Is Outline the same as Shadowsocks?

Essentially yes. Outline is a foolproof wrapper made by Jigsaw, and it uses the Shadowsocks protocol under the hood — so it carries Shadowsocks's recognizable traffic characteristics. That's the root reason it's increasingly caught by TSPU active probing in Russia.

Is Outline banned in Russia?

It isn't banned as a whole app; rather, since September 2024 its underlying Shadowsocks traffic is increasingly caught by DPI active probing and statistical fingerprinting, so nodes often get throttled or blacklisted within hours to days — and self-hosted nodes at well-known hosts also get range-blocked by ASN.

Why do my Outline nodes in Russia die within days?

Two compounding reasons: Shadowsocks's fixed traffic fingerprint gets caught by TSPU active probing and machine learning (reportedly 95%+ accuracy), and Russia range-blocks whole datacenter ASNs — Hetzner, DigitalOcean, OVH and other common hosts especially. Switching to probe-resistant VLESS+Reality and watching node siting is far more stable.

Why is Reality harder to detect than Outline?

Because Reality makes your traffic a genuine TLS handshake to a real, public major website, so active probing gets a real certificate and real website behavior with no proxy signature to blacklist; Outline's Shadowsocks, by contrast, has a fixed traffic fingerprint that both active probing and statistical analysis catch more easily. The Russian tech community's current consensus is likewise that VLESS+Reality still gets through while plain Shadowsocks is mostly blocked.

Why Outline / Shadowsocks Is Getting Easier to Detect in Russia: An Honest Comparison and a Probe-Resistant Alternative (VLESS+Reality)

Updated 2026-07-06

Diagram: Outline is Shadowsocks under the hood and easily caught by TSPU active probing in Russia; VLESS+Reality disguises as ordinary HTTPS to a real website — more probe-resistant and more stable

Why Outline is getting easier to detect in Russia

Outline is a one-click, foolproof tool from Jigsaw (part of Google's parent company) that you can self-host on your own overseas server, and it's deservedly popular. But to understand its situation in Russia you have to know one thing first: Outline uses the Shadowsocks protocol under the hood. Shadowsocks has a set of recognizable traffic characteristics — typically a rhythm of "a few small control packets, then a burst of large data packets." The turning point was September 2024: after Russia updated its DPI signatures, even heavily obfuscated Shadowsocks is often caught within hours; by late 2025 SORM-3 / TSPU added machine-learning classifiers trained on huge volumes of real traffic, reportedly hitting 95%+ accuracy against obfuscated Shadowsocks. The result: domain-based or self-hosted Outline nodes often "get throttled or outright blacklisted within days, even hours." This usually isn't a setup mistake on your end — it's the combination of Shadowsocks's fixed fingerprint plus Russia's targeted probing.

Outline's strengths (stated honestly)

Credit where it's due: Outline is free, open source, extremely simple, and self-hostable on your own overseas server, with easy key management and sharing for family. For someone just starting out who wants to stand up a private channel fast, it's still one of the lowest-barrier options. So don't throw Outline away — its problem isn't that it's "bad," but that the Shadowsocks protocol is too exposed against today's Russian DPI: in areas where blocking is less aggressive, or as a temporary fallback, it can still hold for a while; it's just that once active probing locks onto a node, that node's life is short.

How Russia's DPI actually catches Shadowsocks (and when to switch)

Russia mainly uses two moves. First, active probing: TSPU (the deep-packet-inspection / shaping boxes installed at every operator) suspects a server is a proxy, connects to it and attempts a Shadowsocks handshake, and if the server behaves "like Shadowsocks" it gets blacklisted — reportedly how most Shadowsocks / Trojan servers are eventually caught. Second, statistical fingerprinting: machine learning on packet sizes and timing to spot Shadowsocks's "small control packets + large data packets" pattern. There's also a Russia-specific layer: TSPU range-blocks whole datacenter ASNs, so Outline nodes stood up at well-known hosts like Hetzner, DigitalOcean, or OVH often go dark by the whole range within days. When you notice nodes that "die within days," get "throttled until pages won't load," or you need long, stable sessions, it's time to switch to a channel that is inherently hard for active probing to catch — otherwise more backup nodes just get picked off one by one.

The probe-resistant alternative: VLESS + Reality

VLESS is a lean transport protocol and Reality is its TLS camouflage layer. The fundamental difference from Shadowsocks: Shadowsocks is "encrypted but still looks like a proxy," whereas Reality makes your handshake a genuine TLS handshake to a real, public, major website. That yields two direct benefits: ① when TSPU actively probes your server, it gets a real certificate and real website behavior — there's no "proxy signature" to blacklist; ② your traffic shape is already real HTTPS, so statistical fingerprinting has nothing to match. This is exactly the current consensus in the Russian tech community (Habr, net4people, etc.): Tor, WireGuard, OpenVPN, and plain Shadowsocks are mostly blocked, while XRay-family VLESS+Reality still gets through. On top of that, VLESS+Reality uses a dedicated node, faster and more stable than shared public Outline. The honest trade-off: it isn't zero-barrier like Outline — you need a subscription and a client (sing-box / v2rayN / Shadowrocket, etc.); and no approach can guarantee it always works — node siting (avoiding range-blocked host ASNs) and operations still matter, and during a nationwide blackout or sovereign-internet drill no cross-border channel connects at all.

How to migrate from Outline: step by step

Copy your subscription link from the dashboard (prefer VLESS+Reality nodes in Russia).
Install a mature client: Shadowrocket on iOS, sing-box or v2rayN on Android / desktop, and import the subscription URL (don't add a single node by hand).
Update the subscription, run a latency test, and enable a low-latency, low-loss node — prefer an exit not on an already range-blocked host ASN.
Use Rule mode: send Russian banking / Gosuslugi and other local services direct (they reject foreign IPs) and route only blocked services through the tunnel.
If you still want to keep Outline as a fallback, treat it as a less-aggressive-period / temporary backup, not your daily primary — its life is short against active probing.

Honest expectations

No tool can guarantee it always works; Reality lowers the odds of automatic detection, but the real outcome depends on node quality, host siting, and operations.
During a nationwide blackout or a sovereign-internet (RuNet) drill, any cross-border channel (VLESS and Outline alike) may fail to connect — that's unrelated to the protocol.
Outline isn't junk, but against today's Russian DPI its Shadowsocks fingerprint is too easily caught by active probing — VLESS+Reality is the recommended primary.
For comparisons of the other free / self-hosted tools see why Psiphon slows down and its alternative and why Tor won't connect and its alternative; for the protocol primer see What is VLESS Reality; for client setup see sing-box setup for Russian users; for the overall comparison see what still works in Russia in 2026.

Follow local laws and third-party service terms; this is a technical explainer, responsibility for safe and lawful use rests with the user, and we cannot guarantee the long-term availability of any third-party service (including Outline).

FAQ

Is Outline the same as Shadowsocks?: Essentially yes. Outline is a foolproof wrapper made by Jigsaw, and it uses the Shadowsocks protocol under the hood — so it carries Shadowsocks's recognizable traffic characteristics. That's the root reason it's increasingly caught by TSPU active probing in Russia.
Is Outline banned in Russia?: It isn't banned as a whole app; rather, since September 2024 its underlying Shadowsocks traffic is increasingly caught by DPI active probing and statistical fingerprinting, so nodes often get throttled or blacklisted within hours to days — and self-hosted nodes at well-known hosts also get range-blocked by ASN.
Why do my Outline nodes in Russia die within days?: Two compounding reasons: Shadowsocks's fixed traffic fingerprint gets caught by TSPU active probing and machine learning (reportedly 95%+ accuracy), and Russia range-blocks whole datacenter ASNs — Hetzner, DigitalOcean, OVH and other common hosts especially. Switching to probe-resistant VLESS+Reality and watching node siting is far more stable.
Why is Reality harder to detect than Outline?: Because Reality makes your traffic a genuine TLS handshake to a real, public major website, so active probing gets a real certificate and real website behavior with no proxy signature to blacklist; Outline's Shadowsocks, by contrast, has a fixed traffic fingerprint that both active probing and statistical analysis catch more easily. The Russian tech community's current consensus is likewise that VLESS+Reality still gets through while plain Shadowsocks is mostly blocked.

The service you're trying to reach is blocked. Restore access — free.

Back online in about 2 minutes — no credit card. A working VLESS + Reality route on iOS, Android, Windows and macOS.

Free 1 GB/day
·
No credit card
·
VLESS + Reality in 60 seconds

You and your friend each get +30 bonus days plus bonus traffic once they start using Univista.

Restore access — free

Telegram WhatsApp

Already subscribed? Help for import & troubleshooting.

Ready for reliable international access?

View plans

This article is for technical education only. Comply with local laws when using network tools. Univista is not liable for how you use the service.