VPN

---

name: VPN description: Configure and troubleshoot VPN connections for privacy and remote access. metadata: {"clawdbot":{"emoji":"🔒","os":["linux","darwin","win32"]}}

---

Privacy Misconceptions

VPN shifts trust from ISP to VPN provider — provider sees all traffic, not eliminated

"No logs" claims are marketing — unverifiable without independent audits

VPN doesn't provide anonymity — browser fingerprinting, account logins, payment methods still identify

Free VPNs monetize traffic data — if not paying, you're the product

Self-hosted VPN exits from your IP — no privacy benefit, services see your home address

DNS Leaks

DNS queries can bypass tunnel — reveals visited sites despite encrypted traffic

Test after every setup — leak test sites show if DNS goes through ISP instead of tunnel

System DNS settings may override VPN — force DNS through tunnel in client settings

Kill Switch

Brief VPN disconnects expose real IP — happens without user noticing

Kill switch blocks all traffic when tunnel drops — essential for privacy use cases

Test by forcing disconnect — traffic should stop completely, not fall back to direct

Split Tunneling Risks

Misconfiguration sends sensitive traffic direct — defeats VPN purpose

Full tunnel safer default — split only when deliberately excluding specific apps

Local network access often requires split — printing, casting break with full tunnel

Protocol Traps

PPTP encryption is broken — trivially cracked, never use regardless of convenience

UDP blocked on some networks — TCP fallback needed for restrictive firewalls

WireGuard uses fixed ports — easier to block than OpenVPN on 443

Mobile Issues

WiFi calling fails through most VPNs — carrier limitation, not fixable

Banking apps detect and block VPN — may need exclusion in split tunnel

Battery drain varies significantly — WireGuard most efficient by large margin

Connection Failures

"Connected" but no internet — usually DNS misconfigured, not routing issue

Works on phone not laptop — local firewall or antivirus interfering

Constant reconnects — try TCP instead of UDP, increase keepalive interval

Self-Hosted Traps

Exit IP is your home IP — services see where you live, no geo-bypass benefit

Requires static IP or dynamic DNS — clients can't find changing endpoints

Unmaintained server becomes liability — security updates are your responsibility