Step 4 of 8 ยท Setting up
Protocols and settings in plain language
What the common open VPN protocols are, and what the settings you will meet in most apps actually do.
Common open protocols
A protocol is how the tunnel is set up and encrypted. The three below are open standards or open-source projects, reviewed by many people. Performance depends on your network, device and server, so this guide does not compare speeds.
| Protocol | In short | Often used for |
|---|---|---|
| WireGuard | A newer protocol with a small, readable codebase | Phones and laptops in most current apps |
| OpenVPN | A long-established open-source protocol, highly configurable | Wide device support, routers and older systems |
| IKEv2 with IPsec | A standard built into many operating systems | Phones that switch often between Wi-Fi and mobile data |
Settings you will meet
- Kill switch
- Blocks internet traffic when the VPN connection drops, so nothing leaves outside the tunnel by accident. Usually worth turning on. See kill switch.
- DNS protection
- Sends your DNS lookups through the tunnel to the provider's resolver. Without it, lookups can leak to your network.
- Split tunnelling
- Chooses which apps or destinations use the VPN. Handy for local printers or banking apps that refuse VPNs, but those apps are then not covered.
- Auto-connect
- Starts the VPN on untrusted networks or at start-up. Useful if you tend to forget.
- IPv6 handling
- Makes sure IPv6 traffic goes through the tunnel or is blocked, so none of it travels outside the VPN.
- Server location
- Which VPN server you connect through. A nearby one usually feels faster. Choosing a location does not change which laws and terms apply to you.
Sensible defaults
A reasonable starting configuration
0 of 5 done
Terms used here
- VPN protocol
- The set of rules a VPN uses to set up the tunnel and encrypt traffic. Common open protocols include WireGuard, OpenVPN and IKEv2 with IPsec.
- Kill switch
- A setting that blocks internet traffic if the VPN connection drops, so nothing is sent outside the tunnel by accident.
- DNS
- The Domain Name System, which turns a name such as example.org into the numeric address your device connects to. Whoever answers your DNS lookups can see which sites you look up.
- Split tunnelling
- A setting that sends only some apps or destinations through the VPN and the rest directly. Useful, but it means part of your traffic is not covered.
- IPv6
- The newer version of internet addressing. If a VPN only handles the older IPv4, some traffic can travel outside the tunnel unless IPv6 is handled or turned off.