Troubleshooting

What to try, in order

1. Go through the strategies by hand

   The "Strategies" tab, select a row, "Apply". Try them in this order: Combo (recommended), then domestic (VK), then ALT10, ALT11, Flowseal (multisplit), Flowseal ALT, window (wssize) and finally adaptive.

   After each switch, give it five or ten seconds and refresh the page: the browser may hold old connections open for a while. What each strategy does and which suits which symptom: Strategies explained.

2. Let it select and generate automatically

   The "Diagnostics" tab, the "Select" button. Nothing worked? In the same place, press "Generate": it takes longer, but it assembles a strategy for your network instead of picking from ready-made ones.

   Before you start, narrow the target on the main screen down to the service you actually need. Selecting for "Discord + YouTube" looks for a compromise, while selecting for Discord alone finds a more precise variant.

3. Add it to the antivirus exclusions

   Settings, the "Add to exclusions" button. One click registers the program and the engine folder with Windows Defender and the firewall.

   This is the most common reason the bypass "does not work" or the engine "disappears". Bypass tools regularly trigger false positives. If the engine has already been deleted, add the exclusions and then update it from Settings, or restart the program.

4. Turn QUIC off

   Settings, disable QUIC and HTTP/3. If your provider is targeting that protocol specifically, YouTube and Discord will fall back to ordinary TCP, which the bypass handles better. This is the standard recipe for video that loads forever.

5. Look in the journal

   The "Journal" tab. If there is a start-up error there, the problem is not the strategy but the engine itself: administrator rights, the antivirus, or an engine that has not finished downloading. The codes are decoded further down this page.

6. Check whether it really is name-based blocking

   The "Diagnostics" tab, the "DPI check" button, with the bypass turned off. It answers not "does it open" but "is the provider interfering".

   If the check says "no connection", the blocking is by IP address, and the bypass cannot help with that by design: only a VPN will. For Telegram there is the built-in proxy, which solves that problem another way.

The bypass will not start

Discord problems

YouTube problems

All green, but the site will not open

A special case that confuses people more than any other. Diagnostics checks availability at a low level: a connection is established and the TLS handshake completes. That is not the same as "the page opened in the browser".

A mismatch usually means one of six things.

• ECH. The browser encrypts the site name itself, and the provider cuts such connections wholesale without inspecting them. A check that runs without ECH still passes. Try another strategy or disable ECH in your browser settings.
• QUIC. The check goes over TCP, while the browser tries HTTP/3 (QUIC) first for sites behind Cloudflare. If your provider throttles it, the page loads forever even though everything opens fine over TCP. The tell is distinctive: curl returns the page instantly while the browser stalls. Two settings fix it — the domain in "Свои цели" (My targets), so that it is inside the bypass scope at all, and "Отключить QUIC" (Disable QUIC) in the settings. The order matters: the second only affects what the bypass covers.
• The site does not trust your address. The connection gets through, the site answers — and refuses: an endless captcha, "access restricted", a refusal at sign-up or payment. Your provider has nothing to do with it and the bypass has nothing left to push through. That is a job for WARP: Cloudflare's addresses sit differently in reputation lists than Russian home ranges.
• Blocking by IP address. The bypass lifts name-based blocking, not address-based. The DPI check will report "no connection". WARP helps here too — it changes the address you arrive from.
• A volume limit. The handshake is short and stays under the limit, while a real page does not. The DPI check can detect this separately.
• Stale browser connections. The most harmless one. Wait ten seconds and refresh, or better, restart the browser.

It worked and then stopped

The provider updated its filters. That happens regularly and is normal in itself.

• Turn on auto-repair in Settings: the program notices the failure and picks a working variant again on its own.
• Or press "Select" or "Generate" again on the "Diagnostics" tab.
• If the network changed (mobile internet, a different Wi-Fi), nothing is broken: every network has its own provider and its own DPI. The program remembers a working strategy separately for each network.

Engine exit codes

Visible in the journal, on the line about the engine stopping.

If the strategy is your own, it is worth going through the list of common format mistakes: sticky flags in the wrong place, pos=1 without a second marker, a positive tcp_ts.

Frequent questions

Are administrator rights required

For bypassing Discord and YouTube, yes: the engine loads a network driver into the Windows kernel. For the built-in Telegram proxy, no — it runs as a normal user.

Do I need a VPN

Only if the resource is cut off by IP address, where the bypass cannot help. Against name-based blocking a VPN is not needed, and the bypass does not slow the connection down, because the traffic goes straight to the server.

Is this safe for the rest of my traffic

By default the program only touches domains from the lists plus your own targets, not all traffic. An "all sites" mode exists, but turn it on deliberately: it interferes with connections from games and applications, which may break as a result. Banks and government services are protected by a separate exclusion list even in that mode.

Why does my antivirus complain

Bypass tools work with a network driver and modify packets, and to a heuristic that behaviour looks malicious. False positives are routine here. The "Add to exclusions" button in Settings registers the required paths with Defender and the firewall.

Can I bring a strategy over from another build

From sets for the first zapret, no: the argument names there are different and simply will not run. From sets for zapret2, usually yes, but check the blob names: tls5 and the like do not exist here and must be replaced with tls_google. More in the reference.

Does the program send anything to the internet

It reaches out three times: to download the engine on first launch, to check for updates, and for the availability checks themselves, which go to Discord, YouTube and Google. Per-network memory is stored locally; no addresses are sent anywhere.

How do I remove the program completely

Delete the %LOCALAPPDATA%\Zapret2UI\ folder and Zapret2UI.exe itself. If autostart was enabled, remove the task from Task Scheduler as well. The program leaves nothing in the registry or in Program Files.