When a site “won’t open,” the cause is rarely single-layer. Sometimes a page fails because of a regulator’s decision, sometimes because of ISP filtering, and sometimes the service blocks access by country on its own. From the outside it looks the same: an error, endless loading, or a “resource blocked” message.
Below is how the main blocking mechanisms work, at which network layer they apply, and why the same site can be unavailable for different reasons.
Two models: blacklist and whitelist
Most restrictions follow one of two principles:
- Blacklist — the internet is open by default; access is denied to specific addresses on a registry or ISP list.
- Whitelist — access is allowed only to approved resources; everything else is blocked automatically.
Russia long used a blacklist model: Roskomnadzor adds domains and IPs to a registry, and operators must filter them. The shift toward whitelists is a separate topic; see our guide to whitelists and internet restrictions.
Layer 1: DNS blocking
DNS translates a site name (e.g. example.com) into a numeric IP address. The simplest way to “turn off” a resource is to stop returning the correct answer to a DNS query.
What users typically see:
- the browser reports that the site can’t be found;
- sometimes an ISP landing page explains that the resource is blocked;
- apps may hang at the connection stage.
DNS blocking can be bypassed by sending queries through another DNS server or a VPN that replaces DNS entirely. But if IP filtering or DPI is applied downstream, changing DNS alone is not enough.
Layer 2: IP address blocking
If the server IP behind a site is known, the ISP can drop packets to that address. This blocks individual domains and entire hostings when several projects share one IP.
Key points:
- when a site moves to a new IP, the block temporarily stops working until the registry is updated;
- collateral damage — unrelated sites on the same hosting may break too;
- VPN servers also end up on IP blocklists — popular VPN address ranges are well known to providers.
Layer 3: DPI — deep packet inspection
DPI (Deep Packet Inspection) analyzes traffic content or metadata in real time. Equipment looks not only at IP addresses but also at headers, protocols, and connection fingerprints.
Why filtering systems use it:
- to block a resource even when it hides behind a CDN or changes IP;
- to detect and throttle VPN traffic by OpenVPN, WireGuard, and similar signatures;
- to apply SNI filtering — cutting HTTPS connections to specific domains by name in the TLS handshake (when it is not otherwise encrypted).
DPI is harder to bypass than DNS. You often need protocol changes, obfuscation, or a different route. Practical steps are in how to bypass VPN blocking and DPI and local bypass tools.
Layer 4: blocking on the service side
Not every “won’t load” case is ISP or government action. Many platforms restrict access themselves:
- geo-blocking — access only from selected countries (content licenses, taxes, local law);
- market exit — the service left a country and blocks sign-up, payments, or login from “unsupported” IPs;
- anti-fraud — datacenter, VPN, or foreign IPs trigger captchas, refusals, or limited features.
Example: a foreign streaming service sees a Russian IP and shows a different catalog or refuses payment — that is platform policy, not an “RKN block.” The reverse — a Russian service abroad refusing video to a foreign IP — is covered in Russian websites that don’t work abroad.
How it works in Russia: registry and operators
In the Russian model, the central element is the unified register of banned information (often called the Roskomnadzor registry). It can include:
- domains and URLs;
- IP addresses;
- sometimes individual pages or mirrors.
ISPs must enforce restrictions. In practice they combine DNS + IP + DPI. That is why a site may “work today and fail tomorrow” — providers and regions implement filters with different strictness and update delays.
Separately, there are app store blocks and payment-system limits — not network filtering, but users experience them as “the service doesn’t work.”
Carrier “white VPN” is not the end of blocking
Since 2025–2026, carriers have tested selective access to pre-approved foreign services — “white VPN” bundled with mobile plans. This is not lifting blocks in general, but routing to a short domain list. Everything not on the list is still filtered as before. See Beeline white VPN limits and alternatives.
Comparing mechanisms
| Mechanism | Where it applies | What the user sees | How hard to bypass |
|---|---|---|---|
| DNS | Domain name lookup | “Site not found,” ISP page | Relatively easy (VPN, alternate DNS) |
| IP | Route to server | Timeout, “no connection” | VPN to another IP; site IP may be blocked again |
| DPI | Traffic content/fingerprint | Drops, slow loads, VPN blocks | Protocol change, obfuscation, different service |
| Service geo-block | Platform server | “Not available in your region” | VPN with IP in the right country |
| Whitelist | Entire network | Only approved sites open | Not a “spot” bypass — the access model changes |
Why blocking is often not about security
Officially, restrictions are explained as fraud prevention, extremism, or “illegal content.” In practice, work tools, media, messengers, and educational resources regularly get caught — the mechanism is broader than narrow “user protection.” See why internet blocking is not about security.
What users can do
It depends on the type of restriction:
- ISP or registry DNS/IP block — VPN or proxy exiting where the resource is not filtered; check for DNS and IP leaks.
- DPI and VPN blocking — a service with multiple protocols, bypass modes, and server switching; see the VLESS guide.
- Geo-block — VPN with a server in the right country (foreign service from Russia — exit abroad; Russian service from abroad — server in Russia).
- Payment or account block — VPN does not replace a foreign card or identity verification; that is separate from network access.
Fully “shutting down the internet” is extremely hard in practice — see can the internet be fully restricted and can all VPNs be blocked. What matters is identifying which layer is failing — that determines whether changing DNS, using a full VPN, or switching exit country will help.
Summary
Website blocking is not one switch but a chain of decisions: registry or platform policy → ISP implementation (DNS, IP, DPI) → checks on the service itself. The same “won’t open” symptom can mean network filtering, geo-restriction, or payment refusal.
Once you know the mechanism, choosing a tool is easier: reliable VPN for local filtering; VPN with the correct exit country for Russian or foreign services. You can test your scenarios with a trial access before committing to a long subscription.