The problem: a regular VPN slows down everything
You connect to a VPN server in the Netherlands. You open Yandex Maps — it takes three seconds to load instead of the usual half a second. You launch your online banking app — it hangs, because the bank sees a foreign IP and runs an additional check. Even a simple Google search becomes slower, because all traffic — both Russian and foreign — now takes a detour along a long chain: your device → VPN tunnel → server in the EU → back.
This is the classic problem of a regular VPN: it does not distinguish where the traffic is going. Everything either goes through the remote server or does not go at all. Services are divided into two worlds — Russian and foreign — but a VPN sees them as one stream and sends everything through a single channel.
The result is familiar to anyone who has used a VPN regularly: Russian sites slow down, foreign services work but with a delay. The choice — between speed and access — is inconvenient and unnecessary.
How a regular VPN works
To understand why a cascade VPN is better, let's first look at how a standard one works.
When you connect to a regular VPN, a virtual network interface is created on your device. All network packets — without exception — are sent through an encrypted tunnel to a remote VPN server. This server decrypts the packets and forwards them to the internet on its own behalf.
The scheme looks like this:
- Your device sends a request to a site (for example, yandex.ru).
- Instead of a direct connection, the packet goes into the VPN tunnel.
- The packet arrives at a VPN server in the Netherlands, Germany or anywhere else.
- The VPN server makes a request to yandex.ru on its own behalf.
- The response comes back to you through the tunnel.
For Yandex, you are now a user from the Netherlands. For Google too. For all services — the same remote IP.
This approach has one advantage: simplicity. One server, one connection, one setup. But the price is high — you pay for access to foreign sites by slowing down Russian ones.
How a cascade VPN works: two-server architecture
Cascade VPN solves this problem radically: it does not send all traffic through one server. Instead, it splits traffic into two streams depending on the destination.
The architecture looks like this:
- You connect to a VPN server in Russia (RU). This is the entry point — the ingress. All your packets first arrive here.
- The RU server analyzes the destination of each packet. It looks at where the traffic is going: to a Russian IP address or a foreign one.
- Russian traffic goes directly. If you are accessing Yandex, Sber, VK or any other Russian service, the RU server simply passes the packet to the internet — without encryption and without delay.
- Foreign traffic goes into a tunnel to the EU server. If you open Google, YouTube, GitHub or any other foreign service, the RU server wraps the packet in an encrypted tunnel and sends it to the EU server.
- The EU server sends the traffic to the internet on its own behalf — from Europe, with a European IP.
Here is what it looks like schematically:
User → RU server → [traffic splitting] → directly (RU) / tunnel → EU server → internet
The key word here is split tunneling. The RU server acts as a router: it decides how to route each packet based on the destination IP address. Russian addresses — a direct route. Everything else — through the tunnel to the EU.
Why it works faster
When you open Yandex or VK, traffic goes directly from the RU server to those services. No extra round trip through Europe. Latency is minimal, because the distance between the server and the Russian service is tens, not thousands, of kilometers.
When you open Google or YouTube, traffic goes through the EU server. Yes, the path is longer than with a direct connection to a European VPN. But you are not slowing down Russian services because of this — they use a separate route.
The result: Russian sites work fast, as if without a VPN. Foreign ones — work through the VPN, as before. Nothing gets slowed down.
Who needs a cascade VPN
Remote workers with access to both worlds
Specialists who work with Russian services (1C, Yandex.Taxi, internal corporate systems on Russian hosting) and at the same time use foreign tools (GitHub, Notion, Slack, Figma, Google Workspace) get the greatest benefit from the cascade architecture. They do not need to disconnect from the VPN to quickly open a Russian service, and they do not need to sacrifice speed for access to foreign tools.
Users who work with Russian banks
Most Russian banks block or restrict access from foreign IP addresses. This is done for security — the bank cannot be sure that a login from a foreign IP is not an attempt at fraud. With a regular VPN, you are forced to either disconnect from the VPN to work with the bank or put up with restrictions. A cascade VPN solves this problem: Russian traffic goes directly, and the bank sees a regular Russian IP.
Journalists and analysts
People who gather information from different sources — Russian and foreign — value speed and stability. A cascade VPN lets them quickly load data from Russian databases while having access to foreign sources without switching.
Developers and IT specialists
Access to npm, PyPI, Docker Hub, GitHub, English-language documentation — all of these are foreign resources. At the same time, access to Russian repositories, internal wikis and corporate systems is needed. A cascade VPN works with both streams simultaneously.
Comparison: regular VPN vs cascade VPN
| Parameter | Regular VPN | Cascade VPN |
|---|---|---|
| Speed of Russian sites | Slowed down (traffic goes through a remote server) | Normal (traffic goes directly) |
| Speed of foreign sites | Depends on the server | Depends on the EU server |
| IP address for Russian services | Foreign | Russian |
| IP address for foreign services | Foreign | Foreign (from the EU) |
| Bank security checks | May block access | Work as usual |
| Traffic splitting (split tunneling) | None (everything through one server) | Yes (by packet destination) |
| Latency for RU sites | High | Minimal |
| Resistance to a single server being blocked | Low | High (control plane on the EU) |
Technical architecture in more detail
Entry point: the RU server
The RU server is the first thing your connection starts with. It receives all packets from the client and performs several functions:
- User authentication. Verification that an authorized client is connecting.
- Traffic classification. Analysis of the destination IP address of each packet. Determining whether the address belongs to Russian ranges or not.
- Routing. Direct forwarding of Russian traffic to the internet. Encapsulation and tunneling of foreign traffic to the EU server.
- Tunnel encryption. All packets sent to the EU are encrypted. Russian traffic is not subject to encryption — it goes directly, which increases speed.
Important: the RU server does not store any user data. It works as a stateless router — processes packets and immediately passes them on. No logs, no databases, no information about users.
Exit point: the EU server
The EU server plays two roles:
- Egress node. All foreign packets that came through the tunnel are decrypted and exit to the internet on behalf of the EU server. Services see a European IP address.
- Control plane. The EU server hosts the bot for managing subscriptions, the payment system and the user database. This means that even if the RU server is blocked or unavailable, you can still manage your subscription through the EU server.
Cascade and fault tolerance
The two-server architecture creates natural redundancy. If the RU server becomes unavailable for any reason:
- The client can connect directly to the EU server (backup connection mode).
- Subscription management and payments keep working without interruption.
- There is no single point of failure for the control plane.
If the EU server becomes unavailable:
- Russian traffic continues to work directly.
- Foreign traffic is temporarily unavailable (or redirected to a backup EU server).
Such an architecture is significantly more reliable than a single-server solution, where if the only server fails, the user is left completely without service.
Traffic splitting: how it works in practice
Split tunneling is not just a marketing term. It refers to a specific technical mechanism.
When your device sends a packet, the RU server checks the destination IP address. For this, a routing table is used, in which the IP address ranges belonging to Russian networks are listed. These ranges are determined based on data from Regional Internet Registries (RIR) — in this case, RIPE NCC.
If the IP address falls within a Russian range, the packet is forwarded directly. If not, the packet is encapsulated into a tunnel and sent to the EU server.
This happens per packet, in real time, without delays. The user notices nothing — Russian sites open instantly, foreign ones — through the usual VPN delay.
Why Plan B chose this architecture specifically
When developing Plan B, we faced the same question that all VPN providers in Russia face: how to provide access to foreign services without sacrificing the speed of Russian ones?
Traditional solutions — single servers in the EU, Russian servers with direct internet access — each solved its own problem, but not both at the same time.
The cascade architecture became a compromise that in practice turns out to be better than both approaches:
- Speed. Russian services work fast because traffic goes directly.
- Access. Foreign services are available through the EU server with a European IP.
- Resilience. The control plane on the EU server survives blocks of the Russian infrastructure.
- Simplicity. The user connects to one server (RU), and the architecture works behind the scenes.
We do not require users to configure split tunneling manually. Everything happens automatically — the client determines the destination of packets and routes them accordingly.
Real-world use cases
A developer working with GitHub and Russian repositories
Imagine a developer who daily pushes code to GitHub, pulls Docker images and reads documentation on Stack Overflow — all of these are foreign resources. At the same time, they connect to their company's internal GitLab, which runs on Russian hosting, and use Jira for task tracking.
With a regular VPN: GitHub works slowly (through the EU), Russian GitLab is even slower (through the EU, then back to Russia). Every switch between services is wasted time.
With a cascade VPN: GitHub works through the EU server at normal speed. Russian GitLab works directly, without delay. The developer notices no difference — both services are available simultaneously and quickly.
A freelancer with international clients
A freelancer from Russia works with clients in Europe and the USA. They need access to Slack, Zoom, Google Docs, Figma — all foreign services. At the same time, they use Russian payment systems, document services and corporate tools.
A cascade VPN lets them connect to one server and forget about splitting. Slack and Zoom work through the EU server. Yandex.Disk and Russian banks — directly. No need for separate profiles or manual switching.
A student studying foreign courses
A student watches lectures on Coursera (a foreign service), at the same time reads study materials from the university website (a Russian service) and works with Google Scholar. Without a cascade VPN, they would have to constantly switch between the VPN and a direct connection.
Why a cascade VPN is better than manual split tunneling
Operating systems — Windows, macOS, Linux, Android, iOS — let you configure split tunneling manually. You can specify which apps should work through the VPN and which directly. At first glance, this solves the same problem.
But in practice, manual split tunneling has serious drawbacks:
- Manual setup is required for each app. You have to know which apps use foreign services and which use Russian ones. This is not always obvious — one app can work with both types of services at the same time.
- Impossible to split at the traffic level. The OS splits apps, not traffic. If an app works with both Russian and foreign servers, you cannot split its traffic.
- No automation. If you install a new app, you need to manually add it to the list. It is easy to forget.
- OS dependency. Each operating system implements split tunneling differently. On Windows it is one thing, on macOS another, on Linux a third. The Plan B client works the same on all platforms.
Plan B's cascade VPN solves all these problems at the server level. The user does not need to configure anything — the splitting happens automatically based on the destination IP address.
Protocols and security
The cascade architecture does not affect the level of encryption. The tunnel between the RU server and the EU server uses modern encryption protocols — the same level of protection as a regular VPN. The only difference is that Russian traffic does not go through the tunnel — it goes directly.
For users who want encryption of all traffic (including Russian), Plan B provides the option of full tunneling. But for most users, the cascade mode is the optimal compromise between speed and security.
It is also worth noting that modern Russian services use HTTPS by default. TLS-level encryption protects data even without a VPN tunnel. A VPN tunnel adds protection against interception at the ISP level and against IP tracking — but for HTTPS sites this is not critical.
Frequently asked questions
Will a cascade VPN slow down foreign sites more than a regular one?
No. The path for foreign sites: your device → RU server → EU server → internet. One additional hop (the RU server) is added, but it is negligible — the latency is measured in milliseconds. At the same time, you get the main advantage — Russian sites are not slowed down.
Do I need to configure anything?
No. Plan B works on the principle of "connect and forget". Traffic splitting happens automatically. The client itself determines which packets to send directly and which through the tunnel.
What about sites that use clouds and CDNs?
Traffic splitting works at the IP address level, not the domain name level. If a foreign service uses a Russian CDN (which is rare), traffic will go directly. If a Russian service uses a foreign CDN — traffic will go through the tunnel. In practice, this extremely rarely affects the user experience.
What happens if the RU server is blocked?
The client automatically switches to a direct connection to the EU server. You will lose the advantage of fast access to Russian sites, but you will keep access to foreign services and subscription management.
Is direct traffic to Russian sites secure?
Yes. Traffic to Russian sites goes without encryption, but this does not reduce security — these sites use HTTPS anyway. VPN tunnel encryption is needed to protect against interception at the ISP level, and for HTTPS sites this is not required. You get protection against interception for foreign sites through the tunnel, and for Russian ones — full speed.
Summary
A cascade VPN is not a marketing trick. It is a technical solution to a real problem that all VPN users in Russia face. The two-server RU → EU architecture allows fast access to Russian sites and secure access to foreign ones at the same time.
Plan B is built exactly on this architecture. We do not force you to choose between speed and access — you get both. Connect to Plan B and see for yourself.