“I am on Rostelecom and it does not work” covers three completely different networks. Until you know which one is yours, any advice misses: a setting measured on a cable has nothing to do with a SIM card, and even less with someone else’s Wi-Fi in a café.
In short. First work out which network you are on: home cable is Rostelecom’s own wired network, a “Rostelecom” SIM card is the Tele2 network, and Wi-Fi carrying its name in a café or a clinic is someone else’s public network. We have no measurements of our own on any of them, and we are not going to invent any. What we do have is Cloudflare naming Rostelecom in writing: since 9 June 2025 its sites arrive at Russian ISPs cut off after the first 16 kilobytes — and half of “the VPN broke” looks exactly like that. What actually decides, we measured on other networks: the shape of the first bytes of a connection, not the port number. That is why the app does not hunt for “Rostelecom settings” but tries four routes in turn, and you can check your own line for free in a minute.
We build Mayak. The app never asks who your ISP is: it walks four routes by itself and marks honestly on screen which one you are on. 7 days free after you confirm your email, no card needed. The trial is free and needs no card; without an email it is 3 days.
🍎 On iPhone Mayak works through the third-party Happ app — with the subscription link from your account. Happ is not in the Russian App Store; there incy (publisher LLC ITDEV) works instead, checked on 22 September 2026.
Three different networks share one name
This is not nitpicking about words: it decides whether any given advice applies to you at all. Look at where your internet is coming from right now — this article is about the first row, and the other two have write-ups of their own:
| What you have | What the network actually is |
|---|---|
| a cable and a router at home | Rostelecom’s own wired network — the subject below |
| a “Rostelecom” SIM card | the Tele2 network (also t2), with its own write-up |
| Wi-Fi in a café or a train | someone else’s public network, with its own rules |
Why the SIM card is Tele2. Rostelecom owns Tele2, and mobile service under its brand runs on the same towers. T-Mobile and SberMobile live on that network too. So “it works on neither home nor mobile Rostelecom” is not one problem but two — a wired network and a cellular one — and they have to be worked out separately; for the second one we have a separate Tele2 and t2 write-up.
Why public Wi-Fi is on the third row. By Rostelecom’s own press release, circulated on 14 September 2026, at the end of 2025 the group was servicing almost 130 thousand public Wi-Fi access points (excluding the digital-divide programme). So “the Rostelecom network” may well be the network in the café you joined five minutes ago rather than your own cable — and that is a different conversation, set out in what the network owner sees.
What we do not know about Rostelecom networks
Plainly and up front: we have not a single measurement of our own on Rostelecom networks — neither on the cable nor on the SIM. And there is nowhere for one to come from: our connection log records only the type of network — Wi-Fi or cellular — not whose it is. We do not count by ISP and keep no lists of “where it works and where it does not”: any such claim would be an opinion, not a measurement.
We could have left this out. The internet is full of ready-made parameter sets “for Rostelecom”; retelling them is easy, and the article would read more confidently. But a retold set of numbers is a rumour, not a measurement: there is no way to tell which city it was taken in, which month, or whether it still holds today. We have already been wrong twice on our own measurements and we know what a confident tone costs: once we decided the filtering was stricter on 4G+, and the culprit turned out to be a weak signal in a back room; another time we decided our address was being throttled, and half an hour later got full speed in the same spot. Both guesses were rejected by re-checking — and that was with measurements we took ourselves, by hand.
There is no reliable public comparison of “which ISP is stricter”. We looked. There are scattered field reports — for instance a discussion opened on 14 November 2025 that names Rostelecom among home ISPs and says one particular kind of secure connection over port 443 fares worst there. That is someone else’s observation, not our measurement, and we mark it as such. We will not build “use these numbers” advice on it.
What has been said about Rostelecom by name — and not by us
There is one case where Russian networks were named outright, and not by a forum but by the company whose servers deliver a noticeable share of the web. On 9 June 2025 Cloudflare published a note saying its traffic in Russia was being throttled, and listed the networks: Rostelecom, MegaFon, VimpelCom (Beeline), MTS and MGTS. In its own words, the throttling lets users load only the first 16 kilobytes of any web asset, “rendering most web navigation impossible”, and it does not depend on how you connect — HTTP/1.1, HTTP/2 and HTTP/3 are all affected.
Why this matters to someone who has concluded the app is broken. Sixteen kilobytes is the beginning of a page. You do not see a refusal, you see half of one: text appeared, fonts did not arrive, images hang, the button does nothing. A poor connection, a crowded Wi-Fi and a dozen other things look exactly the same. From inside a browser window these cases are indistinguishable — which is precisely why they are so easy to mistake for a broken app.
Our measurement — and, more importantly, what it does not prove. On 20 September 2026 we downloaded a large Cloudflare-served file three times in a row from our server in a Moscow data centre. Each time 87,533 bytes arrived in full, in 0.24 seconds; from a second Cloudflare address — 86,603 bytes. No cut-off at 16 kilobytes. We measured the same thing from the same machine on 11 August — same file, same 87,533 bytes.
🔴 And here is what that measurement does not prove: your home may differ. Our server sits in a data centre, and Cloudflare was writing about home and mobile users. A data centre and a flat are different parts of the network, and a result cannot be carried from one to the other. The only thing our measurement says honestly is “there is no cut-off in our data centre”. About your building it says nothing, and we are not going to pretend otherwise.
By the way a tunnel is built, such a site should open normally while the connection is up: what leaves your line is one stream to one address, not a request to Cloudflare. But we have no measurement of our own on a Rostelecom cable, so we promise nothing — this is exactly the check worth doing yourself in a minute.
The Steam case: it failed for many, and three causes were named
A recent case that shows why we are in no hurry to name a cause. On 31 August 2026 the Steam gaming platform stopped opening for Rostelecom subscribers: on launch the store went into an endless load. By nine in the morning more than 1,600 people had complained on Downdetector.
It gets more interesting. Rostelecom itself said in comments on VK that it does not block access to resources, and named a powerful attack on its network as the cause; later the regulator reported a malfunction. This is a retelling of a report by The Moscow Times dated 31 August 2026 — we were not there, we have no measurements of our own from that day, and we are not taking sides.
What matters here is different: that day a person saw exactly what they see during any interference — a hang. The cause was argued about for days, and the versions differed. So the first sensible move is not to change settings but to separate “everyone” from “me”: open the same site over mobile data, ask a neighbour, check whether others are complaining. If it fails for everyone at once, there is nothing to fix — it will pass on its own.
The shape of the first bytes decides, not the port number
Since we have no Rostelecom measurements of our own, let us state what we did measure — the mechanism. The test changed exactly one thing at a time. On an ordinary port without masking the connection did not come up at all; moving that same connection to port 443 changed nothing — it still did not come up. With the first bytes masked it came up both on 443 and on an ordinary high port, and in the second case it ran faster.
The next test separated size from content: a packet of exactly the same size as the working one but without a genuine signature (1,200 random bytes) did not get through, while 20 bytes carrying the genuine signature of an ordinary network request did — and then ran at 109 Mbit/s. All nine measurements with numbers are in the write-up of what actually decides.
The conclusion carries over to a wired network as well: the port number decides nothing, every network has its own nose for traffic, and it changes without notice. So the winner is not whoever once found the golden numbers, but whoever has several dissimilar routes. A set of “Rostelecom settings” from someone else’s article is exactly one route, taken once, somewhere unknown.
What the app does on an unfamiliar network
That is what our app is built from. It does not ask who your ISP is and does not tune itself to one: it tries four different routes in turn and checks each with a real request, not with a padlock icon. Here is what our log says about home networks (the 30 days to 7 September 2026, 260 successful connections over Wi-Fi):
- 85.4% (222 of 260) came up on the very first step — directly, with the full cycle to “connected” taking a median of 1.0 s.
- 14.2% (37) did not get through directly, and the app moved itself to the fallback channel on port 443. All 37 connected in the end, with nothing for the person to do.
- The price of the fallback is time: the app reaches it in a median of 2.6 s instead of 1.0 s, and in the worst case out of ten — 12 s.
Hence the most practical conclusion in this article: if you close the app after five seconds “because it does not work”, you may simply never reach the fallback channel. What those steps are and why there are four — in the three-paths write-up; the full home-network analysis — in VPN not working on home internet.
⚠️ An honest caveat about these numbers: they are counted by network type, not by ISP. Among those 260 connections there are surely Rostelecom lines and others, but our log cannot tell them apart.
This is how we do it. The app walks the routes itself and checks each with a real request, marking honestly on screen which one you are on — how it works. On an unfamiliar network that is exactly the check we offer instead of someone else’s tables of parameters.
🍎 On iPhone Mayak works through the third-party Happ app — with the subscription link from your account. Happ is not in the Russian App Store; there incy (publisher LLC ITDEV) works instead, checked on 22 September 2026.
What to do in a minute on your own line
Since nobody has a general answer for Rostelecom, the only honest way is to look at your own line. The order is this, and it takes a minute:
- Work out which of the three networks is yours. A SIM card sends you to the Tele2 write-up, someone else’s café Wi-Fi to the public-networks write-up. The rest of this is about the cable.
- Check whether the slot is taken. Android allows exactly one such connection per phone: while another app holds the slot — the one installed six months ago and forgotten — a new one will never come up. Not “slowly”, never. And it looks exactly like interference on the network.
- Separate “everyone” from “me”. Open the same site over mobile data. If it fails everywhere, your cable is not the problem.
- Let the app count all the way down. Reaching the fallback channel can take twelve seconds. A slow connection is a sign, not a fault: the short routes on your line are closed.
- Leave the router alone. No port forwarding, no “VPN passthrough” switch — the reasons are set out separately.
- Check whether the network wants a login page. If the Wi-Fi is waiting for consent in a browser, the app has nowhere to connect — that is a separate picture.
- Update the app. First-byte masking exists only in recent builds — older ones cannot do it at all.
- In our app — “Check connection” in settings: it walks every step in turn and names the one that failed, instead of a generic “could not connect”.
Our trial is free and needs no card precisely for this: whether an app like ours works is a property of your line, your building and your evening hour. That can only be checked on the spot and in advance, not from someone else’s article.
What these numbers do not say
- We have not one measurement of our own on Rostelecom networks — neither cable nor SIM. Everything above about the mechanism was measured on MegaFon, MTS and Beeline.
- The Cloudflare file measurement was taken from a server in a data centre, not from a flat. It speaks about the data centre only.
- The step numbers come from our 30-day log by network type, not by ISP: 19 people with a known network type, service accounts excluded, team devices on ordinary accounts not subtracted separately. This is an order of magnitude, not national statistics.
- The Steam case is a retelling of a published report, not our own observation. We do not know who was right.
- We do not know, and will not guess, what the ISP changes or when. Anyone naming you an exact cause and an exact date is guessing.
Short answers
Does Rostelecom block VPNs? We have no measurement of our own on its networks and will not assert it. What is known for certain: on 9 June 2025 Cloudflare named Rostelecom among five networks where its traffic is throttled after the first 16 kilobytes, and on 31 August 2026 Rostelecom said publicly that it does not block access to resources. Those are two different claims by two different parties, and we will not choose between them.
What do I do if my ISP blocks the VPN? First make sure the ISP is the problem at all: check whether the slot is taken by a second such app on the phone, compare the cable with mobile data, and let the app count down to the lowest step — the order is above. By our log, 14.2% of home connections do not get through directly and come up on the fallback channel by themselves, without a single tap.
Why does the VPN not work on a Rostelecom SIM? Because that is not the network you are reading about. Rostelecom Mobile runs on Tele2 towers, and it has its own write-up: VPN not working on Tele2 and t2.
Which settings should I use for Rostelecom? We will not hand you a set of numbers, and here is why: any such set was taken once, in one city, and goes stale silently. Instead our app walks four different routes and checks each with a real request — what each step costs.
Do I need to configure anything in the Rostelecom router? No. To a router our tunnel is a single outgoing stream, just like a video call: no port forwarding, no “VPN passthrough”, and Mayak has no setting that is made on a router. More — in the home-network write-up.
Sites open halfway — is the app to blame? Not necessarily. That is also what the restriction Cloudflare wrote about looks like: the first 16 kilobytes arrive, the rest does not. It takes a minute to check: the same site over mobile data, and the same site with the connection up.
Steam would not open on 31 August — was it the VPN? No: it failed for many people at once, and the complaints came from people with no tunnels at all. The operator named an attack on its network; the regulator reported a malfunction. We do not know who was right, but “it fails for everyone” and “it broke for me” are fixed differently.
Do your numbers hold on Rostelecom? The mechanism — yes; the specific numbers — no. The network measurements were taken in Moscow in late July 2026 on MegaFon, MTS and Beeline, and the home numbers are counted by network type, not by ISP. We never tested Rostelecom networks at all, and we say so plainly.