their handshake. More details are in our restriction-bypass guide<\/a>. One important point: use a subscription link rather than a single key \u2014 node addresses can be blocked by subnet, while a subscription can pull new nodes automatically.<\/p>\n

    Digital emergency kit: prepare it in advance<\/h2>\n

    Preparing it during restrictions is too late: the store may not open, a configuration link may not arrive, and the service website may not load. I put my own kit together in one evening and have not had to think about it since.<\/p>\n