On MegaFon mobile data a tunnel either fails to come up at all — a full minute of “Connecting…” — or comes up in a second and runs at full speed. Exactly one thing separates those two outcomes, and it is neither the port nor the server address. Below are our own measurements taken in Moscow on 28 July 2026: nine profiles in a row, each changing exactly one variable.
What actually happens on MegaFon
A plain profile (port 51820, no mimicry) on MegaFon mobile data does not connect at all: there is no handshake, the app shows “Connecting…” for a minute and gives up. That is different from what we saw on MTS, where the handshake succeeded and traffic died two to three seconds later — the MTS case separately. MegaFon cuts earlier and harder: it never gets as far as a connection.
The very same profile on the very same phone comes up in a second over home Wi-Fi. So it is not the phone and not the settings — why a mobile network behaves differently from a home one.
Port 443 does not help — measured separately
The first advice you will find anywhere is “move to 443, that is where the whole web
goes”. We tested it directly: the noise-443 profile differed from the broken one
by the port and nothing else.
| Profile | Port | Mimicry | Result |
|---|---|---|---|
baseline |
51820 | no | ✗ never connects |
noise-443 |
443 | no | ✗ never connects |
quic |
443 | yes | ✅ 117 Mbps |
quic-hi |
51822 | yes | ✅ 127 Mbps, in a second |
The reading is unambiguous. Port 443 without mimicry did not help. Mimicry on an ordinary high port 51822 worked, and worked faster than on 443. The port means nothing; what the first packet looks like means everything.
They look at the content of the first packet, not its size
Next question: does mimicry help because it changes the packet size, or because it changes
a recognisable signature? One measurement separates the two. The rand-big profile
sent 1200 random bytes — exactly as many as the working variant, but with no signature
at all.
rand-big, 1200 bytes, no signature — does not connect;sip-hi, ~150 bytes carrying a real SIP signature — connects;stun-hi, 20 bytes with a STUN signature — connects, 109 Mbps down, idle jitter 6.
Twenty bytes with a recognisable signature pass where 1200 random ones do not. The filter therefore reads the content of the first packet and is indifferent to its size.
The server address has nothing to do with it
A separate check answering “maybe our server is simply blacklisted”. From the same phone
on the same MegaFon SIM: a plain http:// request to our address does not go
through (ERR_TIMED_OUT), while a UDP tunnel to that same address works and
pulls over a hundred megabits. The address is not on a list — what is being told apart
is the protocol and the shape of the traffic.
Over IPv6 the same profile comes up without mimicry
One more separating measurement: the v6-baseline profile — the very one
that never connected over IPv4 — came up over IPv6 in a second and with no
mimicry whatsoever. Exactly one thing differed: we reached the server over the sixth
version of the protocol. Together with the previous finding, this is why Mayak tries IPv6
first.
What you actually get on MegaFon once it is up
Measurements from a single day, Moscow, 4G+:
- with mimicry on a high port — 127 Mbps down, 27.9 up, idle ping 71 ms;
- through our production exit in the Netherlands — 96.9 down, 35.5 up;
- with no tunnel at all (control) — 139.5 down, 20 ms latency.
The drop from 139 to 97 is the price of the leg to the Netherlands and back, not throttling. ⚠️ And one caveat that cost us a whole investigation: on a mobile network a single measurement proves nothing. Two consecutive runs on one tunnel that day returned 2.91 and 41.98 Mbps — why speed tests show different results.
What to do when MegaFon will not connect
- Do not change the port. The measurement above shows it does not cure anything.
- Check whether it comes up over Wi-Fi. If Wi-Fi works, the problem is the mobile network, not your phone and not your account.
- Let the app walk its ladder. Mayak tries the paths itself and shows which one you are on — how that works.
- Make sure the connection is genuinely up. A “connected” badge proves nothing — four checks in a minute.
Short version: on MegaFon what decides is the shape of the first packet. Port, packet size and server address were each checked by a separate measurement and none of them changes the outcome.