Why banks, Gosuslugi and Russian sites do not work with a VPN — and how not to turn protection off for one app

Everything loads, mail arrives, video plays. But your bank app or Gosuslugi, the Russian government services portal, will not let you in. Turn protection off — it works. Turn it on — it does not again. Your phone is not broken, and this is not a coincidence.

What changed in April 2026

If your bank app used to work fine with protection on and now it does not, you are not imagining it. Here is what was reported:

• On 16 April 2026 Vedomosti reported that large Russian services had started restricting access to their apps and sites for people with a VPN on. Before, the paper says, companies warned about possible glitches; now they do not let people in at all. The paper retells the message people see at one of the services like this: access is impossible “due to the restrictions in force”, it is “a requirement of the regulator”.
• On 27 April, Kommersant and CNews report, the Ministry of Digital Development explained it by data security. The CNews list covers government online services, banks, marketplaces and aggregators.

How exactly each service finds out that you have a tunnel on is not described in these reports. We do not know either: we cannot see other companies’ settings and will not guess. But the way the network works shows where such a sign can be noticed at all.

What the service sees: an address, not you

With protection on, the phone sends its traffic to our server, and from there it goes out to the internet. The bank’s service receives the request from the server’s address, not from yours. That address has two noticeable marks:

1. The country. If the server is in the Netherlands, to the service you are a visitor from the Netherlands. Russian services often refused foreign addresses or asked for extra confirmation even before.
2. Whose address it is. Server addresses belong to companies that rent out servers, not to home internet providers or mobile operators. Public address databases show this.

There is a third place where the tunnel shows: the phone itself. On Android an app has a standard way to ask the system whether a secure connection is up on the phone. A site in the browser has no access to that system sign. Whether particular services use it, we do not know.

A simple consequence follows: a site in the browser and an app on the phone may be checking different things, and the same service may behave differently in each.

An app, a site or abroad: each case has its own answer

Before changing anything, work out which case you have. They are solved differently.

Case 1. You are in Russia and an app will not open: a bank, Gosuslugi, a marketplace. The app does not have to go through the tunnel at all: let it go directly, over your usual address, as it would without protection. The rest of the traffic stays in the secure connection. That is split tunneling; how to turn it on in Mayak is in the next section, and what it did on our phone is in the section about the check.

Case 2. You are in Russia and a site will not open in the browser. To the phone, a browser is one app. If it goes through the tunnel, all sites go through the tunnel at once, and you cannot pick out one site that way. Browsers are not part of our list of Russian apps. Your options:

• turn protection off while you sign in and turn it back on;
• open the same service in its app and send the app past the tunnel (case 1);
• choose the “Russia” location if it is in your list of countries. The site will see a Russian address, but it is a server’s address, and the “whose address” mark does not go away. We have not checked this with Russian services, and it may not help.

Case 3. You are abroad. Split tunneling will not help here: your usual address is foreign by itself, and an app sent past the tunnel reaches the service from abroad. Only the “Russia” location can give you a Russian address (what it is). We tested the home pages of Russian sites from abroad and from a Russian address: banks and Gosuslugi showed no difference, and some shops turned away even the Russian server address. We have not tested signing in or apps with it: the address will be Russian, but still a server’s.

Case 4. A site says a VPN is on, but you turned it off. Check three things:

• Whether another app is holding the tunnel. Android allows one such connection per phone, and it may be held by a program you installed long ago and forgot. Find the “VPN” section in the phone settings and see what is marked there. More — in the piece about the forgotten app.
• Whether the browser itself has a protected mode on. Some browsers can send pages through their own server — with a built-in VPN or a data saving mode.
• Which address the site sees. Address databases are sometimes wrong, and your operator’s address may be listed in the wrong country or under the wrong owner. How to see your address the way a site does — the first check in this piece.

How to send Russian apps past the tunnel in Mayak

The Mayak app has a ready-made list for this.

1. On the home screen, above the connect button, there is a strip with the name of an app set and a switch. If it says “RU Apps”, turn the switch on. If the name is different, tap it, mark “RU Apps” with the “default” label and tap “Select”.
2. Disconnect and connect again: the set is applied on the next connection, and the app does not drop a connection that is already up by itself.
3. That is it. Russian apps from the list go directly, everything else goes through the secure connection.

Worth knowing:

• The switch may already be on. On first launch the app checks which country you go online from, and if it is Russia and you have not touched the switch yourself, it turns the list on by itself and tells you so.
• The set will not help when mobile internet is limited to a list of approved services. It splits traffic once the tunnel is up, and in that mode the tunnel will not come up at all — why that is, and what does work then.
• You do not have to build the list by hand. We compile it, the app gets it from our server, and on your phone only the installed apps from it are applied.
• The app you need is not on the list? Tap the set name (or “Settings” → “Split tunneling”), pick “RU Apps” and tap “Edit”. A list of apps opens with the Russian ones already marked; mark yours and save. An honest caveat: what gets saved is your copy, and it is the copy that will work, because only one set is active at a time. The copy remembers the marked apps and does not update together with our list: a Russian app you install later has to be marked by hand. To go back to our list, choose “RU Apps” with the “default” label again.
• No strip on the home screen? It has been hidden. Turn on “Show presets on the home screen” in “Settings”.
• What it means for protection. An app sent past the tunnel travels the same way it would without Mayak: over your usual address, through your operator. The bank app keeps its own encryption, but the operator sees which service you are contacting — just as without protection. Everything else on the phone still goes through the secure connection.

The same in brief — in the help centre.

What we checked on our own app

On 13 September 2026, in Russia, on one Android phone with Mayak. We were not testing the services themselves but our own feature: does a Russian app let you in when it goes past the tunnel. We took two apps — Gosuslugi and the app of one Russian bank — and opened each twice: Mayak on, exit in the Netherlands, the “RU Apps” switch first off, then on.

What follows from it. For these two apps on this phone the refusal went away with one switch; there was no need to turn protection off entirely. That is exactly what this article claims, and no more.

What this check does not say. It is one phone, two apps and one day. We did not record the network (operator or Wi-Fi), the Android and app versions or the exact refusal text, so we do not name them. We do not name the bank either. Another bank or another service may check differently, and what opened on 13 September may stop opening if the service changes its check.

What to do: a one-minute order

1. Work out the case: an app or a site, in Russia or abroad (section above).
2. An app, you are in Russia — turn on the “RU Apps” switch, then disconnect and connect again.
3. The app is not on our list — mark it in your copy of the set (how — above) and reconnect.
4. A site in the browser — open the same service in its app or turn protection off while you sign in.
5. It says “VPN is on”, but it is off — check in the phone settings which app is holding the tunnel.
6. You are abroad — try the “Russia” location if it is in your list of countries. We have not tested signing in or apps with it, and it may not help everywhere.
7. Nothing helped — write to us: the name of the service, what the screen says and which case is yours. Such messages are the only way to learn what changed at the service.

What we do not know

We try to make sure no more can be read out of our text than there is in it.

• How a particular service recognises the tunnel. It is not described publicly, and we cannot see other companies’ settings. A service can change its check on any day.
• Whether an app sent past the tunnel notices that the tunnel is still up on the phone. We have not checked this separately. Gosuslugi and the bank opened in our check, but a service that looks at the phone itself may behave differently.
• Whether the “Russia” location helps. We have not tested signing in or apps with it, neither in Russia nor from abroad. From abroad we measured only the home pages of Russian sites.
• How sites in the browser behave. We checked only apps.
• We have no full list of services with restrictions. We will not compile one from rumours.
• How it will go for you. Our check is one phone, two apps and one day; the network and versions were not recorded.
• We have not checked iPhone or computers. We have no app for them.

Short answers

Why does Gosuslugi not work with a VPN? With protection on, Gosuslugi sees the server’s address instead of yours — a foreign one, or one belonging to a company that rents out servers. Since April 2026, Vedomosti and Kommersant report, many Russian services refuse to let you in in that case. The Gosuslugi app opened in our check when it went past the tunnel; the site in the browser is easier to open with protection off.

Why do apps fail with a VPN while sites open? One possible reason: an app on the phone can ask Android whether a tunnel is up, and a site in the browser has no access to that sign. So the same service may behave differently in the app and in the browser. How a particular service checks, we do not know.

Why do some sites not work with a VPN while others do? The site decides. Some Russian services introduced a restriction, others did not, and foreign sites usually do not care about your country.

A card payment does not go through with a VPN on. What do I do? We do not know how your bank checks a payment. The simplest way is to pay with protection off or from the bank app sent past the tunnel.

A site says a VPN is on, but it is off. Most likely another app is holding the tunnel: Android has one such connection per phone. Look at the “VPN” section in the phone settings. If it is empty, check the browser’s built-in modes and which address the site sees.

I turned on “RU Apps”, and the app still refuses. Check that you reconnected after turning it on: the set is applied on the next connection. Then check that the strip says exactly “RU Apps” and not your own copy without that app. If all is so and the refusal remains — write to us with the app’s name: it means this service checks something else.

Does this mean using a VPN has been banned? CNews on 27 April 2026 quotes the Kremlin as saying on 15 April that there is no ban on using such services in Russia. The point is that services do not let you in while the tunnel is on.

Will choosing another country help? To Russian services any foreign country is equally foreign. Only the “Russia” location gives a Russian address, and it is still a server’s address; whether it helps, we have not checked.

I am abroad and a Russian bank will not let me in. Sending the app past the tunnel is useless: your usual address is foreign anyway. What is left is the “Russia” location, if it is in your list of countries — with the caveat that we have not tested signing in to a bank with it. The home pages of five banks opened the same way in our test, both from abroad and from the Russian address.

Is it safe to send a bank past the tunnel? The bank app encrypts its own connection. Past the tunnel it travels the same way it would without our protection, and the operator sees that you are contacting the bank. Everything else on the phone stays in the secure connection.

And on iPhone? We have no iPhone app yet, and we have checked nothing there. The general way is to turn protection off while you sign in to the service.