Bypassing blocks and DPI (Windows and Android)

What DPI is and how censors use it

DPI inspects not just where packets go but how they look and behave. It can examine headers, handshake patterns, TLS fingerprints, Server Name Indication (SNI), packet sizes, and flow timing to identify protocols.

In Russia, ТСПУ (TSPU) boxes at ISPs use DPI to detect and interfere with traffic that matches known VPN signatures. When a match is found, the system can throttle, block, or reset connections.

Because DPI focuses on recognizable patterns, connections that reveal protocol-specific traits are more likely to be flagged, especially during the initial handshake.

Why ordinary VPNs get blocked

Many standard VPNs have distinctive handshakes or predictable traffic shapes. Classic OpenVPN, IKEv2, or even vanilla WireGuard can expose telltale markers such as fixed handshake sequences, characteristic packet sizes, or use of specific ports that DPI can key on.

Some censors also use active probing: when they suspect a VPN service on an IP/port, they attempt to connect and verify the protocol. Signature lists are updated over time, which is why a server or port that worked yesterday may fail today.

The result is that ordinary VPN sessions can be throttled or dropped mid-handshake, forcing users into a cycle of switching ports, servers, or protocols.

How Tunari helps resist DPI

The Tunari apps for Windows and Android support multiple protocols so you can choose what works best on your network: WireGuard (default, fast), AmneziaWG, VLESS+Reality, OpenVPN and IKEv2. For censorship resistance, the key options are AmneziaWG and VLESS+Reality, both available on Windows and Android. On iOS, Tunari connects via WireGuard.

AmneziaWG is a censorship-resistant variant of WireGuard. It is designed to change how WireGuard traffic appears on the wire, reducing reliance on the static signatures DPI tools look for. See our AmneziaWG deep-dive for more detail.

VLESS+Reality, offered in the Windows and Android apps, is built to make VPN traffic look like ordinary HTTPS/TLS. To DPI, flows resemble a regular encrypted web session, which helps avoid blocks that target recognizable VPN handshakes or UDP patterns.

In our tests, these modes have helped maintain connectivity on TSPU-filtered networks in Russia, but no method is guaranteed to work everywhere or forever. Network conditions and censorship tactics change.

Using Tunari in practice

On iPhone, Tunari uses WireGuard with ChaCha20-Poly1305. The current iPhone app shows connection status and has no Kill Switch setting; full traffic blocking during interruptions is not guaranteed.

Tunari stores account and device identifiers, server and protocol details, session identifiers, public WireGuard keys, timestamps, traffic counters, connection results and errors, app version, IP address and country. It also records first-connection and trial events for its own service analytics. Read the Privacy Policy at /en/privacy-policy.

Available locations, supported apps, device limits, prices and any trial eligibility are shown on the download and pricing pages or in your account. Check the terms shown for your chosen platform and payment method; access to every website or network is not guaranteed.