At home everything comes up in a second, and on mobile data the connection either never establishes or establishes and dies a couple of seconds later. It is not a broken phone and not “bad signal”. Below are our own measurements on three carriers in Moscow: what exactly happens on each of them, why changing the port does not help while masking does, and what to do.
What is actually going on
A home provider usually passes the connection through as it is: what is inside is none of its business. A mobile carrier is different — its network carries equipment that looks at the shape of passing packets and decides on the very first bytes. No decryption is needed for that: for many protocols the first bytes and the lengths of service packets are constant, so the protocol is recognised from the first packet (we took this apart in “AmneziaWG vs WireGuard: what the difference is”).
From there two outcomes are possible, and we have seen both.
What the measurements showed
The measurements were made in Moscow, on live cellular networks, at the end of July 2026. The same app, the same server; the only thing that changed was the masking setting.
| Carrier | Without masking | With masking |
|---|---|---|
| Megafon | does not connect at all: no handshake, a minute of “Connecting…” | connects and works: 117 Mbit/s down, 22 up, idle ping 76 ms |
| MTS | the handshake goes through, but traffic dies after two or three seconds | works |
| Beeline | works | works: 76.8 Mbit/s down, 48.3 up, idle ping 88 ms |
Beeline matters here no less than the others even though everything worked on it: it was the control. If masking broke a carrier that was fine to begin with, that is exactly where we would have seen it. It did not.
The port is irrelevant — it is about masking
The most common advice on the internet is “move it to port 443, ordinary HTTPS goes there, they will leave you alone”. We checked that advice with a separate measurement, and it does not work.
On Megafon the same connection on port 443 but without masking failed exactly as it did on an ordinary port. With masking it came up and delivered 117 Mbit/s. The conclusion is simple: what is being looked at is not the port number but how the packets themselves look. The port is the address on the envelope; the decision is made from what the envelope looks like from the outside.
A second observation comes from the same run. A plain HTTP request to the very same server did not get through on Megafon — it timed out — while a masked tunnel to that same server did get through and worked. So the server address is not on any blocklist: the filter works on the protocol and the shape of the traffic, not on where you are going.
Megafon and MTS break it differently
The difference is worth knowing, because the symptom tells you what is happening.
- Megafon cuts earlier and harder. There is no handshake at all: the app shows “Connecting…” for a minute and gives up. The connection never gets to happen.
- MTS lets the beginning through. The handshake passes, the tunnel comes up, the “Protected” badge appears — and two or three seconds later traffic stops. From the outside that looks like “connected, but no internet”, and we have a separate write-up for that symptom: “Connected”, but no internet.
The same config: works on 4G, fails on 4G+
A separate observation worth keeping in mind: on Megafon the same setting on the same SIM behaved differently depending on the network mode. On 4G+ the connection did not come up; the phone switched to 4G by itself a couple of seconds later — and the same connection came up.
We do not know for certain why: the modes may use different gateways and different equipment along the path. But there is a practical takeaway: if it will not connect and the network indicator shows 4G+ or 5G, it is worth waiting for a switch or trying again a little later before concluding that the app is at fault.
There are only four networks in Russia
Knowing this saves time. There are four physical mobile networks in Russia: MTS, Megafon, Beeline and Tele2 (also known as t2, also Rostelecom mobile). Everything else is a virtual operator on someone else’s towers:
- Yota — on Megafon’s network;
- T-Mobile (T-Bank) and SberMobile — on Tele2’s;
- Tele2 = t2 = Rostelecom mobile — one and the same network under different names.
So if you are on Yota, expecting Megafon’s behaviour is reasonable. But reasonable to expect, not “guaranteed”: a virtual operator may have its own gateway, and filtering can differ from the host network. We did not measure Yota separately, and we did not test Tele2 at all — and we will claim nothing about them.
What to do
If it will not come up on mobile data — in order, top to bottom:
- Update the app. Masking is on by default in recent builds; older ones cannot do it at all, and on Megafon and MTS that alone decides everything.
- Do not turn off “Use IPv6”. Since August the app first tries to reach the server over a newer-style address, and on Megafon that path behaves differently from the familiar one: in our measurement on 23 August the connection came up in 0.9 seconds where the ordinary path without masking would not come up at all. That is a single measurement, on one phone, in Moscow — we are not putting it in the table above. But the practical point stands: turning this switch off deprives the app of an attempt that may be the only fast one on your carrier.
- “Settings” → “Check the connection”. The app goes through every way of connecting in turn and tells you which one fails for you. A minute of your time instead of guessing.
- If the direct route never works on your carrier — turn on “Always use the backup channel”: the connection takes the detour straight away instead of spending time on a direct attempt.
- Try another country. Routes to different countries differ, and what does not get through to one often gets through to another.
The main thing from this whole article: it is not about the port and not about the server address, it is about how the traffic looks. That is why “change the port” does not help and masking does.
Short answers
Why does it work on Wi-Fi but not on mobile? A home provider usually passes the connection through as it is, while a mobile carrier looks at the shape of the packets and gets in the way of the ones it recognises.
Will switching to port 443 help? On its own, no — measured: the same connection on 443 without masking failed, with masking it came up.
Is the carrier blocking the server address? In our measurement, no: plain HTTP to the same server did not get through, while a masked tunnel did.
Are Yota, SberMobile and T-Mobile separate carriers? No, they are virtual operators: Yota on Megafon’s network, T-Mobile and SberMobile on Tele2’s.
Do your numbers hold everywhere? No. Everything was measured IN MOSCOW, at the end of July 2026. In another city and another month the picture may differ — which is why we say where and when we measured.