Beta 3.0 · free · Android and iPhone
Under whitelists, mobile internet opens only approved sites, and a regular VPN can’t connect. olcOS carries your traffic inside an ordinary video call. Your carrier sees an approved call, and you get the normal internet through your own server.
Tap Connect on the screenConnected · whole server ams-1
Whitelists
Usually, individual sites get blocked and the rest of the internet stays open. Whitelists work the other way round: everything is closed except a list of approved services. The list includes Gosuslugi, banks, marketplaces, and VK and Yandex services.
The VPN server’s address isn’t on the whitelist, so the filter drops the connection. Obfuscation and protocols don’t help: the server simply can’t be reached.
Your phone connects to a calling service that’s on the list. Your server sits in the same call and lets the traffic out to the open internet.
Whitelists are switched on for mobile networks. Home internet and Wi-Fi usually keep working as before.
The carrier’s filter checks where each connection goes. If the address or domain isn’t on the list, the site won’t open.
Lists differ by carrier and region and change often. That’s why olcOS supports several calling services.
In July 2026, only about 30% of mobile connections in Russia’s Central Federal District were unrestricted.
The one condition. olcOS works if your carrier lets the chosen calling service through. Carriers’ lists differ, so set up several services on your server and check in the app which one responds.
Sources: Meduza, citing Kommersant, bne IntelliNews, The Record, Teplitsa of Social Technologies (in Russian).
How it works
olcOS joins a video call as an ordinary participant. To your carrier, it’s a call to a whitelisted service.
Traffic is encrypted and packed into the video stream or the call’s data channel. Your server sits in the same room.
The server has normal, unrestricted internet. It opens the sites and sends the replies back the same way. If a room closes, olcOS reconnects, and with several rooms it carries on through the others.
Features
No terminal, no config files. The server, rooms, keys and access for your family all live in the app. Screenshots show the Russian interface; the app also runs in English.
Got an invite, a link or a QR code? Paste it. Have a VPS? Give the app its address and password, and olcOS sets everything up. On iPhone there are also ready-made lists of free servers.
The list is in the app and grows with updates. If one service doesn’t get through on your carrier, switch to another. Without whitelists you can also connect directly through Xray (VLESS + REALITY).
Several rooms are bonded into a single link. Big downloads use all of them at once, and if one room drops, the connection stays up.
Connection check measures every room on its own and all of them together. The fastest one gets a badge; one that doesn’t get through is honestly marked as not responding.
Give your server to another phone or tablet with a single link. New rooms and keys reach it automatically, and you can see who connected when and how much they used.
A VPN for the whole phone, or SOCKS5 for individual apps such as Telegram. If you like, Russian sites, Gosuslugi and banks included, can go directly, outside the tunnel.
Install
Under whitelists, GitHub and this site don’t open. Download the app now or over Wi-Fi, then follow the steps for your phone.
Android 8.0 or later, 64-bit · 150 MB
Your browser and Play Protect may warn that the file isn’t from Google Play. That happens with any APK: tap “Download anyway”, and during installation “More details” → “Install anyway”.
iOS 17 or later · needs a computer
olcOS isn’t in the App Store, so you install it from a Windows or Mac computer. It’s free.
With a free Apple ID, olcOS works as a proxy, for example for Telegram, and needs reinstalling every 7 days. A whole-phone VPN needs a paid Apple developer account.
olcOS routes traffic through your own server. You can set one up straight from the app, or connect with an invite from someone who already has one.
All versions and SHA-256 checksums are on the releases page. Source code: Android, iPhone and iPad, the core and server.
Server
The server is your own exit to the internet. Your phone never connects to it directly: they meet inside the call. So the server can be anywhere, for example abroad.
Linux with a root login, 1 GB of memory and 10 GB of disk or more. The cheapest plan from any host is enough.
Tap + → My own server (VPS). Pick several calling services: there’s no telling in advance which one your carrier lets through. Setup takes a few minutes.
Your phone becomes the server’s owner. Send invites to your family: each device gets its own link.
Prefer a terminal? Run one command on the server:
curl -fsSL https://raw.githubusercontent.com/olcOS/olcos/main/install.sh |
sudo bashThe script finds a Jitsi server that lets your VPS in, and at the end shows a QR code: scan it in olcOS and your phone becomes the server’s owner. Set the server up over normal internet or Wi-Fi: installation needs a direct connection from the phone. The service, the Jitsi server, the frame rate and other settings are environment variables, described at the top of the script.
Speed and limits
The ceiling comes from the calling service and the video channel settings, not from your server. Below is our test from 6 November 2026: a server in the Netherlands, Jitsi. Your numbers will differ with your network and the load on the service.
Per-service measurements are in the olcrtc test bench notes (in Russian). Frames and packets can be changed in the app’s settings.
The ones your carrier lets through will work, and Connection check shows which. The direct Xray mode helps when there are no whitelists.
Apps that need UDP or IPv6 may not work, such as calls in some messengers and online games.
Or limit guests. That’s why olcOS has several services, room bonding and automatic reconnects.
The interface and compatibility are still changing. If something breaks, open an issue.
FAQ
Didn’t find yours? Ask in the GitHub issues.
A mode in which mobile internet opens only approved sites and apps: Gosuslugi, banks, marketplaces, VK and Yandex services. Everything else is unavailable, including regular VPNs. More in the Whitelists section.
Turn off your VPN and open a site that normally works without one, such as google.com. If it doesn’t load while Gosuslugi and Yandex do, whitelists are on. If nothing loads at all, mobile internet has been shut down completely, and no app will help.
The ones your carrier lets through: each carrier and region has its own list, and it changes. The services are listed in the app, and the list grows. Add several services to your server and see which one responds in Connection check. The direct Xray mode doesn’t work under whitelists.
The app is free and open source under the MIT license. The only thing you might pay for is a VPS, if you rent your own server.
No. You can connect with an invite from someone who already has a server, or paste a link, QR code or subscription. On iPhone there are also ready-made lists of free servers, including ones for whitelists, but other people run them and speed isn’t guaranteed. Your own server is more reliable: your traffic doesn’t pass through anyone else’s hands.
olcOS isn’t in the App Store, and an iPhone installs apps from outside it only from a computer: with Sideloadly, AltStore or SideStore. With a free Apple ID, iOS allows proxy mode rather than VPN, and the signature lasts 7 days. With a paid Apple developer account you get a whole-phone VPN and a signature that lasts a year.
Yes. On iPhone and iPad olcOS speaks English, Russian and French; on Android, English and Russian. The screenshots on this page show the Russian interface.
Anything that only uses UDP or IPv6. Websites, messaging, email and most apps run over TCP and work fine.
The calling service sees that you are in a call. Your server sees where your traffic goes next, so it should belong to you or to someone you trust. The code of the apps and the server is open for anyone to check.
Use olcOS within the laws of your country and the terms of the services your traffic passes through. The project is open and collects nothing on servers of its own: it doesn’t have any.
Get the app and set up the server now, while you have normal internet or Wi-Fi. When whitelists come on, all that’s left is to tap Connect.
Every version, the source code and the changelog are on GitHub.