Disclosure: This article may contain affiliate links. If you purchase through these links, NULL PACKET may earn a commission at no additional cost to you. We only recommend tools relevant to the security workflows discussed here.
Public Wi-Fi, ISP telemetry, DNS leaks, regional restrictions, and aggressive tracking ecosystems have quietly turned VPNs from niche privacy toys into practical security infrastructure. Most VPN marketing fixates on streaming, but the real-world security story is much larger, and much more honest about limitations.
For travellers, digital nomads, remote workers, security professionals, and ordinary users alike, a VPN is one of the simplest ways to reduce exposure on hostile or untrusted networks. This guide explains how VPNs actually work, what threats they realistically mitigate, where the marketing exaggerates, and how to build practical, layered setups, including a Linux home-lab workflow, using NordVPN as the working example.
The honest one-liner: a VPN does not make you anonymous. It changes who can see your traffic moving trust from the local network and your ISP to the VPN provider. That is a genuine security improvement on hostile networks, and a meaningful limitation to understand. This article treats it as one layer, not a magic cloak.
Why VPNs Matter More Than Ever
Most people still think VPNs are only for Netflix libraries, YouTube region locks, and censorship bypass. That mindset is outdated. Modern internet use exposes users to ISP traffic monitoring, advertising telemetry, malicious public Wi-Fi, DNS tracking, geographic restrictions, hotel and airport surveillance, and credential interception. Attackers no longer need sophisticated malware when insecure Wi-Fi, rogue access points, DNS visibility, and weak operational security do the job. As covered from the attacker's side in the SOC and APT write-up adversaries consistently target people and the networks they trust rather than hardened infrastructure, because humans are the easier surface. A VPN does not make users anonymous; it reduces exposure.
What a VPN Actually Does
A VPN creates an encrypted tunnel between your device and a remote VPN server. Without a VPN, your path is Device → ISP → Internet and your ISP or local network can see DNS requests, browsing destinations, application telemetry, and activity metadata. With a VPN, the path becomes Device → Encrypted Tunnel → VPN Server → Internet: local interception becomes much harder, DNS can be protected, and geographic routing changes.
Crucially, VPNs are not anonymity systems. They do not stop phishing, prevent malware, eliminate browser fingerprinting, replace endpoint security, or make illegal activity invisible. Security stays layered; the VPN is one component.
The Public Wi-Fi Threat Model
Real scenario: airport Wi-Fi
You connect to "Airport_Free_WiFi". It looks legitimate, the signal is strong, and others are connected, but the access point is attacker-controlled. This is an Evil Twin attack. On such a network an attacker may intercept unencrypted traffic, profile connected devices, harvest captive-portal credentials, scan the local network, inject malicious redirects, or attempt SSL stripping. Travel environments are ideal for attackers: users are distracted, devices roam automatically, and trust decisions happen fast. Even legitimate hotel or airport infrastructure may still expose DNS traffic, device metadata, and local packet visibility. This is where a VPN provides real defensive value: with the tunnel up, traffic is encrypted before leaving the device, DNS is tunnelled, and passive interception becomes far harder.
Practical Setup #1: Secure Travel Workflow
Device preparation before travelling
Before connecting to any public or foreign network, enable full-disk encryption, MFA on critical accounts, automatic updates, strong device PINs, and biometrics; disable auto-join Wi-Fi, unnecessary Bluetooth, and file sharing; install your VPN, a password manager, a privacy-focused browser, and an MFA authenticator.
Recommended VPN configuration
Use NordLynx for most situations and OpenVPN for restrictive networks. Enable the Kill Switch, auto-connect on unknown Wi-Fi, Threat Protection, and DNS-leak protection. Optionally use split tunnelling for banking apps, local services, and low-latency applications.
Why Kill Switches Matter
A VPN disconnect can expose your real IP, DNS traffic, and browsing activity, and disconnects commonly happen while roaming, switching networks, moving from Wi-Fi to mobile data, or on unstable hotel infrastructure. A Kill Switch blocks all traffic from leaving the device outside the encrypted tunnel. It is one of the most important VPN controls and should always remain enabled.
DNS Leaks: The Problem Most Users Never Notice
Many users assume "VPN connected = fully private." That is incorrect. If DNS traffic bypasses the tunnel, your ISP, local router, hotel network, or public hotspot can still see every domain you visit, even over HTTPS, which hides content but not the DNS lookup unless configured correctly.
How to test for DNS leaks
After connecting, visit a DNS-leak testing site (such as dnsleaktest.com) and verify that the DNS servers belong to the VPN provider, your ISP is hidden, and there are no IPv6 leaks. On Linux you can also confirm your resolver and public IP directly:
# Confirm the DNS resolver in use and your egress IP
resolvectl status | grep 'DNS Servers'
curl -s https://ifconfig.co/json | grep -E '"ip"|"country"'NordLynx vs OpenVPN: Why Protocols Matter
VPN protocols directly affect speed, latency, stability, battery, and reliability.
| Protocol | Strengths | Trade-offs | Use for |
|---|---|---|---|
| OpenVPN | Mature, heavily audited, very stable, enterprise-friendly | Higher latency, slower on mobile, more CPU | Restrictive/filtered networks, compatibility |
| WireGuard | Lightweight, low latency, high throughput, mobile-efficient | Early designs raised static-IP/session-persistence privacy questions | Modern baseline where available |
| NordLynx | WireGuard performance plus a double-NAT system to improve privacy handling | Provider-specific implementation | Streaming, gaming, travel, everyday browsing |
NordLynx builds on WireGuard while adding a double-NAT layer designed to avoid storing identifiable session data. In practice, use NordLynx for streaming, gaming, travel, and everyday browsing; use OpenVPN for restrictive enterprise environments, compatibility requirements, and heavily filtered networks.
Practical Setup #2: Streaming Securely While Travelling
Abroad, your streaming library may disappear and subscription services may block access because platforms enforce geographic licensing. A practical workflow: connect to a VPN server in your home country; verify DNS routing, browser geolocation permissions, and time-zone consistency; and use a clean browser session, since providers cache cookies, location metadata, and browser fingerprints. Low-quality VPNs fail here, they overload servers, reuse flagged IP ranges, and lack infrastructure rotation, so streaming platforms block them. NordVPN's larger server footprint (advertised at more than 5,000 servers across 60+ countries) improves reliability for travellers and roaming users.
Practical Setup #3: Linux Home-Lab Workflow
NULL PACKET readers (me included) frequently run Raspberry Pi systems, self-hosted services, Docker environments, remote labs, and Linux infrastructure, where a VPN is genuinely useful for secure remote administration (SSH, monitoring dashboards, admin portals), isolating research traffic (malware analysis, reconnaissance, testing) from residential infrastructure, and administering infrastructure from airports, conferences, hotels, and cafés.
Linux CLI example
# Configure and connect NordVPN from the CLI
nordvpn login
nordvpn set technology nordlynx
nordvpn set killswitch on
nordvpn set autoconnect on
nordvpn connect# Useful operational commands
nordvpn status
nordvpn countries
nordvpn disconnectFor Linux users, CLI-based VPN management is often faster and more transparent than GUI workflows, and scriptable into your lab's startup.
VPNs and Operational Security
For security professionals, VPNs support operational-security objectives beyond privacy: reducing telemetry exposure, protecting administrative sessions, securing research traffic, and minimising metadata leakage on hostile networks. This aligns with the layered-defence, attack-surface-minimisation principles that run through the enterprise hardening playbook.
Threat-Protection Features
Modern VPN clients increasingly bundle malicious-domain blocking, tracker reduction, phishing protection, and ad filtering. NordVPN's Threat Protection helps reduce exposure to malicious downloads, phishing infrastructure, intrusive telemetry, and tracking systems. It does not replace antivirus, EDR, or endpoint monitoring, it adds another layer, in the same spirit as the browser-hardening controls in the malvertising guide.
What VPN Marketing Gets Wrong
No VPN makes users anonymous, invisible, untraceable, or impossible to compromise. And the provider itself becomes part of your trust model. Evaluate providers on transparency reports, logging policy, independent audits, operational reputation, infrastructure quality, and jurisdiction, not on marketing claims. A VPN you cannot verify is a trust decision you are making blind.
Recommended Privacy-First Setup
- Browser: Firefox or Brave, hardened.
- Password manager: Bitwarden or 1Password.
- MFA: authenticator apps or hardware security keys.
- VPN: NordVPN configured with NordLynx, Kill Switch, Threat Protection, DNS-leak protection, and auto-connect.
- Device: full-disk encryption, limited admin privileges, regular patching, secure backups.
The most dangerous networks are often the ones users trust most, hotels, airports, conference venues, and public cafés. That is exactly where practical operational security matters, and where a properly configured encrypted tunnel meaningfully reduces exposure.
References & Further Reading
- DNS Leak Test verify your DNS is routed through the VPN.
- WireGuard the protocol underlying NordLynx and most modern VPNs.
- For the attacker's view of hostile-network and identity-centric tradecraft, see the on-site SOC and APT analysis.
Frequently Asked Questions
Does a VPN make me anonymous?
No. A VPN encrypts your traffic and hides it from the local network and your ISP, shifting that visibility to the VPN provider. It does not stop phishing, malware, browser fingerprinting, or account-level tracking, and it does not make you anonymous. Treat it as one layer of a broader security and privacy setup, and choose a provider you can actually verify.
Do I really need a VPN on public Wi-Fi?
It is one of the highest-value uses. Public and "free" Wi-Fi can be attacker-controlled (an Evil Twin), enabling traffic interception, credential harvesting, and malicious redirects. A VPN with a Kill Switch encrypts your traffic before it leaves the device and prevents leaks if the tunnel drops, substantially reducing exposure on untrusted networks.
What is a DNS leak and why does it matter?
A DNS leak occurs when your device's domain-name lookups bypass the VPN tunnel, letting your ISP or local network see every site you visit even though the rest of your traffic is encrypted. Test for it after connecting using a DNS-leak testing site, and enable your VPN's DNS-leak protection.
NordLynx or OpenVPN, which should I use?
Use NordLynx (built on WireGuard) for everyday browsing, streaming, gaming, and travel because it is faster and more battery-efficient. Use OpenVPN on restrictive or heavily filtered networks and where maximum compatibility or auditability matters.
Bottom Line
A VPN will not make you anonymous, but a properly configured encrypted tunnel meaningfully reduces exposure where trust should never be assumed, hotels, airports, conferences, and public cafés, by protecting traffic, securing DNS, and cutting unnecessary metadata leakage. For travellers, remote workers, and privacy-conscious users, operating without one increasingly means handing unnecessary information to ISPs, public Wi-Fi infrastructure, advertising networks, and third-party monitoring. Configured with a Kill Switch, DNS-leak protection, and a modern protocol, NordVPN balances usability, performance, and practical security features, as one deliberate layer in a defence that stays layered.