Skip to content
Irregularpedia Logo Irregularpedia

VPN Recommendation

VPN Recommendation

Section titled “VPN Recommendation”

What is a VPN

Section titled “What is a VPN”

A VPN (Virtual Private Network) is a tool that creates a private network connection across a public network, such as the Internet. It provides privacy (obfuscation) and security (encryption) while on the public network but does not guarantee anonymity. To achieve anonymity, The Onion Routing (TOR) is required.

Beyond traditional VPNs, there are alternative tools like Cloudflare Tunnels, ZeroTier, Tailscale, and proprietary solutions like Apple Private Relay and Cloudflare WARP. These tools offer unique features and integrations that can complement or replace VPNs depending on the use case.

Consider VPNs for what they are, a middleman. They have benefits. They also absolutely have associated risks. They are a tool in the box but not an end-all-be-all solution. They are far from it. We need to understand their use case when compared to various threat models.

VPNs and Alternatives

Section titled “VPNs and Alternatives”
ToolFeaturesUse CasesNotable Integrations
Mullvad VPNPrivacy-focused, no email association, cash payment supportObfuscation, secure browsingIntegrates with Tailscale for private routing
IVPNPrivacy-first, anonymous signups, supports cash paymentsSecure browsing, privacy-focused usersSupports multi-hop and WireGuard configurations
ProtonVPNSwiss-based, strong privacy laws, free tier availableSecure browsing, privacy-conscious usersIntegrates with ProtonMail for encrypted email
Cloudflare TunnelsExposes local services securely via Cloudflare’s networkHosting services without public IP, bypassing firewallsWorks with Cloudflare Access for zero-trust security
ZeroTierPeer-to-peer virtual network with mesh routingIoT devices, gaming, remote accessSupports IPv4/IPv6 networks and integrates with network controllers
TailscaleSimplifies VPN configuration using WireGuardSecure remote access to private resourcesMullvad VPN integration provides enhanced privacy by routing via Mullvad servers

VPNs to Avoid

Section titled “VPNs to Avoid”
  • Private Internet Access - Was bought for $127 million in 2019
  • ExpressVPN - Was acquired for $936 million in 2021

Kape VPN relationships visualization

Users should carefully evaluate VPN providers’ transparency and privacy policies before choosing a service.

Multi-Hop and Self-Hosted Architectures

Section titled “Multi-Hop and Self-Hosted Architectures”

Beyond single-tunnel commercial VPNs, several patterns chain hops together for stronger separation between observer and destination:

  • Mullvad multi-hop — entry server in country A, exit server in country B, both inside the Mullvad fleet. Defeats correlation by any observer who only sees one side. Mullvad docs.

  • IVPN multi-hop — same idea, separate entry/exit countries with reserved exit ports per server. IVPN docs.

  • Tor over VPN / VPN over Tor — different trade-offs depending on which side you trust. Privacy Guides has the decision tree.

  • Self-hosted WireGuard chain — N hops you run yourself. The reference how-to is Pro Custodibus’ multi-hop WireGuard using per-hop routing tables and asymmetric AllowedIPs. The fundamental kernel pattern is documented at wireguard.com/netns. See WireGuard in containers for the per-hop gotchas, and the Geographic Labyrinth Field Notes series for a community member’s live build log of a six-hop chain.

    An adjacent open-source router platform worth knowing about: OblivionEdge (maintainer is a community member — emerging, not yet widely deployed) — Rust + PREEMPT_RT kernel, TPM attestation, X.509-pinned ZTNA, WireGuard tunnel layer. Useful if you’re already planning to replace your CPE for Zero Trust reasons; not a starting point if you just want better-than-ISP-router privacy. Verified against upstream 1055b3f (2025-12-11) at 2026-06-08.

  • VLESS / Xray-core (REALITY) — different threat model: censorship circumvention, not privacy. If you’re inside a country actively blocking WireGuard/OpenVPN, REALITY is the community-converged default as of mid-2026 (also implemented by Sing-box and used by default in Hiddify). It is designed to resist active probing, not statistical traffic analysis — Iran has blocked it via traffic-volume analysis. Not a VPN replacement — see the VLESS / Xray Deployment Guide for when to pick it and how to harden it, plus the VLESS Investigation Field Notes on the maintainer / supply-chain caveats.

A self-hosted chain is not a commercial-VPN replacement. The exit hop’s WAN IP is yours, so the destination service still sees you. Self-hosted multi-hop is useful for: separation of routing concerns (one chain per workload), confusion of on-LAN observers and EDR connection-metadata collection, and research/lab work. It is not useful for evading destination services or your ISP.

References

Section titled “References”
Section titled “Related”