VPN not working on Yota: it runs on MegaFon’s network, and that is the whole point

Yota is not a network of its own. It is a virtual operator with no towers: your phone actually works inside MegaFon’s network. We have never measured a Yota SIM — but we measured MegaFon’s network nine ways in Moscow, and that is exactly what tells you what helps on Yota and what does not.

Yota runs on MegaFon’s network

Russia has four physical mobile networks: MTS, MegaFon, Beeline and T2. Every other name printed on a SIM belongs to a virtual operator: it owns no base stations and rents somebody else’s. Yota is the largest of them — a brand of Skartel, a MegaFon company, running on MegaFon towers.

Everything practical follows from that. When your Yota phone cannot bring a tunnel up, the decision is made by the very same network a MegaFon subscriber sits on: same radio, same transport to the internet, same filtering rules.

What our measurements mean for Yota

Five findings, each paid for by a measurement where exactly one thing changed:

• A plain profile does not come up at all. Not slow, not flaky — there is no handshake whatsoever: a minute of «Connecting…» and that is it. At home over Wi-Fi the same profile on the same phone comes up in a second.
• Port 443 on its own does not help. We checked it with a profile that differed from the broken one by the port alone: same result, no connection. The «move to 443» advice travels around forums; it did not hold up here.
• The shape of the first packet decides. 1200 random bytes with no recognisable signature do not pass. Twenty bytes carrying a real STUN signature do — and then 109 Mbit/s flows. So the filter reads the content; the size means nothing to it.
• The server address has nothing to do with it. From the same phone a plain http:// request to our address times out, while a tunnel to that same address pulls over a hundred megabits. No address blocklist here — the protocol and the shape are what differ.
• Over IPv6 everything comes up with no masking at all. The very profile that never connected over IPv4 came up in a second over the sixth version of the protocol. One difference: the road to the server.

All the numbers, tables and caveats are in the MegaFon write-up. The one takeaway here: on MegaFon’s network the cure is not the port but the shape of the first packet — so on Yota, too, look for an app that can change that shape instead of turning port numbers.

Where a virtual operator can still differ

«Expect the host network’s behaviour» is a rule of thumb, not a guarantee. The radio is shared with the host, but the way out to the internet can be the virtual operator’s own: its own APN, its own NAT, its own address range. So the picture may diverge, and it pays to look at the failure signature rather than the name on the SIM:

• never comes up — MegaFon’s signature, and therefore the expected one for Yota;
• comes up and dies after two or three seconds — that is MTS: there they cut an already established stream;
• comes up, stays up, but there is no internet — the operator is probably not to blame, five reasons why.

And one caveat so two different things do not get mixed up: a tethering limit, if your plan has one, is about sharing Wi-Fi from the phone — not about whether a tunnel comes up. They break differently and they are fixed differently.

A five-minute check: is this your picture?

1. Compare against Wi-Fi. Same profile, same phone. Comes up on Wi-Fi and not on mobile — it is the network, not your settings and not your account.
2. Leave the port alone. This is our own measurement, not an opinion: the port alone changed nothing.
3. See where exactly it breaks — by the three signatures above. Those are different illnesses with different cures.
4. Do not trust the icon. «Connected» proves nothing about traffic — four checks in a minute.

What to do when Yota will not connect

1. Use an app that changes the shape of the first packet. In our measurements that was the only thing that worked on this network. Turning the port by hand was not.
2. Let it walk the routes. Mayak starts with IPv6 — the very road on which everything came up with no masking — how the walk works.
3. If it did not help and the signature is a different one — go back to the signatures section: the operator’s filter is probably not your problem.