For inbound traffic, when the tunneled data is decrypted by the VPN server it is forwarded to the firewall, which employs its filters to allow the traffic to be forwarded to intranet resources. Because the only traffic that is crossing the VPN server is traffic generated by authenticated VPN clients, firewall filtering in this scenario can be used to prevent VPN users from accessing specific intranet resources.
We also like how easy it is to connect, and how clear and accessible the settings are, on all platforms when using the IVPN app. (ChromeOS has an option to use a less-secure VPN protocol with most providers, including IVPN. But TorGuard, our budget pick, supports the more secure OpenVPN on Chromebooks and tablets.) If you do want to tweak some settings, IVPN has easy-to-understand checkboxes for most options. For example, the kill switch (labeled “firewall”) has an easy on/off toggle. Anytime it’s on and the app is open, all traffic in and out of your computer will cut off if you forget to connect to the service or the secure connection drops for some reason.
In conjunction with information security experts at The New York Times (parent company of Wirecutter), we reached out to our finalists with questions about their internal security practices. We asked how they handled internal security access, how they communicated securely with customers, in what ways they collected reports on security bugs, and of course whether their statements on logging policies matched their marketing and privacy policies. We also considered which companies had public-facing leadership or ownership, and which ones openly supported projects and organizations that promoted Internet security and privacy. (For a full breakdown of trust and VPNs, check out the section above.)
Jurisdiction – PureVPN has a fairly strong jurisdictional advantage. Hong-Kong is far from the watchful eyes of European governments and the 14 Eyes alliance. The state of the Internet in Hong Kong is one of the freest in the world. The government in Hong-Kong does not sweep online content under the rug of censorship. However, acts like distribution of child pornography are criminalized (as they should) by law and fall under the cloak of censorship. So, the jurisdiction of PureVPN should be a reason enough to compel privacy-conscious users to get this VPN.

TunnelBear VPN is a free service that constantly impresses people. This VPN is super-secure and even opened up its software to a third-party analysis last year. The outcome? Security researchers found the VPN to be secure and reliable. It also keeps no logs. Unfortunately, The service is restricted to just 500MB per month. Despite this, it is brilliant for locations with severe censorship and where privacy is essential. It is perfect for securely unblocking news.
Speed Test – The Internet is only as good as how fast it operates. I recently conducted a research where I tested 15 popular VPN providers for speed, using different servers in major countries. The speed you get on the Internet from a VPN is almost always lesser than what you would get without it. This is simply a result of the way VPNs work. However, the leading VPN services only cause a small reduction in VPN speeds, not more than 30% of your usual connection speed. Thus, speed is one of the main criteria I used to evaluate VPNs here.
For PPTP and Layer Two Tunneling Protocol (L2TP), a tunnel is similar to a session. Both of the tunnel endpoints must agree to the tunnel and must negotiate configuration variables, such as address assignment, encryption, or compression parameters. In most cases, data transferred across the tunnel is sent using a datagram-based protocol. A tunnel management protocol is used as the mechanism to create, maintain, and terminate the tunnel.

Logging Policy – This is a tricky subject. The record of PureVPN is not quite clear of controversy, as the company was involved in a case of handing over a particular user’s information to the FBI. However, the particular incident in question was an ethical conundrum, where human rights of a bullied individual were at stake. I can’t really condemn PureVPN for playing its part in helping agencies catch a suspect of reprehensible cybercrimes. In fact, PureVPN has responded admirably to the whole incident with a change in its policies to prevent similar ethical dilemmas in the future. The company probably doesn’t enjoy playing Aristotle and resolving convoluted ethical problems for its own sake as well as for its users’.


If the VPN server is behind a firewall, packet filters must be configured for both an Internet interface and a perimeter network interface. In this scenario, the firewall is connected to the Internet, and the VPN server is an intranet resource that is connected to the perimeter network. The VPN server has an interface on both the perimeter network and the Internet.
CyberGhost has been around since 2011 and has come out strongly as a supporter of "civil rights, a free society, and an uncensored Internet culture." We really liked how the company specifically showcases, on their Web site, how folks normally prevented from accessing such important services as Facebook and YouTube can bring those services into their lives via a VPN.
If you’re on a heavily managed Internet connection, be it government censored or just college Wi-Fi, standard VPN connections may be blocked or throttled due to deep packet inspection, a way for providers to analyze what type of traffic is passing over a network even when they can’t see the actual contents. IVPN’s desktop apps include a checkbox for Obfsproxy, which disguises your traffic as more ho-hum data to get it past those types of blocks—like kids stacked in a trenchcoat to pass as an adult, but more convincing. Our budget pick, TorGuard, and competitor ExpressVPN use different methods to disguise traffic, but we couldn’t find documentation on equivalent features from our other top performers.
We considered native apps for Windows, Mac, and Android to be mandatory because they’re easier to use than open-source or third-party VPN apps like Tunnelblick; that in turn makes it easier to stay secure. For more-advanced users, adding VPN connections to Wi-Fi routers can help secure all connections on a home network without having to manage devices individually.
Logging Policy – IPVanish has been involved in a case where the company handed over user information to Homeland Security. The user was suspected of involvement in child pornography. Again, commenting on the decision of IPVanish to assist agencies in catching a suspect is an ethical gray area that I choose my readers to discuss on what they think in the comment section. However, the brand has since changed ownership with the company StackPath. The CEO of the company clearly stated that they are committed to the no logs policy. I think they deserve the benefit of the doubt considering that they weren’t a part of IPVanish when the case occurred.
A remote-access VPN uses public infrastructure like the internet to provide remote users secure access to their network. This is particularly important for organizations and their corporate networks. It's crucial when employees connect to a public hotspot and use the internet for sending work-related emails. A VPN client, on the user's computer or mobile device connects to a VPN gateway on the company's network. This gateway will typically require the device to authenticate its identity. It will then create a network link back to the device that allows it to reach internal network resources such as file servers, printers and intranets, as if it were on the same local network.

Final Verdict – IPVanish is a decent VPN service with one of the most appealing user-interfaces. It is fast, both in connecting to servers and during actual Internet activity. It uses the modern AES 256 bit encryption and provides up to 10 multiple logins. However, it does not work with Netflix and is not a recommended VPN for torrenting. For everything else, it is a great VPN service. You can get a detailed view in our IPVanish review.
Logging Policy – While conducting ExpressVPN review, the privacy policy is one of its strongest aspects. ExpressVPN does not log user data and takes measures to anonymize user-related information that does end in up the systems of the company for technical reasons. The company has clearly stated that they do not log any information that can possibly tell ExpressVPN the purpose for which an individual is using their VPN for. All in all, the logging policy is quite convincingly friendly towards the user.
Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) is an encrypted authentication mechanism very similar to CHAP. As in CHAP, the NAS sends a challenge, which consists of a session ID and an arbitrary challenge string, to the remote client. The remote client must return the user name and an encrypted form of the challenge string, the session ID, and the MD4-hashed password. This design, which uses the MD4 hash of the password, helps provides an additional level of security because it allows the server to store hashed passwords instead of clear-text passwords or passwords that are stored using reversible encryption. MS-CHAP also provides additional error codes, including a password-expired code, and additional encrypted client-server messages that permit users to change their passwords during the authentication process. In MS-CHAP, both the client and the NAS independently generate a common initial encryption key for subsequent data encryption by MPPE.
VPN was not the first technology to make remote connections. Several years ago, the most common way to connect computers between multiple offices was by using a leased line. Leased lines, such as ISDN (integrated services digital network, 128 Kbps), are private network connections that a telecommunications company could lease to its customers. Leased lines provided a company with a way to expand its private network beyond its immediate geographic area. These connections form a single wide-area network (WAN) for the business. Though leased lines are reliable and secure, the leases are expensive, with costs rising as the distance between offices increases.
We have tested each of these services in as repeatable a manner as possible, but it's worth remembering that networks can be fickle. To get the clearest picture of a VPN's performance, we would have to perform these tests many more times, at different locations and different times of day. We think of these tests as more of a snapshot of performance that establishes a replicable metric for measuring each service. Your mileage with these services will almost certainly vary somewhat from mine.
The country connections, meanwhile, matter most to those who want to spoof their location; however, non-spoofers should also make sure there are connections in their home country. If you live in Los Angeles, for example, and want access to American content, then you’ll need a VPN that provides U.S. connections. It won’t work to try and watch Amazon Prime Video over a Dutch VPN connection, because as far as Hulu’s concerned your computer is in the Netherlands.
NordVPN is one of those service providers that not only focus on security but super-fast VPN experience also. Within a short span of time, it has managed to come in the limelight and have been praised by many experts and got featured on highly-reputable websites like PCMag, Forbes, and The Huffington Post. With over 550 servers plotted in 49 counties, NordVPN easily made its way to our fastest VPN service list. Their servers are capable of bypassing intense geo-restriction with high-speed VPN experience. We had the chance to get help from their support team, and they set a new benchmark of proactive customer services experience. And yes, 30-day money back guarantee is another thing that is much of a consideration when you are in search for a fast VPN service, and they have it! Read more on NordVPN review and learn how they delivery top speed.
In addition to blocking malicious sites and ads, some VPNs also claim to block malware. We don't test the efficacy of these network-based protections, but most appear to be blacklists of sites known to host malicious software. That's great, but don't assume it's anywhere near as good as standalone antivirus. Use this feature to complement, not replace, your antivirus.
×