‹ My VPN

Help

How do I get started?

Create an account with a Passkey and save the Recovery Code. Sign in, choose a server and create VPN access. Generate an install link, open “Install on Apple Device”, download the Mobile Config and finish installation in device settings. Then select the installed VPN and connect.

Which entry point should I choose?

The website automatically selects a recommended entry point from the country of your current connection. You can choose another entry point manually.

In Russia: start with Moscow. Your device connects to a Russian entry server; traffic that needs Riga travels over the link between our servers. Your device does not need a direct VPN connection to a foreign server.

Outside Russia: start with Riga, or another available server outside Russia. Your device can reach the foreign entry server directly, while Russian destinations can use the Moscow exit.

This recommendation follows our network layout. Connection quality depends on your provider and location; it does not guarantee a faster connection or availability on every network.

The entry server and the exit IP are different things. With the default settings, Russian destinations in the server’s lists use Moscow; other Internet traffic uses Riga. This works with either entry server. Leave Local ID empty in the website: Riga uses sr, and Moscow uses its empty default value.

VPN is connected, but the Internet does not work
  1. Disconnect the VPN and check whether the Internet works without it.
  2. Reconnect the VPN. If needed, try Wi-Fi or mobile data.
  3. If the problem persists, note the selected server, device and whether all sites or only some fail.
Does “Active” mean my device is connected?

No. It means VPN access exists on the server. Check the connection state in your device’s VPN settings. You can close the website after connecting; signing out of the website does not turn the VPN off.

Does automatic or manual selection of Moscow or Riga switch my VPN?

No. The website automatically selects a recommended entry point, and you can change that choice manually. This only chooses which profile to generate. To change the actual connection, install the appropriate profile and select it in your device’s VPN settings.

Which Local ID values are available?

Riga: sr is the default split routing; ru sends Internet traffic through Moscow.

Moscow: an empty value is the default split routing; ru uses Moscow for Internet traffic, and lv uses Riga. Moscow’s explicit sr is a different mode: DNS and destinations in the configured Riga lists use Riga; other Internet traffic uses Moscow.

After changing Local ID, generate and install a new profile. Use the website’s hint for the selected server.

Why do different sites see different countries?

That is expected with default split routing. Russian destinations are identified using the server’s IP and domain lists, including .ru, .su and .рф. A site’s supporting domains, DNS settings and IP-location databases can affect the result; a domain suffix alone is not a guarantee.

What expires after 24 hours?

The install link expires, not your account or an already installed VPN profile. Sign in and generate another link when needed.

What should I do if I lose my Passkey?

Use another Passkey for the same account, or choose “Recover account” and enter your Recovery Code. Complete creation of a new Passkey, save the newly issued Recovery Code and sign in. The previous recovery code stops working. Without a usable Passkey, recovery code or existing signed-in session, the website cannot restore access.

What happens when I change the VPN password?

The password changes for both Riga and Moscow. Generate and install a new profile for every server and device you use. Old profiles cannot reconnect with the old password. Your Passkeys and Recovery Code are unchanged.

What is the difference between deleting VPN access and deleting my account?

Deleting VPN access removes VPN credentials on both servers, while preserving your account, Passkeys and accepted promo code. You can create VPN access again.

Deleting the account also removes its Passkey registrations, sessions, Recovery Code and VPN access. It cannot be undone. Removing a profile only from your device does not delete the account.

Do I need a separate account for another device?

No. Sign in to the same account using a Passkey available on that device, then obtain and install a profile. Passkey availability across devices depends on your password manager and its sync settings.

Glossary
VPN
An encrypted connection between your device and a VPN server. Traffic routed through it reaches the Internet through the configured exit.
Account
Your TOLF identity: it links your Passkeys, recovery code and VPN access settings.
VPN access
Your server-side VPN credentials. Creating an account alone does not connect your device: create VPN access, install a profile and turn the VPN on.
Passkey
A digital key for signing in to the website, stored by your device or password manager. You approve its use with Face ID, Touch ID, a device passcode or your manager. It is separate from the VPN password.
Username
The automatically assigned VPN login, often starting with user_. It identifies your VPN connection; it is not your website sign-in method.
VPN password
The secret used with your VPN username. TOLF puts it in the profile automatically. Riga and Moscow share this password for your VPN access.
Device passcode
The code used to unlock your iPhone or iPad. A system request for this code during installation is separate from your VPN password.
Recovery / Recovery Code
Account recovery and its secret code. The code lets you register a new Passkey if you lose access to your existing ones. Save it securely; it is not a promo code.
Promo code
An optional six-character invitation code recorded for your account when accepted. It does not affect the availability of Riga or Moscow, sign you in or replace your VPN password.
Profile / Mobile Config
A .mobileconfig file containing the server, routing identifier and VPN credentials for installation on an Apple device.
Install link
A temporary link to the profile page and download. It lasts 24 hours. Treat the link and downloaded profile as private: the profile contains VPN credentials.
Server / Remote ID
Server is the address your device connects to. Remote ID identifies the expected VPN server and is checked against its certificate. Both are filled in automatically.
Local ID
A connection identifier. In TOLF it selects a server routing mode. It is not your username, location or promo code.
Routing / exit IP
Routing chooses where traffic travels. The exit IP is the public address a destination sees for traffic leaving that route.
On Demand
A system option for automatic VPN connection according to profile rules. TOLF profiles expose this option with it off by default; its presence alone does not mean the VPN is always connected.
MOBIKE
A mechanism that can help an IKEv2 connection adapt when the device’s network address changes, for example when moving between Wi-Fi and mobile data.
DPD — Dead Peer Detection
A check that helps detect when the other end of the VPN connection is no longer responding.