The State Duma elections run September 18–20, 2026, and residents of 33 regions formally have the right to vote online. Thirty-two regions vote on the federal platform, while Moscow uses its own system. The Central Election Commission (CEC) approved this list of regions in June 2026. Having the right is one thing; whether it actually works depends on where you connect from. You won’t get through from every country, and not from every network either.

On top of that, the Central Election Commission and regional election commissions restrict access from outside Russia and through VPNs. Russian state agencies do everything they can to make sure their resources only open in state-approved browsers with state-approved certificates, or without certificates at all but over plain HTTP. And that means automatically leaking your data to the security services.

To vote online, you first need to log into Gosuslugi (the state public-services portal) and authenticate through ESIA (the Unified Identification and Authentication System). In 32 regions you also have to submit a participation application through Gosuslugi in advance (Moscow doesn’t require one). This procedure comes from CEC Resolution No. 10/98-9 of June 24, 2026. If Gosuslugi doesn’t open from your network, or the login fails, you won’t be able to vote — even if the voting portal itself opens just fine.

Methodology of testing

We checked how election-related websites load from different countries and networks. Our test nodes were: home internet in Europe, home internet in St. Petersburg, a VPS in Moscow, a VPS in St. Petersburg, a VPS in Germany (EU), a VPS in Finland (EU), and a commercial VPN service built for accessing Russian services. We ran every point through a browser with Ministry of Digital Development (Mintsifry) certificates installed, and through a browser without them. For our sample set, we picked the remote electronic voting platform (DEG), Gosuslugi, and election commission websites in major cities and in Chechnya. Separately, we checked access to the “election commission” sites in the occupied Ukrainian regions, where Russian authorities also run their own voting procedure.

Election commission domains block access from abroad and from some VPNs

All the commission domains we tested (cikrf.ru, izbirkom.ru, crimea.izbirkom.ru, sverdlovsk.izbirkom.ru, chechen.izbirkom.ru, dnr.izbirkom.ru) showed the same pattern. The results were identical in both browsers for each node:

Six domains behaving identically was not a coincidence limited to one site — it was a general pattern across the entire commission platform.

Unfortunately, a Russian IP address alone doesn’t guarantee access. You get blocked entirely from abroad, but even running your own VPN inside Russia isn’t guaranteed to help. Our Moscow VPS got the same timeout as the server in Germany, while home internet in St. Petersburg, the St. Petersburg VPS, and the commercial VPN all went through without issues. Two separate rules are at work: one cuts off everything outside Russia, and a second additionally blocks access from specific Russian networks.

Access problems with the CEC website from inside Russia started in July 2026. At the time, Novaya Gazeta Europe and Echo both flagged this. Interestingly, it happened exactly when publication of Duma candidates’ financial disclosures began. The resource had already been blocked from abroad before that, but during those days, it stopped opening even with a VPN using a Russian address.

CEC and election commission sites work only over HTTP

The picture is the same across all our nodes: cikrf.ru and every izbirkom.ru domain we tested serve content only over HTTP. HTTPS doesn’t work for them at all.

• Mintsifry certificates aren’t needed to access these election sites at all — there’s no encryption to validate in the first place. A browser with Mintsifry certificates and one without them gave the exact same result on every domain we tested; we found no difference.
• Any tool that force-upgrades connections to HTTPS simply won’t open these sites.
• A request for an election commission page travels in the clear and is visible to everyone along the route, including the ISP and TSPU equipment (Technical Measures to Counter Threats, the DPI hardware Russian ISPs are required to install for traffic filtering).

Gosuslugi opens from almost everywhere

At the time of testing, gosuslugi.ru and esia.gosuslugi.ru opened from almost anywhere: home internet inside and outside Russia, and data centers both Russian and foreign. Out of our seven nodes, only one failed — the VPS in Germany (EU) — where both domains, on both browsers, returned a timeout.

Networks belonging to major European hosting providers often end up blocked inside Russia. Reports about Hetzner subnets (one of the biggest providers) surfaced as far back as 2024, and by that point the hoster itself had already terminated contracts with clients using Russian addresses.

But we can’t chalk our result up to German networks being blocked along the route. From that exact same point, in the same test run, both vybory.gov.ru and mos.ru opened fine. That means traffic to Russian government resources does reach that point, and it’s specifically Gosuslugi refusing the connection. Its filter appears to target neither the country nor hosting status as such (otherwise the Finnish VPS would have failed along with the German one), but specific networks.

All of this holds true as of September 2026: the sets of networks that get through and that don’t keep changing, and the picture could look different in a month.

Guides written for people who left Russia usually claim that Gosuslugi is entirely unreachable from a foreign address. Our measurements didn’t back that up. Home internet in Europe and the Finnish VPS both got through. What is true is that access to Gosuslugi is genuinely unstable and depends on the specific connection. Some parts of the service treat foreign traffic as coming through a VPN.

Election commission sites need a Russian exit node, and even that doesn’t always work. Gosuslugi currently opens from most networks, and if a specific network fails, it’s enough to switch away from it to just about anything else — even home internet abroad.

The DEG portal is open everywhere, but that doesn’t help you vote

The good news: vybory.gov.ru and mos.ru opened from all seven nodes, in both browsers, without a single exception. No timeouts, no CAPTCHAs, no certificate warnings.

The bad news: you still won’t be able to vote. On the federal platform, you can only vote after authenticating through Gosuslugi, or through your mos.ru personal account if you’re in Moscow. The participation application goes through the same services. If ESIA doesn’t work from your network, the open portal page gets you nowhere — you’ll reach the login button and stop there. In our measurements, this showed up on one node out of seven: the VPS in Germany (EU), where the portal loaded but ESIA didn’t. Checking voting availability by testing vybory.gov.ru alone is therefore pointless; you need to look at the login domain instead.

Separately, it’s worth remembering that voters abroad have fewer rights on paper too. In the 2026 State Duma elections, voting from abroad is possible only for the party list, not for individual district candidates. The Golos movement covered the legal amendments that led to this.

Important: we’re not discussing the quality or integrity of DEG voting here. Election researchers and observers have a lot of questions about that — Novaya Gazeta Europe covered it well.

Recommendations for developers

Don’t treat a Russian exit node as a single class of thing. For election commission sites, one of our Russian VPS nodes connected successfully while another failed. A generic “Russian exit” flag in your interface can’t capture that difference. You need a route list tied to specific exit nodes, plus the ability to switch to a different Russian exit if the current one stays silent.

Build one retry scenario, just with a different exit-node order per domain. You don’t need two separate logic branches. One loop is enough: the client remembers which exit node last successfully opened a given domain, grabs the next one from the list on timeout, and records the result. Only the order changes. For cikrf.ru and *.izbirkom.ru, Russian exits go first; foreign exits never got through once, so they don’t belong in the queue at all. For gosuslugi.ru and esia.gosuslugi.ru, almost any order works — the important thing is just pushing any network that already timed out to the back of the queue.

Don’t auto-upgrade election commission sites to HTTPS. If your client or browser rewrites the address to https (through an HTTPS-only mode, a preloaded HSTS list, or automatic scheme substitution), the page won’t load at all: there’s nothing listening on port 443 for cikrf.ru or *.izbirkom.ru. Add these addresses to your exceptions list, let them load over HTTP, and honestly warn the user that the page is loading without encryption.

Distinguish between a timeout and a DNS resolution failure in your diagnostics. They’re different problems that call for different advice to the user. A client that reports “site blocked” in both cases sends people off cycling through exit nodes in situations where that won’t change anything.

Don’t install Mintsifry certificates. Don’t install them yourself, and don’t recommend them to users in your instructions either. Our measurements show a browser with Mintsifry certificates and one without them produce identical results on every host we tested, and election sites have no encryption at all to begin with. Installing them extends trust across all of a user’s traffic and gains nothing in return.

Check voting availability against the login domain, not the portal. vybory.gov.ru opens from everywhere and is useless as an indicator. You need to watch esia.gosuslugi.ru instead, and ideally not just whether the page loads, but how it responds when you attempt to authenticate.

Re-verify your routing table automatically. Network sets keep changing, and static rules will go stale between releases. A short host list, a probe every few hours from each available exit, and automatic route switching cost less than manual upkeep. We covered how to set up a split tunnel and local resolver on a router separately, and we collected techniques for cases when you can’t set up a tunnel at all here.