PROTOCOLS
VPN protocols and how tunnels work
These explain the machinery: which protocol does what, which cipher each one uses, why a handshake fails, and what a kill switch or split tunnel is doing underneath. Written from the specifications and the reference implementations rather than from other people's summaries.
12 articles
MTU and VPNs: why pages hang at 90 percentA tunnel shrinks the largest usable packet. When the network drops the message saying so, large transfers stall silently. How to find the right MTU.
Perfect forward secrecy, plainlyForward secrecy means a stolen long-term key cannot decrypt traffic recorded earlier. How VPN protocols provide it, and what it does not cover.
AES-256 vs ChaCha20: which cipher does a VPN want?AES wins on hardware with AES-NI. ChaCha20 wins everywhere else, which is most phones, routers and TV boxes. Neither is more secure than the other.
How VPNs get past deep packet inspectionObfuscation makes a tunnel look like something else. How DPI identifies a VPN, what the common obfuscation layers do, and what they cost.
Split tunnelling explainedSplit tunnelling sends some traffic through the VPN and some around it. The two models behave very differently, and picking the wrong one leaks quietly.
What a VPN kill switch actually doesA kill switch is a firewall rule that drops traffic outside the tunnel. What that protects, what it cannot protect, and the two places it is implemented.
UDP or TCP for a VPN?UDP is the right choice for a VPN almost always. TCP exists to get through networks that block UDP, and it costs more than people expect.
What is OpenConnect?OpenConnect is an open client for SSL VPN protocols like Cisco AnyConnect. It runs over TLS on port 443, which is why it survives restrictive networks.
IKEv2/IPsec explainedIKEv2 with IPsec is the protocol built into Windows, macOS and iOS. Why it reconnects so well on phones, and where it falls short.
What is OpenVPN?OpenVPN is a TLS-based VPN protocol that runs over UDP or TCP and negotiates its ciphers. Two decades old, endlessly configurable, and hard to block.
What is WireGuard?WireGuard is a VPN protocol of about 4,000 lines with one fixed cipher suite and no negotiation. What that design buys, and what it costs.
WireGuard vs OpenVPN: the differences that actually matterWireGuard is faster, smaller and simpler. OpenVPN is more flexible and harder to block. What each one really trades away, with the numbers.
Free, no-logs, and no card required
Native apps for Windows, macOS, Android, iOS, Android TV and Apple TV, plus browser extensions, all reaching servers VPNmine runs itself.