Noir VPN · Whitelist mode

Whitelist mode: how to tell mobile internet is in it, and why VPNs drop there

When mobile internet is "connected but nothing loads", yet Gosuslugi (Russia's government services portal) and your banking app open fine, the problem is usually neither the network nor your VPN. The carrier has switched traffic into whitelist mode. Below: how to check that in a minute, why almost every VPN drops in this mode, and what it takes for a connection to get through anyway.

30 July 2026 · updated 5 September 2026 · the Noir team

What whitelist mode is

Ordinary blocking works as a blacklist: everything is allowed except what is listed. Whitelist mode inverts that. Nothing is allowed except what is listed, and the filter sits at the IP level, before anything looks inside the packet. Your phone sends a request and it simply never leaves the carrier's network.

Three properties of this mode that matter in practice:

• The filter works on /24 blocks, not on individual addresses. If a block is allowed, every address inside it is reachable. So the question is always "which block", never "which server".
• It is neither nationwide nor permanent. In Moscow it comes in episodes of a few hours, in St Petersburg it is rare, and across most other regions it is close to permanent. The differences go down to individual cell towers.
• Every carrier keeps its own list. An address that gets through on MegaFon, one of Russia's four big carriers, may be closed on another. There is no single national whitelist you could work everything out from in advance.

How to check in a minute

The symptom that gives the mode away without any tools: ordinary sites and messengers will not open, while Gosuslugi, your banking app and the carriers' own sites work normally. If you want to be certain, there are two quick checks.

1. Ping lives, DNS does not. ping 8.8.8.8 goes through, while nslookup ya.ru 8.8.8.8 times out. In this mode external DNS resolvers are unreachable across the board and only the carrier's own resolver answers.
2. Wi-Fi works, mobile data does not. The restriction lives in the mobile network. If everything is fine over Wi-Fi but half the internet has disappeared on the carrier, that is it.

Why an ordinary VPN drops in this mode

Not because "the VPN was detected". The reasons are far more mundane.

UDP is dead, all of it

Not "QUIC got throttled", but UDP as a whole: DNS on port 53, QUIC, WireGuard on 51820. Anything built on UDP transport will not run in whitelist mode at all. That rules out WireGuard on the spot, along with most of the services built on it, including nearly every "fast" app in the App Store.

What is left is a very narrow set

Through a whitelisted address you get ICMP, TCP on ports 80 and 443, and usually TCP 22. In practice that means the transport can only be TCP, and only on those ports. There is no point configuring anything else.

Hiding the SNI is pointless

ECH and other ways of hiding the domain name inside the TLS handshake do not help here: the block sits at the IP level, and the packet never reaches the point where the domain name would matter at all. Disguise is still needed, but against ordinary DPI, which has not gone anywhere and runs in parallel, not against this filter.

What does work in this mode

Three conditions, all at once.

1. An entry point inside an allowed block. Either the server sits in a whitelisted /24, or the traffic comes in through infrastructure that is already on the list.
2. TCP on 443, and a protocol indistinguishable from ordinary HTTPS. This is where Reality works: the connection looks like a real TLS handshake with a real website, it needs no separate front domain, and there is no traffic type left to block it by.
3. Many routes, not one. This is the key part, and the part usually left unsaid. Carrier lists differ, they change, and a specific route stops working without warning. One route you have found is not a solution, it is temporary luck.

A word on ready-made lists of whitelisted subnets

If you decide to test your own server, the first thing you will find is a ready-made list of whitelisted subnets: those dumps live on GitHub, people fork them and build checkers on top of them. We built such a checker too: two public repositories, 141,664 /24 subnets once expanded.

Then we compared it against an empirical measurement (masscan across every Russian prefix, run through a SIM card sitting in that very mode) and got an unpleasant picture.

The caveat without which the numbers lie: "not confirmed by the measurement" is not the same as "the block is closed". The scan only sees blocks where something answers on port 443. A block with no public services has nobody to answer, so it honestly lands in the unconfirmed pile while still being allowed.

What we do about it

Noir keeps 36 bypass routes for whitelist mode, not one. When a specific route stops working, the bot hands you the next one and the connection holds. This is not magic and not "we beat the filter": it is a hand-maintained set of known routes, plus monitoring of which ones are alive today.

Straight about the limits: bypass traffic is metered separately from ordinary traffic. A subscription includes 50 GB of it per month, the trial 8 GB. The reason is simple: these routes cost more than an ordinary channel, and making them unlimited would multiply the price for everyone, including the people whose carrier never switches whitelist mode on.

Frequently asked questions

What is whitelist mode?

The carrier switches mobile internet from a blacklist to a whitelist: only what is explicitly listed is allowed, and everything else never leaves the carrier's network. The filter works on /24 blocks rather than domains, it is not on across the whole country at once and not on permanently, and different carriers keep different lists.

How do I check for whitelist mode in a minute?

Two signs together: ordinary sites will not open while Gosuslugi and your bank still work, and ping 8.8.8.8 goes through while nslookup ya.ru 8.8.8.8 hangs until it times out, because external DNS resolvers are unreachable across the board. If everything is fine over Wi-Fi but half the internet has vanished on mobile data, that is it.

Why doesn't an ordinary VPN (WireGuard, QUIC) work in whitelist mode?

Because in this mode the entire UDP transport is dead: DNS on port 53, QUIC, WireGuard on 51820. It is not that "the VPN was detected", it is that any UDP packet fails the filter along with all other UDP traffic. Only ICMP and TCP on ports 80, 443 and usually 22 survive.

What gets through whitelist mode at all?

Three conditions at once: an entry point inside an allowed /24 block, TCP transport on 443 that is indistinguishable from ordinary HTTPS, and several entry points rather than one, because carrier lists differ and change without warning. A single route you have found is luck, not a solution.

Can you trust the public lists of whitelisted subnets on GitHub?

Partly. We compared a public list (141,664 /24 subnets from two repositories) against an empirical measurement through a SIM card sitting in whitelist mode: of the 16,311 blocks inside the measured range, 2,743 were confirmed whitelisted, while 10,865 genuinely whitelisted blocks were not in the list at all. The scan cannot see blocks with no public services on port 443, which does not mean they are closed.

How does Noir get through whitelist mode?

We keep 36 entry routes running at once. When one of them stops working, the bot hands you the next live one: a hand-maintained set of known routes, plus monitoring of which ones are alive today. Bypass traffic is metered separately from ordinary traffic: 50 GB per month on a subscription, 8 GB on the trial.