VPNs and Chaining

A VPN (Virtual Private Network) creates an encrypted tunnel between your device and a VPN server. Your traffic exits to the internet from the VPN server's IP, hiding your real IP from destinations.

Everything between you and the VPN server is encrypted, protecting against your local network and ISP from seeing your traffic content.

These tools overlap but differ:

• Proxy: forwards specific app traffic, often no encryption.
• VPN: encrypts all device traffic to one server you must trust.
• Tor: multi-hop anonymity through volunteer relays, slower.

A VPN trades trust in many relays (Tor) for trust in one provider.

Your VPN provider can see your real IP and all your destinations (though not encrypted content). You are shifting trust from your ISP to the VPN company.

'No-logs' claims are only as good as the provider's honesty and jurisdiction. A VPN improves privacy from local observers but is not strong anonymity on its own.

Common VPN protocols:

• WireGuard: modern, fast, small codebase, strong crypto.
• OpenVPN: mature, flexible, widely supported.
• IPsec/IKEv2: common on mobile, reconnects well.

Avoid legacy PPTP, which is cryptographically broken.

Chaining means routing traffic through multiple anonymity layers in sequence, so no single point sees the whole path. The idea: even if one layer is compromised, others still protect you.

Two famous combinations are VPN over Tor and Tor over VPN. The order matters and changes who sees what.

You -> VPN -> Tor -> destination.

• Your ISP sees you connect to a VPN, not that you use Tor.
• The Tor guard node sees the VPN's IP, not your real IP.
• You still rely on the VPN seeing that you use Tor.

This hides Tor usage from your ISP, useful where Tor is blocked or suspicious.

You -> Tor -> VPN -> destination.

• The Tor exit node sees only the VPN, not the final destination.
• The destination sees the VPN IP, giving a stable exit IP.
• The VPN can link your activity, and you must pay for it anonymously.

More complex; rarely needed and easy to misconfigure.

If a VPN drops, your traffic can leak over your real connection. A kill switch blocks all traffic unless the tunnel is up, preventing accidental IP exposure.

Without a kill switch, a brief reconnect can deanonymize you. Always verify it works before relying on it.

Even with a VPN, leaks can betray you:

• DNS leaks: DNS queries go to your ISP instead of through the tunnel, revealing the sites you visit.
• WebRTC leaks: browsers can expose your real IP via WebRTC even behind a VPN.

Test for these and disable WebRTC or use leak-protected configurations.

Chaining many layers adds latency and complexity, and each added layer is another thing to misconfigure. More hops are not automatically safer.

The biggest risks are usually operational mistakes, not insufficient hops. A well-used single layer beats a misconfigured chain.

A subtle leak: if you pay for a VPN with your personal credit card, the provider can tie the account to your identity, undermining anonymity if they are compelled to disclose records.

For sensitive work, operators favor providers that accept anonymous payment and have a clear, audited no-logs policy in a favorable jurisdiction. The payment trail is part of your OPSEC.

Think about who sees your Tor usage.

You explored VPNs and chaining:

• A VPN encrypts all traffic to one trusted server; not anonymity by itself.
• Use modern protocols (WireGuard, OpenVPN), never PPTP.
• Tor over VPN hides Tor from your ISP; VPN over Tor gives a stable exit IP.
• Use a kill switch and test for DNS/WebRTC leaks.
• More layers add complexity; operational mistakes are the real danger.

Next: spoofing MAC addresses and device identity.