VPNs - My Experiences

The experience of using a VPN varies drastically, not only from company to company, but also from operating system to operating system with the same VPN provider. With that in mind, this haphazard section offers some insight into my experiences using a handful of VPN providers on assorted operating systems.

A note about iPhones: I have tested the use of a VPN on an iPhone 14 and an iPhone 13 mini. Neither displays an icon on the title bar (or whatever Apple calls the stripe across the top of the screen) that indicates that a VPN connection is active. No doubt the stupid black blotch at the top of the screen prevents this. Yet another reason not to use a VPN on an iPhone.

This is a companion page to main VPN topic on this site.

Topics below: IVPN Mullvad Proton VPN OVPN Windscribe

IVPN

IVPN offers a DNS filtering option called AntiTracker. On the main screen of their Windows software it says that this feature "Blocks trackers whilst connected to VPN." Yet, the feature also blocks ads and malware. You would have to read the website description of the feature or dig into the detailed settings to learn this. The main screen of their iOS app, does not even say that it blocks trackers, it just says that it is on or off (in case the checkbox colors are not clear - and they are not). I lead with this point because it is typical of IVPN. The services they offer are quite good, their user interface does them, and you, no favors.

AntiTracker is included in all their plans and it works on every device supported by the service. More than a simple On/Off setting, the configuration of AntiTracker lets you chose among assorted Block Lists and even offers a "Hardcore Mode" that blocks domains belonging to Facebook and Google. That is some serious blocking. For more, see their AntiTracker FAQ. The FAQ documents a really nifty trick that enables the AntiTracker feature even when using a router as the VPN client.

Note that the AntiTracker feature is not included in the version of their app available in the Google Play Store forAndroid, because they assume that Google will ban it. It is included in the app downloaded from the iOS app store. Android users can download and install an .apk file from the IVPN website, or install the app from Accrescent or F-Droid. Or, Android users can use a DNS blocking service via the Private DNS feature of Android itself. In my experience the Private DNS service is used even when a VPN is connected.

One annoying thing about IVPN, that applies to any operating system they support: You logon to their app with an account number. They give it to you with upper case letters, but you can enter it with lower case letters. They don't tell you this. The account number includes dashes. The dashes have to be entered. Again, you are not told this. It takes so little effort to explain this, but no.

You can check how busy the IVPN servers are on their Server Status page. Note that on this page "LOAD" refers to bandwidth usage, not to CPU usage (making my original point yet again). Every time I have reviewed the server status, the vast majority are not very busy. This is a very good sign and should be an important criteria when choosing a VPN provider.

Device Limits: There is an introduction to this topic on the main VPN page here. As of December 2023, the IVPN Standard plan allows for 2 devices, their Pro plan allows for 7. This screen shot shows what it looks like on Windows when you are using all your REGISTERED devices when you try to connect to IVPN from a new device. And, also on Windows, this screen shot shows what happens to a previously REGISTERED device after it has been DE-REGISTERED to allow the new device to connect to the VPN.

IVPN on Windows 10
This is based on experiences in 2023 and 2024

Self Update: The way the software updates itself made a good first impression. However, having lived with for a while now (as of October 2024), I have found problems.
1. The initial good impression came from the software showing both the currently installed version of itself and the newly available version. It also tells you the changes in the newer version and offers three options: skip this new version, remind me later and do the software update. Here is a screen shot of the pop-up message when updating from version 3.13.3 to 3.14.2 (February 2024).
2. But, there is no way, in the app, to see the list of software changes after the software was installed. Clicking on the version number in the app does pop-up some info, but it is not an obvious link and the info is of no obvious value to an end user.
3. As for the list of changes itself, it is close to useless. For example, at one point there was a new Device Management feature. But what is it? Where is it? What does it do? Why should I care? They don't say. Each change gets a one sentence description. No more. And no link to more information either.
4. FYI: The change log for the software is here.
5. The automated process of checking for updates is flawed. Despite using the software every day, it failed to tell me about newly available versions. I was running version 3.14.2 for many months before I just happened to do a manual check for updates in October 2024. The new version it wanted to install was 3.14.17. It did not tell me about 3.14.12 which was released in March 2024. It had not told me about 3.14.14, which had been released in June. Nor did it tell me about 3.14.16 which was released in July. As for 3.14.17, it had been released over a month ago. This is a big failure.
6. The process of manually checking for updates is hidden (at least it was on 3.14.17). There is no visible check for updates in either the main app window or anywhere in the many settings. You have to right click on the system tray icon to find it.
7. When I updated from 3.14.2 to 3.14.17, a couple of my custom settings were lost. This too, is a big deal. While it may, at times, be necessary, there is NO excuse for not telling the user that this can or will happen. To me, this was really big deal because I use the Custom DNS feature and my settings were wiped out. Not only was the newly installed version not going to use my Custom DNS, it also wiped out my DoH server name. And, another gripe: the software still fails to indicate the status of Custom DNS on the main page. This is a disgraceful user interface choice. (I also lost the setting for showing server side ISP info, no big deal)
Bad: The world thinks that WireGuard is better than OpenVPN. However, with IVPN on Windows 10, I think OpenVPN is the better option. In February 2024 (their software was version 3.14.2) my router noticed that a Wireguard VPN tunnel was leaking. My router flags anything trying to leave the WAN port with an internal-use-only IP address. I had been using IVPN with OpenVPN just fine but shortly after converting to WireGuard, the leaks appeared. Turns out that IVPN re-negotiates some Wireguard key (this is beyond me) daily and that when this happens the tunnel is shut down and re-created. I know this because IVPN has an excellent Diagnostic Log that showed the tunnel being shutdown and restarted. During this shutdown and rebuild, the VPN leaks, requests are made to IP addresses on IVPN's internal network, and my router picks this up. Their other customers probably don't notice this because not many people run sanity checks on outbound IP addresses. IVPN tech support did not think the leaking requests were important. Specifically, they were DNS requests to port 53 using TCP. The IP addresses were either 172.16.something or 10.something depending on whether I was using Custom DNS or their Ant-Tracker for DNS. The Wireguard key rotation defaults to once a day but it can be adjusted to as long as 30 days. I don't know if this happens with IVPN on other Operating Systems. I also don't know if the buggy code is theirs or part of WireGuard. Bottom Line: Use OpenVPN.
The user interface is not consistent. There are 2 configuration options on the main screen and the other 98 options are in the Settings/gear section. The problem is that the settings interact with each other and if you are in the 98 options section, you can not see what the first 2 options are set to and sometimes you need to know this.
FYI: The version of the software is displayed at all times in the application Settings (bottom left corner).
FYI: There is an option to have the VPN automatically connect whenever Windows connects to a Wi-Fi network that is not using encryption (aka an open network - one that does not require a password).
I found the user interface for AntiTracker confusing because you can not see all the settings in one place. The main on/off switch is in the main window of the app, but the advanced settings are bundled in with all the other settings. When you are looking at the advanced AntiTracker settings, you can not tell if the feature is enabled or disabled. When you are looking at the main app window, you can not see the advanced options. Last verified with app version v 3.12.0 in Oct. 2023.
Bad: The user interface on both Windows and iOS has a bug in terms of the connection status. When turning it on, the status quickly goes from Disconnected to Connected but that is not really true. There is a period of time where it is in the process of connecting, yet the user interface says that it has already Connected. The VPN is not really connected until you see the new IP address appear but this is hidden by default. Miserable user interface design. Last verified with software version 3.14.2.
Miserably Bad: The user interface has a major flaw when it comes to DNS. There are three ways DNS can go: Their normal DNS, their anti-tracker DNS or a custom DNS of yours. Which of these three modes of operation is currently being employed is NOT SHOWN ON THE MAIN SCREEN. This is a brain dead design. The main screen only shows whether anti-tracker is on or off. Custom DNS? None of your business. Anti-tracker will over-ride Custom DNS. In and of itself, this is fine - if the user is told. But, the user is not told in a simple, clear way. The over-ride happens silently. If Custom DNS is enabled and you then turn on Anti-tracker, there is no warning that Custom DNS has been disabled. This is a miserable way to do things and I got screwed because of it using app version 3.14.2 in April 2024.
July 10, 2024: This burned me again (still software version 3.14.2) and it was very annoying. The main screen shows that anti-tracker is enabled but does not indicated the Custom DNS is configured and enabled and nonethess being ignored. Look at the anti-tracker settings in detail and again, no warning that it is over-riding my Custom DNS servers. Look at the Custom DNS settings and in very faint text it says that anti-tracker might over-ride this. It should say in big red letters that IT IS NOW being over-ridden. This should also show up in the main window. Really miserable user interface design.
October 30, 2024: This burned me yet again. After updating the software, my Custom DNS settings were wiped out and I had to discover this on my own.
CUSTOMS DNS:
The feature is more advanced than either Mullvad or ProtonVPN in that it offers both old insecure DNS and new secure DNS. Using secure DNS, I was able to configure the IVPN Windows software to use NextDNS. Even better, I was able to give it a unique NextDNS device name. One side affect of this is that when looking at the NextDNS logs, you can tell which DNS requests came from a web browser (assuming they are also using NextDNS with unique device names) and which came from Windows itself. Doing this, I found Windows trying to access dmd.metaservices.microsoft.com and then configured NextDNS to block it. For Windows users of NextDNS, IVPN is a great way to go. See the IVPN documentation and a screen shot.
Old DNS, you can only enter a single IPv4 IP address. Two would be better. Both ProtonVPN and Mullvad allow for two. (last verified on version 3.14.17 October 2024)
New DNS: for NextDNS use a DoH URI template of: https://dns.nextdns.io/xxxxxx/ivpnclient where the Xs are a NextDNS profile ID and "ivpnclient" is a device name.
My DNS tests:
1. First, with Custom DNS disabled, I verified that DNS was coming from the router. I ran both an nslookup command and dnsleaktest.com in a browser that was not configured to use Secure DNS.
2. Then, I enabled Custom DNS using old DNS and set it to 1.1.1.1 which is Cloudflare. This worked perfectly. Both the nslookup command and dnsleaktest.com from the same browser confirmed that the PC was using Cloudflare when connected to IVPN.
3. DNS over HTTPS took two attempts to get working. In large part this is due to poor documentation from IVPN about the feature. It felt like I was re-inventing the wheel. It turns out when using DoH you need to provide both an old school IPv4 IP address and a DoH server name. This is different from web browsers that just need a server name. It is also not obvious when using the IVPN software (see the screen shot for yourself). When I provided only the DoH server name (and the IP address remained 1.1.1.1), nothing worked at all. DNS was totally broken. Windows said it was using 127.0.0.1 for DNS lookups and no web pages could be displayed. NextDNS does provide old school IPv4 IP addresses for each of your profiles. When I configured the VPN software with one of these two IP address, most everything worked. At the test.nextdns.io page, I confirmed that it was being used with one of my profiles. At the NextDNS website, I confirmed by looking at the logs which profile it was using. There were, however, still some quirks. An nslookup command said that Windows was using 127.0.0.1 to resolve DNS queries. No idea why, but the lookups worked correctly. I repeated this weeks later and the result was the same, so it was not an issue clearing any cache. Not to pick on IVPN, the Custom DNS feature in the Mullvad software also breaks their DNS leak testing web page and they do not even support secure DNS.
4. An annoying thing about Custom DNS in the IVPN app is that the feature has no APPLY button and no CANCEL button. Everything you type seems to take effect immediately.
5. I should add the Windscribe has the most sophisticated DNS options that I have seen. However, it is its own thing and it can not use NextDNS.
Great: Sending diagnostics to IVPN is handled very well. The logging for diagnostics is off by default, which is the right choice for privacy. To enable logging, go to Settings -> General and turn on "Allow logging". To send the logs, click on the "Diagnostic Logs" button. This shows a wealth of diagnostic information, the log, system settings and more. From there a single button click sends this information to the company. And, you can go into the "User comment" tab to add your explanation of the problem at hand. All in all a very well designed feature. (as of version 3.10.23 which was current in August 2023).
April 25, 2024: When I had to send them diagnostics, I noticed that the log went back to February 22nd, roughly two months back. Makes me wonder if they ever trim the log data. App version 3.14.2.
When using WireGuard, the main connection status will show that the VPN is connected, even when it is not. Even when the PC is off-line. This is not technically a bug, but it is mis-leading. The company explained why this happens, but the explanation was above me. They realize it can be confusing and they are working on a fix. To see if you are really connected, you need to look for the IP address and location of the VPN server. If it is displayed, you are really connected. The company said that this does not happen with OpenVPN. They responded quickly and on-point to my email about this.
April 25, 2024: App version 3.14.2. This still happens and it fooled me again. You are not really connected to the VPN until the IP address, Location and ISP fields are displayed. If you see a spinning icon, you are not connected.

IVPN on Android 12 and 13
Initial testing with app version 2.10.3 January 2023

Bad: The Android app is not as mature or full featured as their Windows software.
Bad: Custom DNS is not very robust. All you can do is enter an IP address. And, just one IP address, not even the standard two. This means you can not use it with a NextDNS profile. Last verified Oct 2023 on Android 14 with app version 2.10.4.
Bad: The software does not know if the device is connected to the Internet or not. With the Android device not connected to the Internet and the VPN disconnected, you can tell the VPN app to connect and it will say that it has connected. This does not create trust. In contrast, the Mullvad Android app is very much aware of whether the device is on-line or off-line.
FYI: I suggest enabling logging which is off by default.
Good: I tested access to LAN devices. With access turned off (the "Bypass VPN for local networks" option was OFF), a LAN scan from an Android 13 device could only see the router and itself. It worked. Tested app version 2.8.6 from April 2023.
I tested access to the Android device while connected to IVPN using OpenVPN and UDP. Another device on the LAN was able to see the Android device. Tested on Android 13 and IVPN app version 2.8.6 from April 2023.
Bad: Sept 2023, app version 2.10.3. I used the Custom DNS feature for the first time and afterward no websites would load. The VPN however was able to connect. Sending them the logs, using the app, offered a choice of an email message or uploading to Google Drive. Their Windows app handles log sending better.
Bad: While connected to the VPN, you can not see the status of the Custom DNS setting. Poor design.

IVPN on Android 10 (OS has bug fixes as of June 2022)
VPN client version 2.8.4 which was released January 15, 2023
Tested January 2023

Bad: What version of the app are you using? I could not find this displayed anywhere in the app. Had to ask tech support . Last verified this on Android 13 and IVPN app version 2.8.6 from April 2023. It still does not tell you what version it is, you have to check in the Android Play Store app.
Bad: Custom DNS only allows you to specify one IP v4 address. It is an industry standard to always provide two IP addresses for DNS.
Bad: Custom DNS does not support encrypted DNS
Bad: The Custom DNS feature warns that when anti-tracker is enabled, it will over-ride the Custom DNS. The problem with this is that nowhere in the app does it say whether anti-tracker is enabled or not. In fact, there is no option for anti-tracker anywhere in the app. I had to ask tech support and they explained that anti-tracker is not available in the Google Play version of their app, but is available in the F-Droid and APK versions. I should not have had to ask.
Bad: If the VPN is connected, you can not see the current setting Custom DNS setting. And, the app does not tell you this, so it appears to be a software bug. My guess is that this by design, so it is poor documentation in the app.
Bad: The download page for their Android app does not explain the feature differences between the Google Play version and the F-Droid and APK versions. It seems like they are all the same, but they are not.
Bad: The download page for their Android app says that it supports a multi-hop feature. It does not. At least the Google Play version of the app does not.
Confusing: IVPN has a great feature that lets you decide whether LAN devices are accessible or not. However, the wording in their Android app is all but useless. Their Windows software describes this much better. The option on Android is called "Bypass VPN for local networks" and it is OFF (switch to the left and red) by default. OFF means that LAN devices are blocked. When the option is ON (switch to the right, blue), LAN devices can be seen. To help understand this feature, the Android app adds: "Networks directly connected to the local interfaces will not be routed over the VPN". Sad that someone thought this was helpful to add.
FYI: Advice from IVPN tech support about switching from the Google Play version to either the F-Droid version or the APK version: log out, uninstall the Google Play version, reboot Android, then install the new version.

IVPN on ChromeOS
Android app version 2.8.4 from Jan 15, 2023
My guess is that the experience on ChromeOS is 99 percent the same as on Android, but just in case, I list it separately.

Bad: You logon with an account number. They give it to you with upper case letters, but you can enter it with lower case letters. They don't tell you this. The account number includes dashes. The dashes have to be entered. Again, you are not told this.
Bad: Just like on real Android, the app has no idea if the device is on-line or off-line.
Bad: The app reports that it is "Connected" when it is not. To see if it really is connected you need to swipe up to see the IP address of the VPN server. If there is one, you are really connected. If not, then not. A better design would show you the IP address of the VPN server you are connected to up front and center without having to swipe up.
Bad: One day I could not connect to three different VPN servers, so I opted to send them the logs. This feature is not well designed. For one thing, there is no feedback at all, the screen just went black for a couple seconds. Did it work? I dunno. Also, I can not see the logs.
Bad: On a Chromebook with a detachable keyboard, app always runs vertical when the keyboard is not attached. This is an annoyance on a Chromebook that I use horizontally.
Bad: When I first tried to use the app on my Chromebook, I had exceeded the maximum number of devices. To get around this, I un-installed the app from an Android device. This did not help. Perhaps I had to log out from that other device first? The only option was to logoff all other devices. There was no option to just logoff one other device.
Bad: The app does not display its version number
FYI: I suggest that you change the default behavior of connecting to the fastest server. The problem with this is that they have many servers (80 or so?) and they test each one before picking the fastest. This checking slows things down right off the bat. And, many servers halfway around the world can never be among the fastest. If you want it to connect to the faster server, then limit the number of servers that it speed checks.
FYI: logging is off by default. This is the secure option, but be aware that you can enable logging in the app. There is only one log, other VPN software has multiple logs.
May 2023, version 2.8.6: After turning on the Custom DNS feature, something went wrong and whenever the VPN connected, no websites would load. Clearly a DNS issue. That is not my point here. To try and deal with the DNS problem, I used the feature in the app to send them the logs. The screen went completely black for a few seconds, then back to the VPN app. Is this normal? I hope not. It could be that the DNS problem broke the ability to send the logs about the DNS problem. More to come....

IVPN on iOS

November 2024: iOS 17.7 and IVPN app version 2.12.4.

Over the time I have used IVPN on iOS there has been a re-occuring issue. The app will report a status of "Connected" when it is, in fact, Connecting. See a screen shot. This is made worse by the fact that what you need to see, before you can be sure that it is really Connected, is hidden by default. You have to swipe up the part of the app that has the status to see the IP address, Location and Internet Provider of the VPN server. If you see a spinning circle, as shown here, you are not connected, despite a status of "Connected". If you see an IP address that is not yours, you are, in fact, connected. To me, it is a bad user interface design to hide this information, especially when the vast majority of the screen is a useless (to me at least) map of the world.
If, while disconnected from the VPN, you decide to connect to a different server than the last time, the app shows you the huge list of all their available servers. It does this even if you have configured some favorite servers. Kind of lessens the whole idea of Favorites if they are not shown first.
The app has a lot of slider widgets in the interface. For example, when you want to connect or disconnect and the enable/disable of the AntiTracker feature. I personally find these harder to deal with than press-no-slide On/Off buttons.
You really want to enable the Keep Alive on Sleep option. It is the default and when I experimented with disabling it, it caused me problems connecting to the Internet.
I use IVPN on a Wi-Fi only iPad. If I disable the Wi-Fi, the VPN status remains "Connected". Expanding the display to show the IP address, you can see the true status as the IP address is just a rotating circle. Yet again, a poorly designed user interface.

Initial testing was on iOS 17.2 in January 2024 with IPVN app version 2.11.1 (7). Some testing was also done on iOS 17.3.
See their iOS app setup instructions. You are not required to use their iOS app, they provide manual setup instructions for WireGuard, OpenVPN Connect and IPSec with IKEv2.

My initial observations:

As on other Operating Systems, you must enter your account number with dashes, and it is not case sensitive.
Custom DNS is really great. DNS when the VPN is active supports DoH.
There is also a DNS configuration option for when the VPN is not active. This option supports both DoH and DoT. Really great.
At the first login, you are told the type of account you have and the maximum number of allowed devices. It does not tell you how many devices are already allowed.
At the first login, you are also told the types of data that IVPN logs and does not log. Great.
You will probably want to change the list of servers to sort by latency. It defaulted to an alphabetic sequence. Look for "Sort by" in upper right corner.
In the list of VPN servers, you can see the ping time (latency?) for each server. Good. Mullvad does not do this.
By default you select a city to connect to. There is an option to show the individual servers in each city and connect to a specific server. Same as Mullvad.
The default VPN flavor is WireGuard. The app also supports IKEv2 and OpenVPN.
With the VPN connected, and the Internet then cut off, the app still says it is connected. Ugh.
In the Advanced section of the Settings there is an option to Block LAN traffic. Good.
IPV6 is off by default. This is fine with me.
There is a customizable AntiTracker feature to blocks ads, malicious websites and trackers.
The app supports multi-hop VPN routes
The option in the app to contact tech support, simply creates an email to support at ivpn.net. It does not include or attach any diagnostic information. There is no option to include any diagnostic information. On my device the email was useless as it depends on an iOS email system which the device did not use. Email on the device is done using an app from an email provider. Other apps can invoke this email app via the iOS Share feature, but IVPN does not use that.
The app is mostly black, white and grey. So, pretty ugly.

IVPN Tech Support

March 2023: IVPN allows VPN connections from a Synology NAS device. One configuration option for this is an on/off checkbox called "Allow other network devices to connect through this Synology server's Internet connection". IVPN says to enable this option. So, I asked them what needs to be done on a LAN resident device to make it connect through the Synology NAS box. They don't know. At first, they avoided the question. Then when asked again, their response was full of maybes. They did point to the Synology documentation on this: VPN Connection. It too, however, says nothing about using the option. In fairness this is a Synology gripe, but IVPN failed in recommending the use of an option they don't understand and then in not coming clean about not knowing. Also, their Synology NAS setup instructions are poor. For one thing, there are no dates (neither created nor last reviewed), it is for DSM version 6 when version 7 is current and it does not link to the Synology documentation.

The Contact Us page on their website uses PGP keys for secure email. This is as ancient as Fred Flintstone. They should have email addresses at both ProtonMail and Tutanota for secure email. Or something else a bit more up to date.

In general, tech support has been very good. All questions/problems have been responded to by someone who understood the issue and made reasonable suggestions. In my experience, their support has been far better than other VPN providers.

IVPN Billing

April 2023: After paying for some months on a month by month basis, I tried to extend my account for a full year. Their system rejected a MasterCard, a Visa card and an American Express card. The Visa card was a debit card and had been used previously to pay for a month of service. I later learned they do not accept American Express. Their site does not say this while making a payment, it is buried in a KB article that you don't see while signing up. The error message from their payment processor also does not this. In the end, I had to go to Amazon, buy a paper voucher, pay sales tax and wait for it to be delivered before I could extend the time on my account. All three times I was trying to extend an existing account. I probably should have created a new account after the first couple failures. Creating a new account is trivially easy to do as IVPN collects no information from their customers at all, other than what is needed for billing.

IVPN Vouchers
What IVPN calls a "voucher" is a piece of cardboard that you can buy from Amazon in the US. The downside is that you pay sales tax. The upside, is that IVPN never sees your credit card information. They also don't know who purchased any particular card. The card contains an activation code that you have to scratch off using a coin. The instructions fail to mention that you have to scratch anything off, it just says to tear the card. The activation code is 12 characters consisting of numbers and letters. All the letters are upper case, but you can enter them on the IVPN website in lower case. It fails to tell you this too. More here: Voucher cards FAQ (undated). FYI: Mullvad also sells paper scratch-off vouchers.

MULLVAD

Note: Both IVPN and Mullvad offer assorted blocking (ads, trackers, malware, etc) in their Windows apps, but not in their Android apps. I was told by one of them that Google is advertising driven and would block their Android app if they offered ad-blocking. IVPN offers their Android app with ad blocking as both an APK and in the F-Droid store.

New User Experience

December 2022: The new user experience starts out great. Mullvad only knows you by an account number, you do not need to provide an email address to sign up. When you run their Windows software the first time, this is what you see. However, things go downhill very fast.

When I started a new subscription, I installed the software on iOS and Android devices where it only supports WireGuard (their desktop software supports OpenVPN). The first five devices went well.

On the 6th device (Windows 10), there was an error about "Too many devices". What the heck? That's not explained. Usually with a VPN, the limit is the number of concurrent devices that can be connected to the VPN service. That was not the case here as none of the first five devices were connected to the VPN.

Mullvad has introduced new concepts, new terminology, new limits and they offer no explanation for this.

As to specifics, here is a screen shot of the error from version 2023.5 of their Windows software. The user is instructed to logout of another device. But

What does it mean for a device to login and logout? What is the concept here?
How is logging in/out different from being connected to the VPN?
If you click the X next to one of the devices, it is logged out. But which device? You can not tell. Mullvad gives devices a random name consisting of two words. You have to go to each device with their software on it and review the VPN software settings to see the name they gave to that device. You can not set a name like "Mikeys iPad"

In the Help section of their website, I searched for "Too many devices" and the results are shown here. I found this useless.

When you try to use a device that has been kicked out of the system, you get a "Device inactive" error as shown here (from Windows).

The Mullvad tech support page Using the Mullvad VPN app has click here/type this instructions for dealing with this, but does not explain the concept.

So, devices can be logged in or logged out. They can be active or inactive. What do these terms mean? My best guess is

There is no limit on the number of devices that you can install their software on
There are two different limits and they do not have useful terminology to distinguish between them.
One limit is the number of devices that can be concurrently connected to the VPN. If anyone from Mullvad reads this, you should refer to this as the concurrent limit.
Another limit is the number of devices that can be "registered" with Mullvad. "Registered" is my term, not theirs. A "registered" device is one that is allowed to connect to the VPN. You can install their software on 26 of your devices, but only the 5 "Registered" ones can actually make a VPN connection.
When a device that had been "Registered" but was booted out by another device, tries to use the VPN, this is the error message (from an iPad). In my terminology, this means the device was de-registered. But, Mullvad refers to this condition as "inactive", "revoked" and logged off. Miserable user interface.

So, if you install their software on 5 devices and use it, at least once, on all 5, then you are in trouble. All 5 devices are now in a "registered" status, and they are allowed to connect to the VPN. The 6th device that you try to use will fail with the "Too many devices" error. Even if none of the first 5 registered devices are connected to the VPN, the 6th device will still suffer this error because it refers to their being too many registered devices, not too many concurrently connected devices.

This is far from the worst thing in the world, but their description of what's going on is disgraceful.

I suspect that having a limit on registered (again, my term) devices is a WireGuard thing as it says here that you can only have five Wireguard keys. What a key is, is apparently none of my business. Also, I have used Mullvad in the past and this was not an issue back when they used open source OpenVPN client software on mobile devices. If it is a WireGuard thing, then the Windows software should have asked if I wanted to use OpenVPN instead of de-registering (or whatever its called) another of my devices. It did not.

As thing stand, Mullvad is not appropriate for a general non-techie audience. It is only for someone willing to dive into this rabbit hole, or, someone with no more than five devices. This is a shame, as Mullvad does so much right.

Connection Status/Information

One thing Mullvad does not believe in is providing detailed information about the VPN connection or their servers. Up front, their VPN client software does not provide any indication of how busy any of the available servers are. There is a server status page on their website, but it does not show any information about how busy a particular server is. In contrast, Windscribe provides both the Ping time to their servers and an indication of its current load in their client software.

While connected, Mullvad software does not provide data on how fast the connection is, how long it has been active or how much data has been transmitted in either direction.

On the upside, Mullvad provides both an input and output public IP address for the VPN connection. I have seen this on both Windows and Android. For the input IP address, they also display the port number and the server name. The input IP is what your router sees. I have not seen any other VPN client software that provides two different public IP addresses. That said, sometimes with a VPN, the input and output IP address are the same, so this is not always needed.

Mullvad on Windows 10
VPN client version 2022.5 December 2022 - January 2023

The first time you run the software, you see a summary of the changes in the latest software release. These mean little to a new customer. Note that this is quite different from what an Android user sees the first time they use the app.
Good: The software offers blocking of ads, malware, trackers, porn and gambling. Bad: It does not say when these options kick in. Is it immediate? Do you have to disconnect from the VPN and re-connect? None of our business.
Bad: Mullvad does not have an option that Windscribe does have - killing existing sockets/threads. After making an OpenVPN connection, I saw many sockets/sessions/threads that continued to run outside the VPN. After a minute or two they timed out and went away. If your router is not able to display this information, then connect to a VPN five minutes before you need it.
Custom DNS feature
- Eh: you are limited to entering a pair of IP v4 address, so it can not support secure encrypted DNS (DoH and/or DoT), which is based on a server name.
- Eh: It only works with WireGuard, it does not work with OpenVPN.
- Bad: When using Custom DNS, and the Tunnel protocol is set to Automatic (which means the software chooses between WireGuard and OpenVPN on its own) the software can chose OpenVPN and thus ignore the Custom DNS. There is no warning about this. I discovered it only because I ran some of the DNS testers on my RouterSecurity.org website.
- Good: It can be used to force the use of NextDNS. When logged in to nextdns.io, the setup page gives each customer two IPv4 addresses to use with a specific NextDNS profile. I used these as my Mullvad Custom DNS servers and verified that the system was indeed using NextDNS.
- Good: It turns out the above is not always true. When this was not working (NextDNS was not being called, even though the Custom DNS was configured with two IP addresses for my NextDNS profile), I sent a lot of debugging information to Mullvad. Their tech support found the problem and it was not even theirs. The problem was with NextDNS which offers many ways to invoke their service and two IPv4 IP addresses is the bottom of the barrel. I had never used it before this. It turns out I had forgotten a step, NextDNS needs to be told the public IP address. They call this "linking." Great tech support by Mullvad. The best I have ever received from any VPN provider.
- FYI: The down side of using the linking feature of NextDNS is that you are locked to one specific VPN server. If you connect to another VPN server, you will still use NextDNS but only their generic service, you will not be using your custom NextDNS profile. Here too, Mullvad tech support offered a suggestion: "enable IPv6 in the Mullvad app settings and then use the IPv6 addresses in your NextDNS account. Since those addresses are unique for you it will work without linking the [public/VPN server] IP. "
- Bad: Turns out you really can not lock NextDNS to one specific Mullvad server. A few days after making this link, the link broke because the public IP address of the server changed. That is, server us123-wireguard (for example) initially had an IP address of 1.2.3.4. Then, it changed to 5.6.7.8. This has continued to happen to me time and time again. I give up. This is not a viable option after all. So to use Custom DNS with Mullvad and NextDNS the only reasonable approach is to enable IPv6. But, IPv6 opens up a new whole can of potential worms. Note that IVPN can do this on Windows (see above on this page). That is, the Custom DNS feature in the IVPN software lets you specify a NextDNS server name which includes your profile ID.
- Note: Browsers configured to use Secure DNS still used DNS services from the browser, not from the VPN, even with Custom DNS in place. This is an FYI, as it has been my experience on Windows with many different VPN providers.
- Bad: Their Connection Check page is not aware of any Custom DNS settings and thus reports the wrong status. When, using WireGuard and my Custom DNS was being honored, it reported a DNS leak. When using OpenVPN and my custom DNS servers were being ignored, it reported that all was well.
Good: The taskbar icon is brutally obvious. It is a solid green lock icon when connected, and a broken red lock icon when not connected. Excellent UI.
Good: You can contact tech support directly in the app (Settings -> Support -> Report a problem). In the same section of the app you can view the logs in Notepad.
Good: The app displays its version easily. One click on the Gear icon (for settings) is all it takes to see the currently installed version.
Good: The version numbers for the software are great. Version numbers start with the year the software was released, and then the update within that year. So, for example, in 2023 the first released version was 2023.1, then 2023.2, then 2023.3. This is great and no one else does this.
FYI: To quit the Windows app (that is, to exit the software, not just disconnect from the VPN), you have to into the Settings section to find the big red Quit App button.
FYI: To see which version of the app you are running, click the gear icon in the top right corner of the main window.
Software update: The experience of updating the software from version 2022.5 to 2023.1 was bad. It starts off well, with a notice of an available update. But, then you have to click an icon the size of 3 molecules to be taken to the Windows software download page on mullvad.net. Here you manually download the latest version of the software and you can see the changes in this version. Fine. It does not show you which version you currently are using. The installation instructions are my biggest gripe, they are inadequate to the point of being amateurish. To begin, there is nothing about a new installation vs. an upgrade. It also says nothing about installing as a limited/restricted Windows user. One thing it does say is "Open the downloaded file and follow the prompts to install the app." You do not "open" the downloaded file, you run it. And what are the prompts? The laziness in this documentation is offensive.
Bad: The VPN leaks when using OpenVPN. I owe more doc on this, but well after a VPN connection was made, I saw a new thread/socket/session created outside the VPN tunnel. I suspect that this is a Windows issue rather than a Mullvad issue, but I have not gotten in the trenches on this yet. I have also not tested with WireGuard.
FYI: This matters not at all, but I find the color scheme for the app pleasing.

Mullvad on Android

Bad: The Android app version 2024.1 (latest as of May 2024) is missing a feature they introduced in May 2024 to their iOS app - Custom Lists of VPN server locations. The master list of all server locations is huge and sorted alphabetically. This means that I have to scroll through this long master list, to find servers in the United States and the United Kingdom. Anyone living in Australia or Belgium has no problem :-)
Bad: While there is a Custom DNS option, it is limited to old DNS. That is, the only input is an IP address. This makes Mullvad a bad option for someone who wants to use NextDNS with one of their customized NextDNS profiles. As of app version 2023.7 which was current as of October 2023.
Good: In the Advanced Settings feature, there is an option for DNS content blockers where you can chose to block ads, trackers, malware, gambling and/or adult content. Each of these can be individually enabled or disabled. As of version Version 2023.2 June 2023. This is a recent addition, it did not exist in version 2022.3 from Dec. 2022.
Bad UI: the app does not support Landscape/horizontal mode, it always runs vertically. As of app version 2022.3 December 2022
Good: You can use either your own Custom DNS or the Mullvad app DNS content blockers, but not both. If any of the content blockers are enabled, the app (v2023.2) makes it impossible to do anything with the Custom DNS feature. This avoids confusion and is better handled than IVPN.
Good: Unlike IVPN, the app is very much aware of whether the device is on-line or off-line. Here is a screen shot of Mullvad app version 2024.8 on Android 14 from Nov. 2024. The main status is "Blocked Connection" and at the top, it says "Blocking Internet". Since the device is off-line, there is really nothing to block, so, eh. But, if you read the fine print it says "Your device is offline. The tunnel will automatically connect once your device is back online." While, I would have not used the word tunnel, still, this is pretty clear about what's going on.
Good: The app self-identifies easily. One click on the settings gear icon and you can see which version of the app you are using.
Bad: I leave the VPN app running and connected all the time on an Android 10 tablet. When the Wi-Fi is disconnected, the app detects this and says that it is blocking everything. When the Wi-Fi is re-enabled, the app detects this too, and automatically re-connects to a VPN server. There is however, one small issue. A number of the apps on the tablet create alerts. After the VPN has automatically re-connected, there are no alerts. I wait and wait and no alerts. As soon as I manually disconnect the VPN, all the alerts show up. I then re-connect the VPN manually and all is well. Till the next time. As of app version 2023.2 June 2023.
Running app version 2023.2 in July 2023. This was not the latest version of the software, there was a 2023.3 available. The app did not tell me that a new version was available. The new version, however, did show up in the Google Play Store.
Version 2023.3: The app does not support Favorite servers. If you want to connect to a VPN server in the US, you have to scroll through a long list of countries before you can pick a city in the US to connect to. (July 2023).
First use: This is what you see when start their Android app for the first time
FYI: Their documentation:
Install Mullvad app on Android Last updated: March 10, 2022. You can get it from the Play store (of course) or you can download the apk file from the Mullvad website or you can install it with the F-Droid app.
Using Mullvad VPN on Android Last updated: October 14, 2022

Mullvad on iOS

The Mullvad app version 2024.3 (introduced in May 2024) finally introduced a feature that I wanted for a while - Custom Lists. These are lists of your favorite VPN server locations. Your lists appear over the master list of all server locations, which is huge and sorted alphabetically. Prior to this feature, I had to scroll through the long master list, to find servers in the United States and the United Kingdom. Anyone living in Australia or Belgium had no problem :-).

The below is as of iOS 17.2 and Mullvad app version 2023.8, both were current in January 2024.

Good: The app version numbering system is the same excellent system as on other operating systems. The current app version is displayed as soon as you go int o the Settings.
Good: The main app window shows the number of days left in your Mullvad VPN subscription.
Good: They offer DNS content blocking for Ads, Trackers, Malware, Adult content, Gambling and Social Media. Each category of blocking can be individually enabled/disabled. However, the user interface is a bit confusing as the color Green indicates that blocking is on for a category, not, that the category is allowed to be displayed. To me, when I saw Gambling (for example) and a green color, I thought it meant that Gambling websites were allowed. Just the opposite.
Mixed: There is a custom DNS option, but all you can provide is an IP address. It is not clear if they take IPv6 addresses. By not allowing a server name, they do not support Secure DNS for your custom DNS.
Mixed: As for automatically re-connecting when an off-line device goes back on-line: If the VPN was active when the device went off-line, it will automatically re-connect when the device goes back on-line. While the device is offline, the Mullvad app says "NETWORK ISSUES - Your device is offline. The tunnel will automatically connect once your device is back online." Pretty clear. But, it also says "blocked connection" which is mis-leading. Also while off-line, there is a "Disconnect" button which I also find mis-leading. Disconnect, in this case, means do not automatically re-connect.
Good: Reporting a problem is a feature built into the app. An email address is not required. You can, optionally, enter a problem description. You can also view the app logs without reporting a problem. Two issues however: when viewing the logs in the app, the entries wrap around making it very hard to read, and, there is no option to save the logs so you can review them later.

Mullvad on ChromeOS

February 2023: I have the Mullvad Android software (v2022.3) installed on a Chromebook that I often use horizontally (landscape mode). The software can't handle that. Every time it runs, the screen is rotated sideways because the software can only run in portrait/vertical mode. It's getting pretty annoying.

PROTON VPN

ProtonVPN on Windows 10
Software version 1.26.0 March 2022

--The software update process is excellent. You are notified that a new version is available but you are not forced to update. You are told about the new features before doing the update. The update process is painless, just click on a link and, if running as a restricted user, enter the password for an admin user.

--There is a quick connect button that connects you to a fast server that is chosen for you. You can also configure profiles to connect to specific servers. You can not have a profile connect to a specific US state, only to an individual server in the state. That is, you have to pick server TX#34 or TX#35 rather than Texas. The profile also lets you chose the type of VPN: WireGuard, OpenVPN with TCP, OpenVPN with UDP or Smart, which lets them chose for you. Smart is what they suggest. Before you connect, there is a list of your profiles. For each profile, it shows you how busy that specific server is, both as a graph and as a percent. A percent of what? It does not say. Maybe CPU usage, maybe bandwidth, maybe both. Dunno.

--While connected, you can see the pubic IP address of the VPN server you are connected to, the data transmission rate, the total amount of data sent/received (referred to as "Volume"), how long you have been connected and the type of VPN. Some of this information is only shown on the map which makes no sense. What is really nifty is that it shows the current load on the server (again, load of what?). So, the server you are connected to may have been lightly used when you first connected, but now it could be very heavily used so you may want to connect elsewhere. It is very rare to see current server load information in real time.

--Navigation within the app is annoyingly inconsistent. There are two tabs, Countries and Profiles. Fine. But all the other stuff is scattered. Some of the other options exist as small buttons in the Countries tab. The rest are accessed with the three horizontal lines in the top left corner, then clicking on Settings. It is as if one group created the app, then it was turned over to a different group to maintain it and they had different ideas on navigation. One small button in the Countries tab is an on/off for the Secure Core feature. Another is for NetShield which can be set to block nothing, block only malware or block everything: ads, trackers and malware. The last button configures the Kill Switch which can be On, Off, or Permanently On.

--There is a custom DNS option but it only takes an IPv4 address for input. It claims to support Private DNS but all private DNS providers give you a host/server name, no one uses IP addresses This seems half baked.

--A big part of the user interface is a map of the world that struck me as useless and lame. While I was connected to the West coast of the US, the map showed me in Kansas. You can get rid of it (look for a tiny arrow pointing to the left).

ProtonVPN on ChromeOS (Chromebook)
Android app version version 4.3.52.0 | ChromeOS version 105 | November 2022

--Problem connecting: I installed a new copy of the ProtonVPN app on a Chromebook and logged in. The Internet connection was working fine, but the app would not connect to any VPN server. Worse, it would fail repeatedly. I tried both a VPN profile and the Quick Connect option. I changed the system wide DNS to a different provider. Still failed. There is an option in the app to display the log file, but the log text was too small to read and it was not possible to copy the log text anywhere. I reported the problem through the app and the problem report included the log. However, when ProtonVPN responded, it was clear that the log did not provide nearly enough information to understand the problem. They asked for my location, the servers I tried to connect with and more. Rebooting the operating system fixed the problem. However, it was not a one time fluke, because the same thing happened shortly after the reboot. My guess is that it has something to do with the Chromebook waking up from a sleep state.

--Smart Protocol is stupid: The above problem pointed up another problem with the Android app. I did some more debugging and found that OpenVPN and IKEv2 worked fine. Whatever the problem was, was limited to WireGuard and their home-grown Stealth protocol. All my initial tests were done with the default ProtonVPN "Smart" connection. This is supposed to mean that the app chooses among the many supported VPN protocols. My experience shows that the app is not smart enough to try making an OpenVPN connection or an IKEv2 connection when an initial WireGuard connection fails. Adding on more stupidity, it keeps trying to make a WireGuard connection over and over and over. It did not stop until I told it to stop.

--Problem handling is amateurish: After some emails back and forth it turns out that there is a known bug with ChromeOS after it wakes up from sleeping. Fine. No one expects everything to be perfect. But, then what? There should be a public web page where I can go and check on the status of the problem. There is not. Proton should keep track that I am one of the people who experienced the problem and they should email me when its fixed. They do not do this.

ProtonVPN on Android
Initial testing: Android app version version 4.3.52.0 | November 2022

Update Oct 2023 with the free version of ProtonVPN. Free users do not get Netshield the ad/tracker blocking feature. Free users are limited to 3 countries. There is no Custom DNS feature. Tested app version 4.7.91.0 on Android 14.
The app design is confusing. It starts out with three tabs, Countries, Map and Profiles. Fine. But there is no tab for the current status, instead the status is overlayed on top of whichever tab you happened to be on when you connected. You see the heading for a tab, but none of the data for the tab. The current status display should be its own tab. Nowhere does it use Green to indicate that you are connected. The biggest visual clue of a current connection is a big red Disconnect button.
Current status: Missing from the current status display is the country you are connected to. You have remember that servers that start with ES are in Spain and those that start with CA are in Canada. Even when you know the country it is frustrating because it does not tell you the city. There are profiles for fastest server in a country and a random server in the country. When these are connected, you are only told a server number, not the city.
Profiles: profiles do not include NetShield. I think they should. Also, the current NetShield setting is pretty much hidden until you make a connection, at which point it is part of the Current Status display. In the list of profiles, clicking on a profile does not start it, rather it edits the profile. Since there is an edit thingy (three periods in a row is not at all obivious) I would rather have a press/click on the profile name start it and get rid of the current Start button.
Server busy: The app shows how busy a server is after you connect to it which is great. The before part is not consistent. If you connect from a list of servers in a country, you can see how busy the server is before connecting. Sadly, if you connect from one of your profiles, you do not see how busy the server is beforehand. Also, when you create a new profile, you do not see how busy a server is. If you go to the country list and find a server that is not busy, when you go back to create a new profile, you can not easily find the server again. You have to scroll through the list of all servers. In the US this list is huge.
Colors: the use of color is not consistent. In the server list, green is good, yellow is pretty busy and red is really busy. But, these same colors are randomly assigned to profiles where the meaning has nothing to do with how busy the server is. The random colors seem to have no meaning, as far as I can tell. By default, profiles should have the same color and no profile should be allowed to use red, yellow or green. Nothing wrong with color coded profiles as a rule, it is just not consistent in the app.

ProtonVPN on iOS version 15.5
Software version 3.1.3 May 2022

--User Interface: There are five buttons along the bottom. The easiest is Quick Connect which connects to whatever VPN server the software thinks is best. Countries is self-explanatory, which you click on a country you see the list of all their servers in that country. For each server you see the city it is in and a percentage, which I have to assume is how busy the server is. Click on a server to connect to it. The Map button strikes me as useless.

--Profiles: The Profiles button presents a list of profiles. You are not shown the type of VPN used by any of the profiles. Profiles that connect to a specific server, only show the country and the server number. They do not show the city where the server is. Even when editing the profile, the city is not shown. You can make up for some of this missing information in the name of the profile. Instead of one specific server, a profile can also connect to the Fastest server in a country or a random one. After not using the app for a while, I could not figure out how to edit a profile. There is an edit button tucked away in the corner of the screen.

--Features: The app supports WireGuard, IKEv2, OpenVPN with UDP and OpenVPN with TCP. The default is "Smart", which means the app chooses the protocol for you. The NetShield feature can block either malware alone or malware, ads and trackers (great). There is a Kill Switch and an option to Allow LAN connections (I did not test it). Debugging is built into the app. In the Settings section, it can show three different logs: Application, OpenVPN and WireGuard.

--While connected: a green stripe (good color choice) confirms the VPN is connected. You see the public IP address of the server, the city it is in, its number, the protocl being used and how long the VPN has been connected in what seems to be HH:MM:SS format. Again, nothing is explained. The Quick Connect button changes to a Disconnect button while the VPN is connected.

--Problems: The Always-on VPN option is not an option. Its always on. I don't like this on a conceptual level. Also, I suspect it may not interact well with the Airplane Mode feature. Worse is that in testing I did in May 2022, the VPN seems to have leaked. In fairness, I suspect this is an iOS problem not a ProtonVPN problem. However, their tech support has been less than ideal. The details are here.

ProtonVPN on an Android Fire Tablet
VPN app version version 4.4.73.0 November 2022

The software on FireOS is drastically different from both the Android and iOS apps.No fancy features at all. There are flag buttons for the available countries and you connect by clicking/pressing on a flag. That's about it. See a screen shot of what it looks like when not connected. You can see how busy each server is before connecting or just click on a country. There is no choice as to the type of VPN and it does not even tell you what type of VPN connection it has made (OpenVPN? WireGuard?). This is what it looks like when connected.

ProtonVPN Cancel an Account
December 2022

My ProtonVPN account is configured to automatically renew when it expires. Disabling the automatic renewal seems to be impossible. There is nowhere in the website Dashboard to stop the automatic renewal. I tried to delete the credit card on file, but it would not allow this. I went to the Payment Options page in their tech support section and struck out there too. I tried to do a Chat from the website Dashboard but no one was available. So, I had to submit my How To question as a tech support ticket. Waiting to hear back. This just confirms my decision not to renew.

Proton responded very quickly and said "Kindly note that all Proton plans are renewed automatically unless the subscription is canceled prior to the renewal date. If you'd like to avoid an auto-renewal the next time around, you'll need to cancel the subscription in the Dashboard tab of your account ... However, please note that all plan changes are immediate and irreversible, therefore we advise you to cancel the subscription near/on the expiration date of your current plan. If you'd like, we can also remove the payment method on our end. In that scenario, the subscription will still renew if not canceled on time, however, you won't be charged automatically for the renewal." What does it mean to renew and not be charged? I don't care any more.

OVPN

OVPN on Windows
Software version 2.0.0 and 2.1.0 April/May 2022

--Installation: There is a huge installation problem. Now that their software includes WireGuard, it MUST be installed while logged on to Windows as an administrator. It can not be installed if the currently logged on Windows user is restricted/standard. In and of itself, this is not a huge big deal, but two decisions by OVPN make it much worse. The first is that they don't tell you this. You have to complain to tech support that the installation failed, provide them with debugging information (which you have to do on your own, unlike when the app is running) only to find out later the real cause of the problem. Both the software and their website should warn people about this, neither does. Adding insult to injury, when the software detects a new version, it will not let you continue to use the old version. This is no way to run things.

--Features: The interface for picking servers manually is great, it shows both how busy each server is and the ping time to the server (screen shot). On the other hand, the scrollbar for scrolling through the list of servers is much too narrow. It can also chose the best server in a country of your choice, or just chose the best server, period. Once connected, there is no indication of how busy the server is. Usually you can pick individual servers to connect to, but on one computer, it only let me connect to the best server in a specified country, not sure why. There is a question mark next to every configuration option that takes you to a dedicated web page with an explanation of what that option is. Great. (screen shot). There is a Support feature that lets you describe a problem and report it to them, optionally with logs and diagnostic data. Nice touch. There is also a button to show the log files. The software keeps two different types of logs on your computer. The Kill Switch is on by default (good). IPV6 is off by default (good). Launch on boot is on by default (not my preference). The software supports OpenVPN and WireGuard. OpenVPN is the default and it can run with either UDP or TCP which is pretty standard. Only a single port is supported for OpenVPN (but they are different for UDP and TCP). While connected, the app has two different graphs of bandwidth usage. There is an icon in the system tray. When connected, it is green, when disconnected it is yellow. Good choice of colors. When connected with OpenVPN, you can not access devices on your LAN. Tech support was great when I asked about this, they said that with the WireGuard software from WireGuard, you can connect with LAN devices. I did not try it.

--Wireguard: Wireguard is a constant problem with OVPN. Very often it fails to connect due to key management. Other VPN providers do not seem to have this problem and I do not fully understand it. To fix it, you have to logon to the OVPN website and expire old keys. The error handling for this is not the best. For example, the first time I tried to connect with Wireguard on a Windows machine, it just ignored me. There was no error message and no VPN connection either.

OVPN on Android version 12
App software version 0.8.0 released Feb. 10, 2022. Observations from May 2022

Originally OVPN relied on open source OpenVPN software on Android. Now, they now have their own app (it was first released in 2020). The app only supports WireGuard and has relatively few features. That said, it does have two features that I consider important: it can block ads and trackers (always does both) and it can hide you on the LAN. On the other hand, I did not like how it handles WireGuard keys. While you can install the OVPN software on an unlimited number of devices, there can only be six active WireGuard keys and I often maxed out. When this happened, the app failed to connect and the error message was useless. More than once I had to logon to their website and delete one of the active WireGuard keys before I could connect.

--Connecting: VPN servers can be chosen for you automatically, or you can pick your own manually. The automatic approach requires you to first choose a country, then the software will pick a server in the country for you. Each country is identified with a "ms" number. What the number is, they don't say. It is probably the ping time to a server in the country. To pick a favorite server (it does not keep a list of your favorites) manually you first select a country, then it shows all the cities in the country with, again, a ms number. When you select a city, it shows all the servers in that city along with a percentage, which I assume is the server load. Based on using their Windows software, their servers are never very busy, which is great.

--While connected: it shows the city, country and IP address of the VPN server (screen shot). It also shows how many minutes you have been connected. Nothing else. There is no speed or bandwidth information. It is annoying that the blue circle rotates all the time. On Windows, a similar blue circle only rotates when making a connection, then it stops once connected.

--Configuration: There is a toggle option to Block ads and trackers. There is another toggle option to "Communicate with LAN devices". i did not test this.

OVPN on iOS version 15.5
App software version 0.5.0 dated Feb. 2022. Observations from May 2022

The user interface on iOS is, by and large, a duplicate of the user interface on Android (see above). Here too, only WireGuard is supported. As on Android, there is an option to block ads and trackers (only does both). However, it does not have the an option for blocking LAN side communication. Maybe this is unnecessary as a recent addition to iOS was the ability to block LAN side communication? I am not sure.

WINDSCRIBE

Account types

December 2022: Windscribe offers three types of accounts: free, full service and half service. The "half" option deserves an explanation. For $2/month you can access their servers in only two countries. You pick the countries and you can change them later. In each country, you get access to all their servers. If want to use 3 countries, it costs $3/month, 4 countries is $4. At some point it makes more sense to use their full service. The "half" option is limited to 30 gigabytes of data per month. The main window of the app tells you the amount of data left in the current billing period. It is also limited in its use of the R.O.B.E.R.T. DNS feature (which is a great feature, by the way). A "half" account is allowed to use R.O.B.E.R.T. to block malware, ads and trackers, but that's it. A full account has access to about 7 other categories of R.O.B.E.R.T. blocking. A full account can also block 1,000 specific DNS names (domain or sub-domain) A "half" account can only block 3 DNS names. If nothing else, a "half" account is a very cheap way to kick the tires on the Windscribe software and service.

Needless to say, they don't call it a "half" account. In their Android app, they call it a "30 GB/Month" plan and on their website, they call it a "Custom plan".

Windscribe on Windows 10
Software version 2.3.16 April 2022

It does not display workload information for individual VPN servers (their Android app does). There is a link to download the software at windscribe.com/download but there is no link to any installation instructions. That said, the installation process is painless. On Windows 7, there is no way to get an icon for the software in the system tray. You either see the software on the task bar or you see nothing at all. And, while the taskbar entry does change to indicate the connected status, the change is very subtle and easily missed. On Windows 10, there is a system tray icon. Some setup options are in the section with the list of servers, other options are in different sections you find in the hamburger menu. So, inconsistent. The index of sections in the hamburger menu is icons rather than words which I find a constant annoyance. The list of countries to connect to seems haphazard and is a lot to scroll through. The software can be installed by a restricted/standard user and yet it includes Wireguard. This is different and much better than OVPN (above). The app is ugly. The app does not have a standard Windows title bar which makes it hard to move it around the screen. It is hard to scroll in the app because the scrollbar is far too narrow. Tip: make the app window taller to avoid vertical scrolling.

--Features: There is a MAC spoofing option, which is unusual and might be a good thing, but there is no explanation of it in the app. There are five different VPN protocols to chose from. It is confusing however that OpenVPN with UDP is called UDP (same for TCP) in the app, so unless you do some homework, no idea it is OpenVPN. Dumb design. Two off-the-beaten-path types of VPN it supports are WStunnel and Stealth. WireGuard and OpenVPN are supported on five different (fixed) ports, which is great. IKEv2 has to use port 500, such is the protocol. Before connecting it does not tell you how busy each server is, but it does show the ping time. This is not all that helpful in finding a city/server close to you. There are no profiles. There is an option to Kill TCP sockets after connection. This is rare and a very good thing. It insures that existing connections between Windows and the Internet are terminated when the VPN is activated, so that everything is forced to use the VPN tunnel when communicating with the Internet.

--DNS: You can use a custom DNS while connected to the VPN which is nice. Their normal DNS service, ROBERT, blocks many ads and trackers. When I need to do something that ROBERT blocks, there is no need to update the ROBERT rules (but you can). Instead, I specify another DNS service in the "DNS While Connected" field. This requires disconnecting and re-connecting before it takes effect, which you are not told.

--While connected: The software tells you very little about the current connection. It does not tell you how long you have been connected, the total data uploaded/downloaded, the current speed or how busy the server is. It does tell you the public IP of the VPN server, the type of VPN (IKEv2 seems to be the default) and the port number. When you disconnect, it tells you how long you were connected and some other bandwidth number. Not sure about what that number is because it is displayed for only a second, literally. Update: By accident, I discovered that if you hover the mouse over the type of VPN or the port number, there is a pop-up telling you how long you have been connected (with no label as to hours or minutes, just a string of numbers) and the amount of data transferred. In which direction(s) was this data transferred? Don't say.

--Firewall: The kill switch is called a firewall, a constant annoyance. There is a toggle for it in the main part of the app. One way the indicator is white/black, the other way it is white/blue. Which is on and which is off is not obvious at all. Elsewhere in the app, ON is indicated by green/black, so inconsistent.

--There is a toggle option to Allow LAN traffic but there is no documentation on it. I searched their Knowledge Base for the option and came up empty. Seems to not work. With it set to OFF, I was able to get to the web interface of my router. I was also able to run a LAN scanning program and see other devices on my LAN. Worse, a LAN scanning program on another device was still able to see my VPN connected PC. This is bad. Tech support at Windscribe said "The logs ... show that you did disable the Allow LAN Traffic option but, the firewall was turned off ... Therefore, despite having the Allow LAN traffic option disabled, when the firewall is deactivated, you will still be able to access your LAN resources" Again, when they say "firewall", they mean Kill Switch. So, somehow the Kill Switch needs to be on for LAN traffic to be blocked. Again, there is no documentation on this which is disgraceful. With the Kill Switch on, some things were blocked, others were not. Ongoing....

--Un-install: An un-install of the app leaves information behind. I used it for a bit, uninstalled it for a while, then when I re-installed the software, there was no need to provide my Windscribe userid/password. It was still on the computer.

--Log file: You can view the log file in a font that is readable. You can also export the log file, so all good.

--Upgrade: I upgraded to version 2.4.10 in November 2022 and lost my favorite servers. Not the first time that upgrading has wiped out the favorite servers. Turns out this was even worse. The next day, after re-booting Windows, my just-recreated list of favorite servers was gone again. Surely a bug.

--December 2022: software version 2.5.14 on Windows 10

Windscribe is starting to add links in the app to web pages that describe some of the options. Not all, just some. Here is the link to the Firewall feature and the Connection mode feature. Sadly, both are bad. What they call a firewall is a kill switch. If they want to argue that their kill switch is better than others, fine. But don't call it a firewall. The link to the Firewall explanation is only in the Settings section, not on the main window for the app, where you see the Firewall status. And the status is either blue or black. Which is on? Which is off? Its not obvious to me. They use ON/OFF to indicate the VPN connection status and they should the same for the Firewall/Kill Switch status. In the app, there is an option for Connection Mode and its an important one. But the web page describing this calls it Flexible Connectivity. One name is enough for any particular feature.

The display of the software version is still hidden at the bottom of the General section rather than being in the About section where all other software puts it. There is an App Skin option (I can not explain where it is as the different sections in the Settings make no sense to me) that can be set to either Alpha or Van Gogh or classic or earless. Yes, there are four names for two options. And no explanation for any of it. What miserable UI design. I suggest Van Gogh.

As for debugging, Help -> View debug log works well. It shows the log in a font that I can read and lets me easily copy the log data and/or save the log file. But, the log records are timestamped in a date format that makes no sense. And, the time on the log records is not in my local time zone, so I could not, at first, figure out either the date or time that the log records are from. To figure out this puzzle, I had to save the log file. It turns out the Log file display is quite different from the underlying log file data. The underlying file has data from multiple days which made the date format obvious. It had log records going back a couple weeks. The format is DDMMYY. The log also has a record with "App start time" that displays the date/time in an obvious format using the time zone of the computer.

A nice feature of the software is that when your subscription is a few days away from expiring, there is a notice on the main display telling you how many days are left in your subscription (screen shot). Of course, there is also a button for Renewing.

The software also handles the notification of a newly released version well. It puts up a notice about the new version on the main display (screen shot). It is not in your face and you are not forced to update immediately. It is just an FYI.

FYI: Changelog for the Windscribe Windows software: windscribe.com/changelog/windows

Windscribe on iOS version 15
App software version 3.0.0 (262) April 2022

The lack of explanation is a huge issue. Before connecting, some servers have a number next to their name which I assume is the ping time. I have to assume because there is no column heading in the display. Some servers have no number, what that means is a mystery. When I connect to a VPN there is a huge warning "This network is unsecured". What that means, I have no idea. It is not even clear if the message refers to the local Wi-Fi network or the VPN server it is about to connect to. The expanded explanation under this message is: "Unknown is unsecured, meaning you don't wish to use Windscribe while on this network" WTF? After a few times, the "unknown" was replaced with the SSID in my home, so its not complaining about the VPN server. What does it think is wrong with my home network? No idea. Its WPA2 Personal and, trust me, quite secure. While connected to the VPN, the app provides no information at all. For assorted toggle switches, the app uses black/white to indicate OFF and green/black to indicate ON.

--Features: The option to "Show Location Load" is off by default. When enabled, the app shows a green line of varying length under each section of a country (i.e. Canada West) and a green line under each server. What is the green line? Is a longer line better than a shorter one? None of our business, there is no explanation. The app supports three types of VPN: IKEv2, WireGuard and OpenVPN (on either UDP or TCP). With both WireGuard and OpenVPN, six different connection ports are available, a nice defense from blocking.

Windscribe on Android version 12
App software version 3.1.887 May 2022

--Compared to their Windows software, the Android app has a better user interface. See a screen shot of the app. When you first login, there is an option to display the password as you enter it. This is helpful for those of us with long passwords.

--DNS: You can configure R.O.B.E.R.T categories (their DNS system that blocks ads/trackers and more) in the app. To configure specific DNS allow/deny exceptions, the app takes you to their web site. Fine. However, the use of R.O.B.E.R.T is mandatory, there is no Custom DNS option. (verified Oct. 2023 with app version 3.74.1243 on Android 14). R.O.B.E.R.T is a great DNS system but if you already have customized NextDNS profiles, this is not for you. Also, R.O.B.E.R.T has no logging, which NextDNS does offer.

--It takes some tweaking, but the app can show both the load and the ping time for each VPN server. The big down side is that there is no easy-to-find documentation on the configuration options. There is a Help section in the app but that links to general help that is not focused on the options in the Android app. OVPN was much better at documenting each configuration option. That said, the version number of the software is in the General section (scroll to the bottom) rather than the fairly standard About section. Also, it does not do landscape mode.

--Configuration General options: I always change the "Display Latency" from Bars (the default) to Ms. This takes effect immediately if you are currently connected to a VPN server. One one Android device the Ms did not display at all. Another device was fine. I did not investigate. The "Show Location Load" option is OFF by default. Turn it on. It adds a green line underneath each displayed VPN server. The problem, however, is exactly what does the green line indicate? Is a long line (more green) better or worse than a short green line? If green is good, then more green is better? Or, is it showing the load on the server, in which case a shorter line is better and they should not have chosen a bright green color. This change also takes effect immediately, even if the VPN is active. The option for Haptic feedback is ON by default, I always turn it off. There is a toggle option for "Notification stats" that does not seem to do anything.
Speaking of toggle options, they are too hard to toggle. The slider is much too small. The list of servers is presented in geographic sequence by default, which I find sub-optimal. I suggest changing the sort order to Latency so that countries near you sort to the top. That said, this sequencing is far from perfect. Eventually the sorting sequence won't matter to you as you can set Favorite VPN servers that display in their own section of the app. That said, I have lost my favorite VPN servers many times, the last time a password reset wiped them out.

--Configuration Connection options: Connection Mode is perhaps the most important option in this section. It defaults to "Auto" which, in turn, defaults to IKEv2 and port 500. If you opt for Manual, you can chose other types of VPN connections (such as WireGuard) and also pick from a small list of allowable port numbers.

--While connected: It says "ON" which is good. It also shows the type of VPN connection (such as WireGuard or IKEv2), the port number and the public IP address of the VPN server. There is no bandwidth information while connected.

--Location Load: Windscribe has a comprehensive status page at windscribe.com/status. I mention it because it too has green lines underneath each VPN server. It also shows the load on the server as a number which makes it obvious that shorter green lines mean a lesser load.

--LAN traffic: Tested Nov. 2022 using app version 3.3.1003 on an Android version 10 tablet with Android patches as of June 2022. With the VPN off, I was able to see many devices on my LAN and I was able to communicate with my NAS. Then I connected the VPN which was configured with "Allow LAN traffic" OFF. It seemed to work, a scan of my LAN now showed only the router, the other devices did not appear. I was also not able to ping the NAS. But, that is only half the story. A device on my LAN was able to see the VPN-connected Android tablet when doing a LAN scan. It was also able to ping the Android tablet. So, FYI, this option works for data going out, but not for data coming in.

Windscribe on an Android Fire Tablet
VPN app software version 3.4.1085 November 2022

The VPN client on FireOS has pretty much the same user interface as their Android software.

April 2023: My router blocks some IP addresses and logs all attempts to connect to them. Without the Windscribe app running, the router detected that the Fire Tablet frequently tried to make outbound connections to some IP addresses on my banned list. It would both Ping the IP address and try to make a TCP connection to port 443. It did this often enough that it flooded the log in my router and I had to un-install the Windscribe app. I could have just stopped logging anything from the Fire Tablet, but I don't like that it was phoning home when the app was not even running. The IPs that the tablet tried to contact all belonged to Windscribe, this was not anything like Facebook pixel spying. Still, the app was not running.

This page: 7 views per day (over 441 days) Total views: 3,270 Created: November 12, 2023

This Page
Last Updated
November 21, 2024

Site Page
Views TOTAL
1,080,323

Site Page
Views TODAY
283

Website by
Michael Horowitz
@defensivecomput

top

Copyright 2019 - 2025