The law, the ISPs and local pricing in Indonesia, in detail
Legal status. VPNs are legal in Indonesia and are used openly, including by businesses and by the government's own critics. The relevant law is about content, not tools: the Electronic Information and Transactions Law, known as the ITE Law, criminalises defamation, blasphemy and distributing indecent material online, and has produced convictions over social media posts. Ministerial Regulation 5 of 2020, MR5, requires online platforms to register with the ministry and to take content down on request, with unregistered platforms blocked. None of this restricts a person from using a VPN. Source: Electronic Information and Transactions Law 11/2008 as amended; Ministerial Regulation 5 of 2020 (MR5).
What ISPs do. Telkom and its IndiHome fixed-line arm carry the majority of Indonesian households, with Telkomsel, Indosat and XL on mobile. Filtering is done by DNS and by SNI inspection against the Trust Positif list rather than by fingerprinting VPN protocols, so plain WireGuard and OpenVPN connect without difficulty on every major network. Telkom is the exception worth knowing about: as a state-owned operator it has enforced blocks its competitors did not, most famously Netflix, and it is the network where an unusual block is most likely to appear first.
Commonly blocked: adult sites, filtered comprehensively through the Trust Positif blocklist, Reddit and Vimeo, blocked for years on indecency grounds, gambling sites, blocked in enormous numbers as a stated policy priority, Netflix, blocked on Telkom networks from 2016 to 2020 over its unrated catalogue, PayPal, Steam, Epic Games and Yahoo, blocked briefly in 2022 for missing the MR5 registration deadline, Papua and West Papua, subject to regional internet slowdowns and shutdowns during unrest.
Paying locally. Indonesian cards work with most providers and several bill in rupiah through local processors, which avoids the foreign transaction fee. Local payment methods such as GoPay and OVO are accepted by a few providers through resellers, though buying a VPN through a reseller means trusting the reseller with the account.
A blocklist the size of a phone book, and nothing behind it
Indonesia filters more addresses than almost any democracy. Trust Positif, the communications ministry’s centralised blocklist, runs into the millions of entries, and every ISP in the country implements it. Adult sites and gambling dominate the list by volume, with gambling in particular treated as a headline policy priority and blocked in vast numbers.
What the country does not do is inspect protocols. The filtering happens by DNS resolution and by reading the hostname out of a connection, both of which stop working the moment traffic goes through any encrypted tunnel. There is no deep packet inspection hunting for WireGuard handshakes, no throttling of recognised VPN traffic, no registration regime. Plain protocols work on every major network, all the time.
That single fact reshapes the recommendation. On the Pakistan or Egypt pages, obfuscation is the deciding property and half the market is disqualified. Here it is irrelevant, and you get to choose on the things that actually affect daily use: price, how many devices a household can cover, and whether the streaming works.
The Telkom pattern
Indonesia’s most instructive censorship episode was not political. In January 2016, Telkom, the state-owned operator, blocked Netflix across IndiHome and Telkomsel because the catalogue had not been through Indonesian film censorship. Competing ISPs did not block it. For four years, whether Netflix worked in your house depended on which company had run the cable to it, and the block was lifted in 2020 once Netflix agreed to local content rules.
That pattern recurs. Telkom, as the state-linked incumbent, enforces things its competitors do not, and it is the network where an unusual block appears first. If something works for a friend and not for you, check whose network you are on before you blame the VPN.
The MR5 episode in 2022 was the other memorable moment: platforms that missed the ministry’s registration deadline were blocked outright, which briefly took down PayPal, Steam, Epic Games and Yahoo. Most registered within days and came back. It demonstrated that Indonesian blocking is administrative and fast, and that a large service can vanish on a Friday over paperwork.
Papua is the exception
Everything above describes filtering. Papua and West Papua have seen something different: throttling and outright shutdowns during unrest, most prominently in 2019, when connectivity was restricted for weeks and an Indonesian court later ruled the shutdown unlawful. A VPN does not help with that, for the same reason it does not help during any shutdown. There is no working connection to tunnel through.
That distinction is worth carrying: Indonesia’s national policy is filtering, which a VPN defeats completely, and its regional policy during unrest has been restriction, which no VPN defeats at all.
What we have not measured
We have not run probes from inside Indonesia. The blocking described here comes from public documentation of the Trust Positif regime, from reporting on the Telkom and MR5 episodes, and from user reports across the main operators. We do not publish a per-provider works-or-not table for Indonesia, because on a network that does not filter protocols every provider connects, and a table of ticks would tell you nothing you could act on.
Practical setup
Connect to Singapore for everything latency-sensitive. From Jakarta it is a short hop with more capacity than anywhere else nearby, and the regional caches sit there.
Use an Indonesian exit only when a local service checks where you are, such as a bank or a domestic streaming platform.
Do not pay for obfuscation you will not use. It is a genuine differentiator in Pakistan and Egypt. In Indonesia it costs speed and buys nothing.
If you want a free VPN, take Proton’s. The free VPNs that dominate the Indonesian app charts are advertising-funded, and in a country whose ITE Law has produced convictions over posts, handing your browsing to an ad business is a worse trade than it looks.
