To understand what a Virtual Private Network is, first, its best to explain what a Proxy is. In the content of networking, a Proxy server is a server that one can connect to, that acts as an intermediary connection to the internet.
Connection Without Proxy to Internet:
User --> ISP --> Internet
Connection With Proxy to Internet:
User --> ISP --> Proxy --> Internet
Note: ISP - Internet Service Provider
When you connect, the proxy assigns you an IP address. Proxies that use "Shared IP Addresses" use a range of IP addresses to connect to the internet. All users connecting to the internet via a proxy have there real IP addresses masked behind the range of IP addresses the proxy uses to connect to the internet. Assuming the proxy does not keep logs, your connection to the internet is anonymized and with little to no trace of your internet activity. This is because multiple users use the same IP address, making it harder to track you based on your IP address alone.
Further, If the proxy server is physically located overseas, you connection to the internet appears to originate from the proxy server. Thus, if you connect to a proxy server in the United States from Australia, you can bypass geolocation restrictions imposed by Netflix (The US has 7 times more titles than Australia on Netflix due to copyright reasons).
Finally, what exactly is a VPN? A VPN is a Proxy, but with the addition of End-to-End encryption. When you connect to a VPN server, a tunnel protocol is created, a secure conduit for your data is formed, between you and the server.
Although the internet may not be able to see your real IP address, the proxy/VPN server can see all your internet activity. So it is important to pick a VPN service that keeps no logs of your real IP address and web history. To compare, a VPN could be seen as a log-less Internet Service Provider (ISP). Unlike most VPN services, Internet Service Providers keep logs of your IP, search history and even the type of data you consume. In Australia under the new metadata retention laws, ISP's are now legally required to keep logs of your activity for a minimum of two years. ISP's use what is known as packet sniffing to examine your internet traffic. Using this technology, ISP's have been known to throttle users who connect to high bandwidth services like Netflix. If however you connect to a VPN server, your ISP cannot see what services you are using as all your internet traffic is encrypted, and therefore cannot throttle you.
The last big benefit of a VPN is guarantees you a secure connection to the internet, even when you are using a very insure public Wi-Fi network. Because your data is encrypted through the Wi-Fi router, through the ISP, all the way to the VPN server, hackers who also use packet sniffing techniques connected to the same unsecured Wi-Fi network cannot see anything your doing. Put simply, anyone who intercepts your packets of data, whether its a hacker, a router that allows for packet sniffing for analytical purposes or your ISP, will only see a giant cipher of encrypted text (see my article for an example of encrypted Ciphertext: What is Encryption). VPNs also protect against session hijacking attacks on unsecured wireless networks. Session hijacking works by stealing your login cookie (piece of information stored on your computer to indicate you are logged in). By stealing your login cookie, the user can press a button and then steal your login session, allowing the attacker full access to your account (albeit without your password). Believe it or not, that can be as easy as installing a browser extension.
Although VPN services probably sound like the greatest thing ever at this point, there are some trade offs you make when connecting via a VPN. Apart from the fact the VPN provider can see what your doing, VPN services cost money and due to the encryption that happens between you and the server, your connection will be slowed down. How much so depends on your distance from the server your connecting to, the strength of encryption you select, your device hardware and how good the VPN service providers server is. However, due to ISP's throttling users, many observe higher speeds to popular websites like Netflix and YouTube when connecting via a VPN. Some websites simply do not work over a VPN. This came as a shock to me when I realized the reason I couldn't access Carsales.com is because it doesn't support connections from VPNs. In these rare cases, simply switch the VPN off. Further, VPN users have been found to be put under more scrupulous surveillance by government organizations like the NSA. The NSA and it's subsidiaries have been known to store encrypted VPN traffic to be decrypted by supercomputers if the user were to fall under suspicion. This is as a pose to unencrypted traffic, which is stored and then discarded off, as the ISP and government surveillance agency can see the contents of the unencrypted web data without the need of decryption. Finally, in buildings with lackluster wiring, packet loss or loss of information during transit across the internet can look like a connection is compromised, resulting in the VPN server disconnecting to prevent any risk of exposing the users web traffic.
Benefits of a VPN
- Bypass geolocation restrictions
- Bypass censorship restrictions
- Anonymize your connection to the internet and your ISP
- Secure yourself against many public Wi-Fi risks
Downsides to VPNs
- Will slow your connection speeds
- Costs money
- VPN provider can inherently see your web activity
- To Hackers and ISPs sniffing your internet traffic, it is obvious you are connecting to a VPN
- Government agencies like NSA and GCHQ reported to spy on VPN traffic
VPN vs Proxy vs Smart DNS
If your looking purely to get to US Netflix or a blocked website due to geo-restrictions, a Smart DNS service will suffice for the lowest possible cost. Proxies have slightly more anonymity over smart DNS, but most people choose a VPN over a proxy. The great benefits over proxies for the small price penalty is usually considered worthwhile. I personally recommend a VPN service for most people or possibly a Smart DNS service. Proxies are generally more difficult to setup as well.
What VPN Should I Choose?
If you so decide to try a VPN, your in luck. Many VPN's are cheap and most offer a trail period or a money back guarantee. There are a number of things you should consider when choosing a trailing VPN services.
An important part of what VPN you choose is their attitudes towards logging and privacy. This is usually advertised by most VPN providers, as most users seeking a VPN do so for the increased privacy and anonymity. Many VPN providers state they do not keep logs of any kind, which is a blatant lie.
Other VPN services may be very anti-piracy, blocking all P2P Torrent traffic altogether through their VPN. As many use a VPN purely to avoid their IP address being easily found while illegally downloading, take this into consideration if this matters to you. Although policies like no torrenting may be hidden on a VPN providers website, be sure to read reviews to find information like this. I personally need a VPN that supports P2P, as I use BitTorrent Sync (a Dropbox competitor). The difference between traditional cloud based options like Dropbox and P2P services like BitTorrent Sync is Sync takes the server out of the equation. Using Sync, files are directly transferred to your devices, rather than first uploading it to Dropbox's server, and then downloading across your other devices. As Sync uses P2P (torrenting) technology to transfer data, it is vital to me to choose a VPN that allows for torrent traffic.
Pricing - Free vs. Paid VPN
You might ask, why not just use a free VPN service? Free VPN services always have to make money in order to be sustainable. This usually means no or very little customer support, inferior encryption, slower speeds and unstable connections. Further, some VPNs make you sit through some advertising before you connect. Others restrict the amount of servers you can actually connect to. Free VPNs almost always have low data limits and may sell your bandwidth and information to third parties for advertising purposes. Put simply, if your using a free VPN, your the product! Besides, VPNs are cheap, especially when bought in longer subscriptions. As an example, I use Private Internet Access (PIA). PIA offers a 7 day money back guarantee, and is priced at $6.95 for 1 a month subscription, $35.95 for a 6 months subscription or $39.95 for a annual subscription (US Dollars).
Definitely note if the VPN service your looking at has data limits and if so, how much data you are entitled to. Most paid VPNs allow for unlimited data. Note that if your VPN provider states they keep zero logs but have data limits, scrutinize their logging policy, as it is impossible to implement data limits without logging a users total consumed data.
Does the VPN Service Connect Using Their Own Servers?
Although uncommon, some VPN providers such as Vypr VPN from GoldenFrog only connect to their own servers. Most VPN services rent other servers and don't have direct control over them. Owner operated servers are definitely a plus. I am not being paid to state this.
Number of Connected Users
One of the most important things to look for in a VPN service, is the number of simultaneous connections to the VPN server the service allows for. As discussed, VPN services do keep SOME logs. For example, a VPN must keep logs on how many devices you are connecting to the VPN at once. Otherwise, you may be giving your whole family and friend base access to the VPN service via your one subscription. Keep in mind the number of devices you intend to connect at once. For instance, if you have a phone and computer, you will need a minimum of 2 simultaneous connected devices to the VPN.
VPN Protocol - OpenVPN
When looking for a VPN service, make sure it uses OpenVPN as its protocol for connecting to the VPN server. OpenVPN is the standard, and is pretty much ubiquitous. For more information on this topic, see BestVPN.com's article: PPTP vs L2TP vs OpenVPN vs SSTP vs IKEv2. For most though, just make sure your VPN uses the OpenVPN protocol.
A good VPN will have its own DNS servers. DNS in case you weren't familiar is a phone book of website URLs and IP addresses. When you type in a URL in your browser, a DNS request is issued to a DNS server, that tells your web browser what IP address to connect to. Your web browser cannot connect to a website without knowing the URLs corresponding IP address. By default, your DNS server (usually set on your router in a home environment) is your ISP's DNS servers. To fully hide your traffic from your ISP, you should change DNS servers to a log-less DNS server run by your VPN service. The easiest way to do this is to find out if your VPN provider has their own DNS server and if so, what is the server address. Once you have their DNS servers IP addresses, input your DNS server(s) into your routers settings page (usually located under WAN). This will result in your devices using the DNS services specified when connecting to the wireless router. Alternatively, you can set the DNS server for each individual device to connect to. I often do this for networks I usually connect to such as my university campus wireless network. Many VPNs have guides on how to do this. Note that you can only change a DNS server on a device by device basis per connection. So if you switch to another wireless network (other than your home network), you'll have to set the DNS server again manually.
Some VPN servers only allow DNS requests from connections from their VPN service. So if you disconnect to say browse a website that is blocked on VPN connections, your DNS servers won't work, thus you won't be able to browse that site. So look for a VPN with its own log-less DNS servers that work even when not being accessed using the VPN. Alternatively, you can connect to a third party DNS server like OpenDNS, if your VPN provider doesn't offer its own DNS servers.
Finally, many VPNs allow you to specify an option to prevent DNS leaks. A DNS leak is when a DNS request is sent outside the VPN tunnel, unencrypted and possibly to an ISP's DNS servers if you have not configured your custom DNS servers. This would allow an ISP to see and log what websites you have visited.
Using Private Internet Access VPN, I have my DNS servers set on my router, and avoid DNS leaks set to "on," on my devices. PIA allows for an unlimited number devices using their DNS server, even when you aren't using PIA VPN for that particular device. This is vital, as setting their DNS servers on the router makes ALL devices connecting to that wireless router use those particular DNS servers. Additionally, PIA allows for a maximum of 5 devices using the VPN per subscription, so it is likely that not all your devices will be connected to the VPN at any one time (note above discussion on DNS server needing to be useful even when not connected to VPN). Sadly, the downside I have observed with PIA is it does not allow for OpenDNS and its proprietary technology "DNSCrypt" - a technology that encrypts all DNS traffic, even when a VPN is not used. If your using a VPN however, this really shouldn't matter too much, as DNS traffic is usually tunneled through the VPN (assuming avoid DNS leaks is set to "on"). Unfortunately, I don't find PIA particularly reliable, and it's Windows client at one point prevented the computer from accessing the internet without connecting to the VPN, even when disabled or uninstalled.
Instead of connecting all your devices to the VPN (note maximum number of simultaneous VPN connections possible for your VPN service), you can connect your router to the VPN. In this configuration, all devices connected to the router will be connected to the VPN by default, despite the VPN provider only logging this as one connection to the VPN. Further, devices like AppleTV's that can't usually connect to a VPN, can be when connecting to a VPN enabled router. Sadly, most routers have comparatively horrid processing hardware (it takes a decent computing processor to be able to encrypt your data at a fast enough rate to keep up with your bandwidth without bottlenecking). Thus, your router will usually bottleneck your internet speeds. Even if you have a top of the line 802.11AC router, I noted a ten times reduction in speeds when connecting to the VPN via the router, instead of connecting from my laptop. Further, you probably won't want to connect your gaming console to a VPN anyway, as it will reduce speeds and introduce lag. Setup is also usually more difficult. PIA offers very little and at times misleading support for setting up their VPN on routers. Many tell you to install a third party router firmware like DDWRT or Tomato, which is often not necessary. ExpressVPN offers far more comprehensive guides with far more flexibility regarding types of encryption etc when connecting via a router. In any case, I cannot recommend connecting to a VPN using a router, due to the reduced speeds. Further, some VPN services don't offer support for connections from routers using the OpenVPN protocol, instead opting for the less secure L2TP protocol (PIA cough cough). If you connect via your computer or mobile device, it almost certainly is using OpenVPN. I can however recommend running a VPN on a pfSense custom made router.
Anonymous Payment Method - Bitcoin
Bitcoin as a digital decentralized currency. A decentralized currency works something like this:
Bitcoin: Buyer --> Seller
Mastercard/Visa/Paypal: Buyer --> Mastercard/Visa/Paypal --> Seller
Note: Mastercard/Visa/Paypal etc will keep logs of your purchase.
If you want there to be no log of your purchase of your VPN, consider using Bitcoin and finding a VPN service that accepts payment in Bitcoin. For a full guide on how to pay using Bitcoin anonymously, read Buying Bitcoins to pay for VPN anonymously, a step by step guide Part 1. You'll want to do this if you are worried about government surveillance, or if you are in a country with particularly oppressive internet laws. Note that Bitcoin is not inherently anonymous, but it can be made very difficult to trace using certain techniques.
Even the best VPNs will experience disconnections from time to time. If this happens say during public Wi-Fi use, you may suddenly reveal your identity to potential threats. Make sure your VPN has a VPN kill switch, which is more like an internet kill switch, that automatically kills your connection to the internet if the VPN connection is not active.
Further, you may want to implement into your computers Firewall not to let any applications connect to the internet without the VPN service active. The security benefit to this is as your computer starts up, it may begin loading unencrypted data before the VPN connection becomes active, allowing your passwords to be seen if you were on an insecure Wi-Fi network. A guide on how to implement this here (recommended for advanced users only): Using Little Snitch to prevent internet access without VPN. Littlesnitch also comes with a free trail.
VPN setup can be complex when not using the default software provided by the VPN. In some cases, you may want to take your VPN service to the next level. Whether its by trying your VPN on your router, or using a different VPN client, or setting up DNS, great support staff is vital. Most VPN's I have tried reply within minutes. Comprehensive guides are also great. ExpressVPN has the best guides I have seen, to the point I never needed to use their support. PIA on the other hand, had to help me on various occasions for seemingly trivial reasons. Seemingly arbitrary things like the VPN software not connecting to the server because my IP assigned to my device from my router was not between a specific range etc. Luckily, I have a basic knowledge of networking, DHCP and IPv4. The support staff basically said they couldn't be bothered to teach me, thinking I had no idea how to change the DHCP range on my router. Although I managed to fix the problem once they pointed out the issue, if you aren't so savvy with networking, make sure the VPN functions without issue before forking out your money at the end of a trail.
Obviously, a VPN that yields faster speeds than another is preferable. I recommend also testing on your mobile devices. My phone always gets slower speeds than my laptop when connecting to a VPN. This may be due to my laptops superior processing power. Funnily enough, altering the encryption settings to require less processing power (and weaker encryption) did not help. Strangely, connecting to other VPN services using the same encryption standards resulted in faster speeds on my phone, but slower speeds on my laptop. So, just be aware that VPN speeds vary across devices and should be taken into consideration. Additionally, as speed is influenced by server location, test on all the servers you might regularly use. For instance, if you plan to be using Netflix, test a VPN server based in the US. You'll notice most likely the speed will be considerably lower than connecting to a local VPN server. If they are too low to stream high definition video on Netflix, try shopping around. On the other hand, your internet connection may be too slow to stream HD video even without a VPN, in which case, you will just have to watch in low resolution if you are to connect to US Netflix via a VPN.
Note, pricing and speed are not linked. I get the fastest speeds (on my computer and not my phone anyway) with Private Internet Access, one of the cheapest VPN services available. I've tried Astrill, Vypr, ExpressVPN and more. All of these services were 50-300% more expensive and were slower, despite similar encryption used and server locations. Not to give PIA too much credit, as there support staff I'd consider very average, but the saying "you get what you pay for" is true, but not for speed (unless you are on a free VPN).
To measure your internet speeds, visit Speedtest.net. On the bottom right is your IP address as detected by Speedtest.net. If you are not using a VPN, this is your real, ISP provided IP. If your connected using a VPN, it should show the IP address of the VPN server. Just be sure that when you connect to a VPN, that your IP address changes to one other than your ISP provided IP. Do note that your ISP does change your IP address periodically. You should also be able to see your location on a map. Once again, this will show your location unless you connect to a VPN server. If that is the case, your VPN servers location should be displayed instead. Press begin test to find your internet speeds. Ping is the latency, or speed at which a connection can be sent to the server. This is important when gaming, as gaming requires a faster connection, but doesn't necessarily require a lot of data. Upload and download bandwidth is the total amount of data per second you can upload or download. Obviously, higher numbers here are better. Download is what you'll care about when streaming Netflix or YouTube.
Censorship & Geolocation Subversion
If your connecting to a VPN in another country to subvert geolocation or censorship restrictions, not all VPNs will work. In China, VPNs are blocked by default. However, many VPNs still seem to work undetected. For example, Vypr VPN has a proprietary encryption technology called Chameleon that avoids VPN blocking. Sadly, when using Vypr VPNs Chameleon, the internet can see your real IP address and location.
For the Netflix users outside of the US out there, Netflix blocks most VPN and proxies when connecting to its services. However, some VPNs still seem to be unblocked. Research reviews and ask your VPN provider about this issue. Private Internet Access is an example of a VPN that is blacklisted by Netflix. Netflix simply blocks all connections coming from IPs originating from PIA. ExpressVPN at the time of publication does support Netflix. However, it doesn't when using the Netflix mobile app on iPhone (I have not tested on Android). The same is true for PIA. However, when using PIA from a laptop, I was able to connect to US Netflix until an hour later, where Netflix finally detected I was using a VPN/proxy. So make sure you try your VPN on Netflix on all your operating systems you use and for extended periods of time before buying. Additionally, look for reviews and do some searching or even contact the VPN provider directly.
Features & Encryption Types
Many VPN providers will offer many different features to differentiate themselves. Make sure to take these into consideration when choosing between providers. As aforementioned, Vypr has its Chameleon technology and NAT Firewall. Astrill VPN offers Nat Firewall as an extra add-on, as well as additional encryption, authentication and handshake options other than AES, SHA, and RSA respectively. AES, SHA and RSA are all National Institute of Standards and Technology (NIST) standards. If your worried about government surveillance, know that the NSA has a history of introducing backdoors into services like Skype etc and weakening encryption algorithms. Further, the NSA has worked closely with NIST for a number of years, and there has been reason to believe that AES and RSA can be subverted by the NSA as well. For more information regarding the NSA and encryption, visit the following article: Silent Circle moves away from NIST encryption standards. Astrill through their Crypto+ add-on (adds cost) allows Twofish, Threefish, CAST and Carmella encryption standards (all non-NIST). These encryption standards are believed to not be compromised by governments, although we can never be sure. For most people, I recommend AES, SHA and RSA, as it protects well against hackers unlike for example the Blowfish encryption algorithm, that has known security flaws. For more, read the following article: VPN encryption terms explained (AES vs RSA vs SHA etc.). Some providers allow you some options regarding what encryption settings you would like to use, others have a default that cannot be changed. be sure to check with your VPN provider what standards they offer regarding encryption, authentication and handshake (and protocol - hopefully OpenVPN as discussed earlier). A final note on Astrill, ask them if you can trail their Crypto+ add-on via their support staff, as it is not enabled by default during the trail. They will hopefully give this add-on to you for free for the trail period, as they did for me.
VPNs are one of the best tools to anonymize your internet activity. Although the basics of VPNs are quite simple, shopping around can be quite a tedious process. The VPN landscape is always progressing, so be sure to comment if I have left anything out, or have any further questions.
This guide was a part of my Ultimate Information Security & Privacy Guide. Be sure to check out any related content: