Mayak Blog
We write about what we know from practice: how a private network operates, why a connection sometimes misbehaves, and what to do about it. The topics come from the questions people actually bring to our support.
One connection slot, “Block connections without VPN”, battery saving and autostart on Samsung, Xiaomi, Huawei, vivo and OPPO, Private DNS, the clock, the app version — and a five-minute routine.
One configuration at a time, cellular data for the client, Low Power Mode, date and time, an up-to-date client from the real publisher — paths from Apple support. If the iPhone is fine — where to look next.
Five checks in order — server address, config parameters, the AmneziaWG 3.1 version, MTU, IPv6 — and what our own bench showed on three carriers on 28 July 2026.
It connected yesterday, not today. Happ itself rarely breaks: more often the provider’s subscription ran out, a server died, the list did not update, or another app, a wrong clock or the network gets in the way. What Happ shows by itself, how to read its ping, iPhone and Happ Plus separately — and a five-minute order of checks.
“Down today” is almost never a day — it is minutes, and that can be checked rather than guessed. We measure only ourselves, and here is our worst result from the latest measured stretch: on 22 September one of our exits was unreachable for 13 minutes, 03:03 to 03:16 UTC. Not a day, not “every service at once”, not forever; about anyone else’s service we know nothing and will not make it up. What we can hand you is five checks that tell four identical-looking failures apart — your network, your app, our exit and the site itself — and after them the thing you actually need to know: whether to wait or to do something.
Do not write a service off after one bad evening: in our own journal two thirds of failed attempts succeed on the very next try. What separates a bad night from a dead provider is not whether the app connects, but whether anything on their side still answers at all — an error message, the website, the billing page; ten minutes are enough to find out. And if you do have to move: a key or a subscription never transfers between providers, the only thing that moves is your list of devices — so count those. What happens to money you already paid, and what to ask the next provider before you pay them, is here too.
The screen says “App not installed” and keeps the reason to itself. We triggered five refusals on our own file and wrote down what Android answers: the file did not finish downloading, the same app is already installed from a different source (the signatures do not match), the build is older than the one on the phone, the phone is older than Android 7.0, there is not enough space. What to do about each, why a signature clash is only cured by removing the app, and what you lose when you do.
Different companies, different prices, and they stop together on the same day. What the apps have in common, how to tell a broken program from network filtering in two minutes, and what our own log shows: when a person presses the button, 557 attempts out of 566 come up — what breaks is not the connection but the life of the tunnel.
The toggle lights up and dies, “Connecting…” hangs, an error pops up — one fault from the outside, three different ones underneath. The five steps a connection goes through, how each one fails, and a one-minute order of actions.
It worked yesterday, not today. In our journal for 21 August — 22 September, 37 of 58 failed attempts that people started themselves were followed by a success on the very next attempt by the same person, and in 28 of those it was the same direct route. Five causes by frequency and a one-minute checklist.
Payment does not buy passage: the filter on the way has no idea whether you paid. In our journal, since early September the direct route has failed on 7–9 % of attempts against 1 % in late August, and a detour step picks up the connection. What money does buy, and what to check in order.
Not one app comes up — not the old one, not a new one, not a paid one. Three causes from our own log and bench: another app holds Android's single slot, the shape of the first packet, and a weak signal that looks exactly like interference. The «move it to 443» advice is tested and does not work.
143 of our 158 connection self-checks found the phone holding the app on a battery leash. What else breaks a tunnel, and what takes two taps to fix.
A 1.24-second median in our own log — and twenty seconds in rare cases. What those seconds are made of and why the figure jumps.
The shield icon is on, yet no page opens. Five real reasons — from expired access to Wi-Fi login screens — and a fix for each.
There is no “this one works on both networks”: one phone and one server gave three different pictures on three networks. Five checks on your own SIM before you pay, what does not prove it works and what we do not know.
Switching networks on the move, several routes to the server, IPv6 at operators, a weak signal that looks like a refusal, data and battery. Our operator measurements and what to switch on.
Three different networks share the name Rostelecom, and the advice for each differs: home cable, mobile service (that runs on Tele2 towers) and public Wi-Fi in cafés. We have no measurements of our own on any of them and say so plainly. What we do have is Cloudflare naming Rostelecom in writing: since 9 June 2025 its sites arrive cut off after the first 16 kilobytes — so you see half a page rather than a refusal. Our control measurement on 20 September from a Moscow data centre found no cut-off, and we explain honestly why that says nothing about your flat. Plus the Steam outage of 31 August, where three different causes were named, and what to check on your own line in a minute.
Someone else's network in a café, a hotel or an airport sees the names of the sites you open — even over HTTPS: the name leaves twice, once in the name lookup and once in the first packet of the encrypted handshake. We captured our own traffic: without a tunnel all four requested names went out in the clear, including a bank that never answered us; from inside a tunnel not one name left the wire in 29.7 seconds. What stays visible anyway, what HTTPS does cover, where the 130,000 public Wi-Fi access points in the news came from, and what we do not know.
Sometimes the only thing left open on a mobile network in Russia is a list of approved services — the government portal, banks, marketplaces. The ministry maintains that list, it holds more than 500 services, and it concerns the mobile network only: nothing changes on Wi-Fi. What the mode is and who builds the list, what was reported on 31 August and 4 September, what happens to our app in it (it will not connect — and we say so plainly), which Android system switch leaves the phone with no connectivity at all, and what we do not know.
Tele2, t2, Rostelecom Mobile, T-Mobile and SberMobile are one network under five brands. We have no measurements of our own on it and say so plainly instead of retelling somebody else’s parameter sets. What was measured on three other networks, why port 443 decides nothing, and how to check your own SIM in a minute.
Over Wi-Fi 97.6 % of “Connect” taps succeed in our log, on mobile data 93.0 %; of 351 people on Wi-Fi, one never connected. Why a VPN fails on Wi-Fi, what a router really does, and when the app moves to port 443.
Yota is a virtual operator on MegaFon towers. We never measured a Yota SIM, but we measured that network nine ways: the port is not what helps — the shape of the first packet is. What that means for your SIM and how to check in five minutes.
In our July measurement in Moscow, Beeline was the control network: the connection came up without mimicry and lived. Where the cause actually hides — and why Yota should be read as MegaFon.
The handshake succeeds and the flow dies after two or three seconds. How it differs from MegaFon and why changing the port does not cure it.
Nine measurements in Moscow: port 443 does not help, and 20 bytes with a real signature pass where 1200 random ones do not. Plus what speed you actually get.
Our measurements on Megafon, MTS and Beeline in Moscow: on one the connection never establishes, on another it dies after two and a half seconds, the third does not interfere. And why the advice “move it to port 443” does not work.
“YouTube is not working” is three different pictures: a connection error, a feed that loads while the video does not start, and a video that plays but stalls. How to tell them apart in five minutes, and four causes when the tunnel is on and YouTube is still silent. Our measurement of 29 September: YouTube’s addresses answered from all five of our machines, the Russian one included — and what that measurement does not say.
Messages sit on a clock icon and never arrive, the app says “Connecting…”. How to tell the phone from the network in five minutes, what WhatsApp itself says about VPNs, and what our measurement of 29 September showed: from the Russian machine WhatsApp’s addresses opened over IPv6 and not over IPv4, from the Dutch, Polish and German ones all of them opened. We did not measure calls, and we say so.
The character rubber-bands or never spawns while websites and video work — that is most often packet loss on the way to the game server. How to check for it on a computer, in the game and on a phone, how to tell that your provider is to blame, and our test to Valve’s relays: 500 packets each, direct and through every one of our exits.
The feed will not load, and with the tunnel on Instagram asks you to log in again. Three kinds of “not working”, six reasons why even the tunnel does not help, and our measurement: from our datacentre in Russia not a single IPv4 connection opened, while over IPv6 Instagram answered — and demanded a login.
The internet works, yet Discord is silent. How to tell “one app is silent” from “the network is down”, why Discord opens completely from our datacentre in Russia, and what volunteers see on home and mobile networks — from the open OONI test database.
Feeds load, videos play, sites open — but the messenger hangs on “Connecting…”, with the tunnel on, too. That is not what a broken app looks like but a break on the road to its servers: other sites open meanwhile, echo packets arrive, yet the connection is not established. Our measurement on 22 September from four machines: from the one in Russia the connection was never established — 21 attempts out of 21 against seven addresses, with a live echo and control addresses opening in the same minute; from the Netherlands, Poland and Germany all five addresses answered within fractions of a second. That is one address in one datacentre, not a portrait of the country. And separately — four reasons why the tunnel is on and the app is still silent.
“It does not open” comes in three flavours, each cured differently. Most often the service itself refuses and says so in plain words: to an address in Russia OpenAI answers “Country, region, or territory not supported”, Copilot answers with error 1009, and Claude redirects to a page that says the app is unavailable in your region. Gemini and DeepSeek, in our measurement from four addresses, answered everyone alike — the Russian address included — so the road and the country were not the problem. The third flavour is a “verify you are human” page: it is not about your country and changing country does not remove it. How to tell which one you have, and which of them settings can actually fix.
The check is not looking at you but at the address your request came from: when traffic leaves through a server, the site sees a datacentre address used by many people at the same moment — and plays it safe. Our measurement of 12 sites from four addresses in four countries turned up the inconvenient half: Avito, Wildberries, Ozon and DNS-Shop refused all four alike, the Russian address included, so the refusal was not about the country. What can actually be done: traffic that does not need the tunnel is better kept out of it, and that is what the “RU Apps” preset is for. Plus an honest line about what we do not promise — that the challenges will stop.
A clip stalls halfway, the quality drops to mush by itself, and in the next tab a speed test shows tens of megabits. There is no contradiction: YouTube’s own table recommends 5 Mbit/s for 1080p, so the width of the channel is there with room to spare, and the bottleneck is not in it but in how far those megabits get — a clip travels not “from YouTube in general” but from the nearest serving machine. A five-minute check that shows whose half of the way is at fault; what a private network changes here and what it does not; and our own measurement that night: the same clip pulled from four of our machines in different countries arrived at the same speed everywhere — almost exactly its own bitrate. Plus a separate look at the most annoying case: it buffers even with the tunnel on.
Mayak has a built-in ad and tracker filter — off until you turn it on. Where to tap in the app and in your account, which ad networks it cuts in our measurement of 19 September (Google, Yandex, mobile game ad modules, trackers), and which ads it leaves alone: in YouTube videos, social feeds, search and marketplaces. What may stop working, and what to check if the ads are still there.
Our test on the night of 16 September 2026: the home pages of 24 Russian sites from servers in the Netherlands, Poland and Russia. Russian Railways and Russian Post did not open from abroad but did from the Russian address; Gosuslugi, the banks and VK answered the same everywhere; Avito, Wildberries and Ozon turned away even a Russian data-centre address. Sign-in and apps were not tested. How to get a Russian address in Mayak, and why to switch off “RU Apps” abroad.
Ping in a game is the length of the path to the game server plus the loss along it, and a tunnel does not shorten the path. Our test on 16 September 2026: the tunnel itself added 1–2 ms, on a healthy path the detour through an exit adds 10–30 ms, and a gain comes only with loss or a roundabout route. Why ping passes through AmneziaWG, and Delta Force in players’ words — with the risk to your account.
Since April 2026 many Russian services refuse to let you in while a VPN is on the phone. What the service sees, how an app, a site in the browser and signing in from abroad differ, and how to send Russian apps past the tunnel. Our check on one phone: Gosuslugi and a bank app refused with the switch off and opened with it on.
“Always-on VPN” means Android itself keeps the VPN app running from boot; “Block connections without VPN” is a system kill switch. How to turn them on, what the convenience costs and how to set it up for Mayak.
Today's snapshot: what to install on Windows 11 and 10, Mac and Linux and which of it is checked with a live connection, what changed over the year, and what is really free on a computer.
The official places for AmneziaVPN and AmneziaWG on each system, what the Russian App Store has, how to check the publisher and the SHA-256 sum, and what to do with the download next.
Two clients, AmneziaVPN and AmneziaWG: which file to take for Windows, macOS and Linux, how to add a .conf file, and where Mayak's file is checked with a live tunnel and where not yet.
Instead of a ranking, eight checks on the Android phone itself: source, route choice, IPv6, connect time, ping through the tunnel, permissions, background work and a card-free trial. And how Mayak does on each.
TP-Link’s stock firmware knows OpenVPN, L2TP/IPsec, PPTP and, on some models, WireGuard — but not AmneziaWG. When OpenWrt is an option, how to check your model and when to leave the router alone.
Two safe places — Google Play and the service’s own site. How to tell the real app from a look-alike, what to check in an APK, why random sites are risky and what “free download” means.
A free iPhone client from LLC ITDEV, available in the Russian App Store, but with no servers of its own. What its page says, how to avoid a fake, where to get a subscription and five steps to add it.
The real Happ for Android is on Google Play and available as a file from its publisher, and it will take our link. What changes with Mayak's own app: no link to sign in, four connection attempts, plan slots — and when Happ still makes more sense.
Happ exists for Android TV and as a separate app for Apple TV, but not for Samsung or LG. How it takes a subscription from a phone, what happens to the link, and how Mayak's app with code sign-in differs.
A check of Apple's catalogue on 4 October: the real Happ is not in the Russian store, and a search for “happ” shows look-alikes, some with “Plus”. How to spot a fake, and three ways forward: INCY, another country's account, TestFlight.
Where the real Happ for computers lives, which of the nine files your system needs, how to pass it a subscription link in a minute, and why never to hand that link to strangers.
Three paths by phone type: Android with Google Play, Android without it, iPhone. Five questions instead of a ranking, installation, two settings that keep the connection alive, and what is special about Samsung, Xiaomi and Huawei — with links to the detailed guides.
How a laptop differs from a desktop: someone else's Wi-Fi, a hotel login page, sleep and the lid, internet from a phone. What to install on Windows, macOS and Linux, and what we checked ourselves and what we did not.
An APK installs only where Android is inside: Android TV, Google TV, YaOS. Four steps — the stick, a file manager, the “Unknown sources” permission, install — and what to do about “App not installed”. On Samsung and LG the file will not run.
Our file needs AmneziaWG 3 with header protection. The main KeeneticOS 5.1.6 does not know it; in the 5.2 Alpha 11 developer channel Keenetic reports version 3.1 parameters. A version table, import step by step, Entware, and honestly what we did not test.
One Happ file for both a Mac with an Apple chip and a Mac with Intel; five steps, what to do if macOS will not open the file, and how a MacBook copes with sleep. What we checked ourselves and what we did not.
Which Happ file to download for Windows 10 and 11 — x64 or ARM, five steps to a connection, and what to do if it will not connect. We checked Windows 11 with a live connection and Windows 10 not — and the article says so.
Mayak installs on a tablet with Android 7.0 or newer: from Google Play or as a file from our site, signing in with the same account as on your phone. What to do on a Huawei tablet without Google Play, whether Wi-Fi without a SIM is enough, how many devices a plan covers, and an honest word on iPad.
It will not install, will not connect or drops with the screen off: the reasons specific to a tablet — Wi-Fi without a SIM, an old Android, no Google Play, battery saving, a forgotten trial — and a five-minute order of checks.
Mayak installs on Redmi, Xiaomi and POCO from Google Play or from a file on our site. How to turn it on and off, and where Xiaomi keeps the autostart and battery settings that can kill the connection while the screen is off: the paths come from Xiaomi's help pages.
Mayak installs on Samsung Galaxy from Google Play or from a file on our site. What to do if you meant a TV, and what in One UI keeps the connection from holding in the background: sleeping apps, “Unrestricted”, Auto Blocker. The paths come from Samsung's help pages.
LG runs its own webOS, not Android: there is no Mayak app for it, and an APK file will not run. Two ways that work, with steps — an Android TV box and a router with AmneziaWG 3.0: what each costs and what we did not test.
A general guide for Android TV and Google TV: how to tell the system, install Mayak from Google Play or from an APK file, sign in with a code from your phone and what to do when there is no permission window. Separately on Sony, Philips, Kivi, Toshiba and Thomson.
Every TV in Xiaomi's Russian catalogue runs Android TV, and Mayak installs from Google Play. DEXP TVs run different systems, Salute TV among them: how to tell yours by its app store and which path to take — Google Play, a file through Sber's account page or a file on a USB stick.
Mayak is not in the YaOS Store, but Yandex allows APK files from a USB stick on the TV Station and on YaOS TVs. How to install Mayak step by step, why it will not work on a subscription device or the Module, and what to do then — a box, a router or the TV as a screen.
In the TCL and Haier catalogues for Russia every TV runs Google TV or Android TV, and Mayak installs on them. Where to find it on Google TV, how to install it from a file if the store does not show it, how to sign in with a phone code and what to turn on so the connection comes back by itself.
In the Hisense catalogue for Russia every current TV runs VIDAA or HomeOS, the new name of the same VIDAA. It is not Android, and the Mayak app does not install there. How to check your TV in a minute, what to do with VIDAA — a box, a router or the TV as a screen — and how to install Mayak on a Hisense with Android TV.
Mayak is not in Sber's catalogue, but Sber lets you install your own APK files from firmware 1.81. How to put Mayak on a SberBox or a Salute TV set via apps.sber.ru following Sber's own steps, how to sign in with a code from your phone, what happened on SberBox Top in version 0.7.39 and what we have not tested yet.
A connection is a server plus a client on your device. How the service’s app, a subscription link and a config file differ, whether Android, iPhone and Windows Settings will do without an app, what to install on a phone, computer, TV and router, and seven common mistakes.
On a computer it is a pair that works: a client and whoever provides the servers. How an app differs from a browser extension, five steps with Happ on Windows, Happ or INCY on Mac, an AmneziaWG settings file on Linux, and what Mayak has right now: no desktop app of its own yet, but you can already connect.
A VPN on the router puts the whole home through one tunnel. Which firmware accepts our file, seven OpenWrt steps from a live test in a virtual machine, Passwall2 with a subscription link, why stock Keenetic is not there yet, and why the whole home loses internet if the router is deleted from your account or access ends.
Mayak installs on boxes with Android 7.0 or newer — with or without Google Play. How to tell what is inside yours, how to install from the store or as a file, what is known about operator boxes, SberBox and Yandex, and our test: since version 1.0.0 Mayak on a box with plain Android and no touchscreen shows a QR code for signing in from your phone.
Huawei models released after May 2019 have no Google Play store. How to tell which case is yours, on which system the file from our site installs and on which it does not, and our test: on Android with no Google services, Mayak signed in, connected and updated from our site. Plus how to keep the phone from dropping the connection in the background.
Where a VPN is turned off on Android, iPhone, Windows and Mac when the app has no button. Why the whole internet vanished after you turned it off — the system option “Block connections without VPN” is to blame — and how to clear the “Disconnected from always-on VPN” notification.
On iPhone it is not an app alone that works, but a pair: a client from the App Store and a provider of servers. Our check of Apple’s catalogue on 23 September: INCY, Karing, Clash Mi and Shadowrocket are in the Russian storefront, Happ, Streisand, V2Box and Hiddify are not. How to tell the real app from a look-alike by its publisher, and how to connect in five steps.
Happ is installed, and there is nothing to connect to: it has no servers, a subscription comes from a provider. How a subscription differs from a key, why free keys die fast and what a stranger’s server sees, how to add the link step by step, what is going on with Happ in the Russian App Store — and what our link gives you.
There is no Mayak app for Samsung (Tizen) or LG (webOS), and we are not going to pretend otherwise: the config file from your account will not work on their firmware either. One path works — an Android TV box: Mayak runs on the box and the TV becomes its screen, at which point the brand of the TV stops mattering. The fallback is to watch from a phone or a computer plugged into the TV. Tethering from your phone and “setting it up on the router” will not help, and the article shows exactly why. Checking your own TV takes a minute: if it has Google Play on it, this article is not the one you need — the neighbouring one is.
Free services fall away almost always for one reason: they have a single path — one connection to one address, and the moment the network stops letting it through the app goes silent for everyone at once. Spare paths cost money every month, and they do not fit the economics of a free service. Six signs that show a working service before you install it; our own numbers for the connection steps over seven days; where to install the app from on Android and how the store build differs from the file on our site (including the honest part: the two will not install over each other); four settings of Android itself that break any secure connection — and what the app asks of the phone, and what it does not ask for at all.
The TV’s system matters, not the brand. The Mayak app runs on TVs and set-top boxes with Android TV; there is none for Samsung or LG. How to find out your TV’s system, how to install the app from Google Play or as a file from our site, how to sign in on the TV with a code from your phone, and why the code on the screen does not open your account by itself. How many plan slots a TV takes, and what we have not tested: a real TV and the store on it.
The server recognises a device by its key and remembers one address for it, so two phones with one key keep snatching the connection from each other. Our measurement: one device got 289 answers out of 289, two on one key went unanswered for 63–68 % of requests. How many devices a plan includes and what is cheaper — two accounts or the Family plan.
Is there a VPN that asks for no account, and what you lose when there is none: signing in from another phone, recovery, support that can find you. Four meanings of “no registration”, what an account gives, what Mayak needs to start and what we store.
Ads in a free VPN are a way to pay for servers. How to check an app before you pay: use it, look for a “remove ads” purchase, read Google Play's Data safety section and the App Store privacy label. What Mayak does: no ads in the app, and a separate filter for ads in other apps that does not remove everything.
Mayak has no day or week plan: payment starts at one month. Instead there are 3 free days after you confirm your email, no card. What to try in the trial days, what to do before a trip, and how a paid month differs from a “VPN for one day” from open lists.
A year pays off only if the discount pays back before the service stops suiting you: a pay-back table, the risks of paying ahead and what to check first. Mayak does not sell a year, only 1 or 3 months, and explains why.
Cheap means a low monthly price per device you use, not the number in the shop window. One formula, what cheap plans cut, the “from” and “lifetime” traps, and our price per device in five cases.
Instead of a ranking, seven hands-on checks for the trial days: devices, paying from Russia, mobile data, apps, refunds, support. Plus what to check on Android and where Mayak will not suit you.
An honest list of “free VPNs that work” cannot be made. Four kinds of free VPN and how you pay for each, how to check an app in ten minutes, and when free is enough and when it is not.
A free service, a free client with no servers, or a trial — who pays for the servers in each case. Five checks of the App Store page before installing, without listing other services.
The “per month” price is only the start: how to convert it to a year and to one device, what a subscription usually includes, and where the price differs from what gets charged. Our prices in a table for 3 months and per device.
There is no single “best” for everyone: on a TV the system inside it decides first. Seven checks that take an evening: an app for your TV, sign-in without a keyboard, plan slots, paid or free, a no-card trial. Our answers, with prices and dates.
A VPN service takes your carrier’s place and can see the names of the sites you visit. What “no logs” really means, why the company’s country matters, what free services pay with and six signs of a trap — and what our own privacy policy records and for how long.
Instead of a ranking, seven questions to put to a service before paying: how it earns its living, what it keeps, where the app comes from, how many devices, how to pay and cancel, whether there is a no-card trial, what happens when it fails. With our answers, prices and dates.
If a free trial asks for your card, you will most likely be charged at the end. What to find out before giving a card, how trials without a card, in a Telegram bot and Happ trial keys differ, and what to test on your own network in the free days: carrier, home, video, bank.
Deleting the app or the bot is not enough: a subscription is cancelled where it was set up. How to find where yours lives and cancel it in a bot or on a website, in Telegram Stars, in the App Store and Google Play, what your bank can do, and what Russian law says about getting money back.
No list of “what works right now” exists, and that is not a dodge: “works” is the outcome of three things meeting — the app, your network and this hour — not a property of a service, which is why it comes up for your neighbour and stays silent for you. There is one checkable sign that does tell services apart: how many ways the app has to connect, and whether it walks through them by itself instead of asking someone who is offline at that very moment. Our four attempts and the live numbers behind them over seven days — which paths carried 1,171 connections, and what those 294 records with no step at all really mean; where we honestly fall short, and how to check on your own networks in one evening rather than by somebody else’s list.
What is sold is a subscription to access for an account, not a key file — that is what section 1 of our payment terms says, and no separate “key” product appears there. The account has a nine-digit number, and the app creates a key for every device itself, on the phone. The plan is a number of devices working at once (3, 5 or 10), not speed and not traffic volume. How a place is taken and freed, why a reinstall is not a new device, what to do when you change phones, whether one subscription can cover a family, and what cannot be bought here at all — no key as a file, no lifetime access, no devices beyond the plan.
The plan price is 300 ₽ a month for 3 devices, 500 ₽ for 5, 700 ₽ for 10; the term is 1 or 3 months, and the cabinet shows the invoice total before you pay. From Russia people pay the ordinary way: by SBP or a Russian bank card, the invoice is raised in the account cabinet and the access extends itself. What you do not need: a foreign card, a messenger account or a bot, a live secure connection. Why a longer term is not cheaper here (the price is a plain multiplication, and we checked that in the code), what happens before the term ends, and what to do if the money left and the access did not arrive.
Paid and free services both connect — the difference is who pays for it and with what. Five questions worth asking any service before you pay: what it lives on, where to install the app from, how many devices, whether Russian apps will work and who answers when it breaks. Our answers with prices — and what money does not buy: a guarantee for tomorrow or money back for days already gone.
A tunnel does not save data, it adds it: every packet travels inside another one, and the wrapping goes over the network too. Our test on two production lines: the same 20 MB file cost 10.7 % and 10.1 % more through the tunnel than without it, and ten minutes of idling cost about 2 KB a minute, roughly 3 MB a day. Where the overhead comes from, what that is in gigabytes a month, what matters more than the tunnel, and how to measure your own usage.
Servers cost money. If you're not paying, the bill is settled with your connection, your browsing history, or ads injected into your pages. The documented cases, no scare tactics.
A reference to the texts of the rules: whom Article 15.8 of the Information Law, Articles 13.52, 13.53 and 14.3 of the Code of Administrative Offences and the Advertising Law address, which acts they name and which fines they set — with links to the texts.
H.R. 10364 by its text rather than its headlines: which VPN services a court could order to shut off a piracy site for the United States, within how many days, where the bill stands, what already happened in France, and what follows for a person in Russia.
In spring Russian media reported that mobile users would pay extra for foreign traffic above 15 GB a month — 150 roubles per gigabyte was named — and then that the launch had been put off. In July a deputy minister of digital development told the State Duma that such a fee is not being considered. A dated timeline of the reports, what 15 GB means in light of our measurement of tunnel overhead, how to check your monthly usage on Android, and what we do not know.
Part of the traffic through the VPN, part directly: splitting by app and by site, the “only selected” and “all except selected” modes, Android's rules, the split tunnel in Mayak and in Amnezia. And the trap with “Block connections without VPN”.
VLESS is a lightweight protocol from the Xray project that does not encrypt by itself and relies on TLS or REALITY. We take a vless:// key apart: why encryption=none is normal, what security, sni, fp, pbk, sid and flow mean, and how not to give the key away.
Setup starts with where the server comes from. Your own server versus a ready key or file, Android, iPhone (what the Russian App Store has) and split tunnelling by system.
An encrypted tunnel to someone else’s server — fine, but what changes, and for whom? We brought up a real connection: through the tunnel not a single packet went to the site on the outside, the site saw a different address — and one of four databases named the wrong country. Plus what a VPN is on a phone and what it does not do.
Measured the same way on two of our own networks: no difference in Amsterdam, 72% behind from Russia, and a win on a mobile carrier. Why the protocol was created, where it stands worldwide, and how to test your own road.
Every field of an AmneziaWG 3.1 config — and the measurement that showed which of them must match the server and which are yours alone.
Where 1420 and 1360 come from, how to measure your own limit with one ping command, and why AmneziaWG needs a few more bytes subtracted.
The same tunnel, twenty minutes apart: 2.91 and 41.98 Mbps. What a speed test actually measures, why back-to-back runs disagree by a factor of five, and six rules for measuring honestly.
A “connected” badge proves nothing. Four checks in a minute — address, traffic, DNS and IPv6 — and you know whether the tunnel works or merely looks like it does.
AmneziaWG is WireGuard with the outward shape of its packets changed. What exactly changes, why obfuscation does not make the encryption stronger, and what it costs.
Between “Connect” and “Protected”, the app can try up to three routes to the server and verifies each with a real request. How that ladder works.
A private network for Android: three routes to the server, automatic selection of the live one, and an honest label showing which one you’re on. 3 days free once you confirm your email, no card required.
🍎 The buttons above are about Android. On iPhone Mayak works through the third-party Happ app with the subscription link from your account. Happ is not in the Russian App Store; there INCY (publisher LLC ITDEV) works instead, checked on 22 September 2026: how to connect iPhone, Mac and Windows.
The account is created right in the app. A confirmed email opens the access — 3 free days. An email is optional: without one the trial is 1 day.
