Google/YouTube geo without ads via a Russian exit

A useful side effect of geo-routing: if you send Google/YouTube to a Russian exit, ads almost disappear while the region stays native. But for this to work without leaks, you need four touches in the config — the route, DNS without ECS, muffled IPv6, and QUIC in the tunnel. Let's build it. The commands and JSON work.

This material is about engineering your own infrastructure and is educational in nature. Complying with the laws of your own jurisdiction is on you.

Why a Russian exit removes ads

Simple mechanics: Google wound down ad sales in Russia back in 2022. So videos served to a Russian IP run practically without pre-rolls — there simply are no ads for this region. Plus native RU recommendations, the RU region without a geo-captcha, and often a low ping to Google (peering of a Russian data center).

Hence the technique: we wrap Google/YouTube to a Russian exit separately from the rest of the traffic. An important caveat right away, to avoid surprises: a Russian IP removes ads but doesn't remove throttling — YouTube in Russia is throttled at the TSPU level, and a Russian address by itself won't speed up the video. To keep it from buffering, the Russian exit for YouTube must bypass the throttling (a separate Russian host with zapret, breakdown in the YouTube article). Here — about geo and whiteness, not about speed.

Touch 1: route Google/YouTube to the Russian exit

In routing we send Google and YouTube to the Russian exit. On the cascade entry (server-side routing) this is a rule like:

{ "type": "field", "domain": ["geosite:youtube"], "outboundTag": "exit-ru" },
{ "type": "field", "ip": ["geoip:google"],        "outboundTag": "exit-ru" }

geoip:google catches what resolves into the Google CDN without an explicit domain too. Everything else goes its own route (the foreign exit/balancer). This is the "node by service" idea: YouTube exits as Russian, the rest of the foreign traffic — as configured.

Touch 2: DNS without ECS

Even with a perfect exit you can get exposed on DNS. If the resolver passes ECS (EDNS Client Subnet) with the client's Russian subnet, the Google CDN geolocates by it, bypassing the IP. We wrap the Google/YouTube resolution onto a non-ECS DoH right in the node config:

"dns": {
  "queryStrategy": "UseIPv4",
  "servers": [
    {
      "address": "https://1.1.1.1/dns-query",
      "domains": ["geosite:google", "geosite:youtube"]
    },
    "https://1.1.1.1/dns-query",
    "localhost"
  ]
}

Cloudflare 1.1.1.1 by default doesn't send ECS outward — that's its privacy feature, exactly what we need. queryStrategy: UseIPv4 also cuts off IPv6 responses (see touch 3).

Touch 3: muffle IPv6

A quiet leak: if the client has a Russian IPv6 and Google opens over it bypassing the tunnel — the whole masquerade is wasted, the region leaks over v6. Either we tunnel v6 or cut it. Cutting is simpler, both on the client template and by querying in v4 only:

{ "type": "field", "ip": ["::/0"], "outboundTag": "block" }

Plus queryStrategy: UseIPv4 in the DNS block above — we resolve to IPv4 only, so Google's v6 addresses never even appear.

Touch 4: QUIC into the tunnel, not around it

Google is almost entirely on QUIC (UDP 443). If QUIC goes directly, bypassing the tunnel — you're done, the IP leaks. We make sure UDP goes into the tunnel. Or, if QUIC gets in the way (the video sticks over a high-latency channel), we muffle it and Google moves to TCP:

{ "type": "field", "network": "udp", "port": "443", "outboundTag": "block" }

The choice depends on the channel: on a normal Russian exit QUIC can be left in the tunnel; on a high-latency one (CDN/cascade) — block it so the video doesn't hang in stuck QUIC.

A mandatory condition: sniffing

For the rules by domain (youtube.com and the rest) to fire at all, the inbound must have sniffing enabled — otherwise routing and DNS won't see the name *.google.com in the encrypted traffic:

"sniffing": { "enabled": true, "destOverride": ["http", "tls", "quic"] }

Without this the domains aren't recognized and the whole Google routing falls apart — the traffic goes wherever.

Verification

• Open YouTube — the region is RU, ads are almost absent, recommendations are native.
• Check on 2ip.ru what your IP appears as when you visit Google — it should be Russian (the exit-ru exit), not foreign.
• Make sure v6 isn't leaking: test-ipv6.com shouldn't show a Russian v6 address bypassing the tunnel.

The limits of the technique

Honestly, so you don't expect a miracle. This is the network part, and it fixes the geo-flag and geo-ads by location. But there's what the network doesn't solve:

• An old account. If the Google account has lived from Russia for years (language ru, a Russian card, +7), the country is written on the account itself — a Russian exit won't override it.
• Browser locale. Accept-Language: ru-RU and a Moscow timezone cross out any Russian-or-not IP for anti-fraud. This is a memo to the client, the tunnel doesn't reach into the browser.
• Query language. You type Russian queries and watch Russian videos — Google honestly returns Russian results, IP be damned.

So the technique removes ads and keeps the region clean at the network level, and the rest is about the account and behavior. The full mechanics of geo-routing (RU-direct, rule order, anti-fraud) — we covered in the article "Geo-splitting traffic: why routing."