# How to set up a VPN: Windows 11, Mac, iPhone, Android and small business

> Set up a VPN with a provider's app or the built-in client on Windows 11, Mac, iPhone and Android, on a home router, and for small business remote access.

- URL: https://computese.com/how-to-set-up-a-vpn/
- Author: Duong Quan Nguyen, CEO, Computese
- Published: 2024-09-04
- Updated: 2026-09-25
- Topics: Security, IT support

## In short
- A VPN encrypts your traffic between your device and the VPN server and shows websites the server's IP address instead of yours. It does not make you anonymous, and it does not stop malware or phishing.
- For personal use, install the provider's app from an official store and turn on its kill switch. For a work VPN, use the app or profile your IT team provides, or the built-in client in Windows 11, macOS, iOS or Android.
- Choose a provider on its jurisdiction, a dated independent audit of its no-logs claim, modern protocols (WireGuard, IKEv2 or OpenVPN) and a kill switch. Avoid PPTP.
- For a small business, the VPN gateway is an internet-facing target that keeps appearing in CISA's KEV catalogue: require MFA, check devices, grant least privilege, patch within days, or move to zero trust network access.

To set up a VPN, install your VPN provider's app, sign in and connect, or enter the server details your provider or IT team gives you in your device's built-in client (in Windows 11: Settings > Network & internet > VPN). Once connected, your traffic travels encrypted to the VPN server, and websites see that server's IP address instead of yours.

A VPN is useful, but it is usually sold as more than it is. This guide starts with what a VPN protects and what it leaves exposed, then covers choosing a provider, installing a VPN app on Windows 11, macOS, iPhone and Android, adding a work VPN with the built-in clients, running WireGuard on a home router, and, for a small business, remote access that holds up against the attacks aimed at it.

## What a VPN does, and what it does not do

A VPN client on your device wraps each packet in an encrypted tunnel that ends at a VPN server. The server unwraps the traffic and sends it on to the site or app you asked for. As [EFF's Surveillance Self-Defense guide](https://ssd.eff.org/module/choosing-vpn-thats-right-you) puts it, your requests then appear to come from the VPN rather than from your internet provider, and the website sees the server's IP address and approximate location instead of yours. The café Wi-Fi, the hotel network and your ISP see only encrypted traffic going to one server.

![A laptop sends traffic through a café Wi-Fi access point and a router inside an orange tube that ends at a VPN server; from the server, plain lines continue to three website servers.](https://computese.com/images/blog/how-to-set-up-a-vpn/tunnel.72aea24ae0-1536.webp)

*The tunnel ends at the VPN server: the network you sit on sees only encrypted traffic, and whoever runs the server sees the rest.*

The same technology does different jobs. The [Canadian Centre for Cyber Security (CCCS)](https://www.cyber.gc.ca/en/guidance/virtual-private-networks-itsap80101) lists four kinds: gateway-to-gateway (joining two offices), host-to-gateway (a remote worker's laptop into the company network), host-to-host, and third-party privacy, the consumer VPN you subscribe to. Setting up a VPN for yourself means the last kind; setting one up for staff means the second.

What a VPN does not do matters just as much:

- **It does not make you anonymous.** The VPN provider can now see what your ISP used to see, and sites can still track you through [cookies, tracking pixels, browser fingerprinting](https://computese.com/how-to-protect-your-privacy-online/) and GPS. For anonymity, EFF points to Tor instead.
- **It does not stop malware or phishing.** CCCS is explicit that a VPN gives no protection against someone clicking a malicious link or downloading malicious content. That is the job of your browser, your email filtering and [antivirus or EDR](https://computese.com/choose-the-right-antivirus-software-for-your-pc/).
- **It protects nothing past the server.** From the VPN server to the website, traffic crosses the internet like any other, so HTTPS still does the real work of protecting logins and payments.
- **It is not a reliable way around geo-blocking.** EFF notes that streaming platforms increasingly block devices that appear to be using a VPN.

On public Wi-Fi, the case for a VPN is weaker than it used to be. The [FTC](https://consumer.ftc.gov/articles/are-public-wi-fi-networks-safe-what-you-need-know) now says that because most websites encrypt their traffic, using a public network is usually safe. What HTTPS does not hide is metadata: someone on the same network can still see which domains you visit and when. A VPN you trust hides that from the local network, which is worth having on a network whose operator you do not know. How that kind of interception works is covered in our guides to [eavesdropping attacks](https://computese.com/understanding-eavesdropping-attacks-how-they-work/) and [man-in-the-middle attacks](https://computese.com/understanding-man-in-the-middle-mitm-attacks/). On an iPhone with iCloud+, [iCloud Private Relay](https://support.apple.com/guide/iphone/protect-web-browsing-icloud-private-relay-iph499d287c2/ios) sends traffic through two separate relays so websites do not see your IP address, but Apple describes it in terms of Safari browsing: a browser privacy feature, not a VPN for every app.

## How to choose a VPN provider

If the VPN is for your employer's network, skip this section: the provider is your IT team. For a personal VPN, you are moving trust from your ISP to a company, so choose the company carefully.

| What to check    | Why it matters                                                                                                                       | What good looks like                                                                   |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------- |
| Jurisdiction     | The provider is subject to the laws of the countries it operates in, including requests for data that may come without notice to you | You know where it is incorporated, and it publishes a transparency report              |
| No-logs policy   | EFF's warning: a claim is not a guarantee                                                                                            | A dated audit by a named firm, published in full, that examined the servers            |
| Protocols        | Broken encryption such as PPTP can be decrypted by your ISP or government                                                            | WireGuard, IKEv2 or OpenVPN                                                            |
| Kill switch      | Without it, apps fall back to your normal connection when the tunnel drops                                                           | On by default, or one setting away                                                     |
| Business model   | Servers cost money: some free VPNs sell your data, and freemium plans cap it                                                         | A clear subscription or a funding model you can explain                                |
| Where the app is | EFF warns that being listed in an app store does not make a VPN safe                                                                 | Google Play's "Verified" badge helps, but it covers the app, not the company's servers |

Audits are the strongest evidence a provider can offer, within limits. [Proton VPN's page on its no-logs audits](https://protonvpn.com/blog/no-logs-audit), for example, last updated on June 16, 2026, reports a fifth consecutive yearly audit by the security firm Securitum and lists what was checked on the servers: whether DNS queries, session timestamps, traffic contents or links between a user and a server are logged, and whether logging settings are protected by change control. Use that list to read any provider's report. EFF's caution still applies: an audit is a snapshot, and practices can change after it, especially under a government order.

### VPN protocols compared

| Protocol    | What it is                                                                                                                                                                                                                               | Use it when                                                 |
| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- |
| WireGuard   | A modern protocol that [runs over UDP and authenticates each side by public key](https://www.wireguard.com/), like SSH, with a code base small enough to audit. It keeps working when your IP address changes                            | Your app or router offers it: the default choice            |
| IKEv2/IPsec | The IETF standard, [RFC 7296](https://www.rfc-editor.org/rfc/rfc7296.html) (2014), built into Windows, macOS and iOS. The [MOBIKE extension](https://www.rfc-editor.org/rfc/rfc4555.html) keeps a tunnel up when a phone changes network | Phones, and work VPNs set up without an app                 |
| OpenVPN     | An [open-source SSL/TLS VPN](https://openvpn.net/community-resources/how-to/) that accepts certificates, smart cards or passwords                                                                                                        | A network blocks the others, or your provider recommends it |
| L2TP/IPsec  | An older combination still supported by Apple devices and Windows                                                                                                                                                                        | Only when an existing work VPN requires it                  |
| PPTP        | Legacy protocol whose encryption EFF calls broken                                                                                                                                                                                        | Never                                                       |

A kill switch blocks all internet traffic whenever the tunnel drops, so apps do not quietly fall back to your normal connection and reveal your IP address. In a provider's app it is a setting: turn it on. Company-managed devices can get the same behaviour from the operating system. With Apple's [Always On VPN](https://support.apple.com/guide/deployment/vpn-overview-depae3d361d0/web) for IKEv2, if the tunnels are not up, all IP traffic is dropped.

One more check before you travel: VPN legality differs by country, and EFF advises keeping up with each country's policy on VPNs, including outright bans.

## Set up a VPN app on Windows, Mac, iPhone and Android

A provider's app is the simplest route on every platform, because it handles the protocol, the server list and the kill switch for you:

1. **Install the app from an official source.** On Windows, [Microsoft suggests](https://support.microsoft.com/en-us/windows/connect-to-a-vpn-in-windows-3d29aeb1-f497-f6b7-7633-115722c1009c) checking the Microsoft Store for your service's app, or the provider's website for its connection settings. On a Mac, iPhone or Android phone, use the App Store or Google Play.
2. **Sign in** with the account you created, and follow the app's first-run prompts to create its VPN connection.
3. **Open the settings before you connect.** Turn on the kill switch, choose WireGuard or IKEv2 if the app lets you pick, and turn on automatic connection for untrusted Wi-Fi if the app offers it.
4. **Pick a server near you**, unless you need a particular country. Distance adds delay.
5. **Connect, then check it worked.** Search "what is my IP" before and after: the address shown should change to the VPN server's.
6. **Keep the app updated** along with the operating system (see [how to keep your computer and phone updated](https://computese.com/how-to-update-your-computer-or-phone/)). EFF notes that VPN software not updated against flaws such as TunnelVision may not protect you when it matters.

Where the connection lives on each platform:

| Device       | Where to get the app                                                       | Where to see and manage the connection                        |
| ------------ | -------------------------------------------------------------------------- | ------------------------------------------------------------- |
| Windows 11   | Microsoft Store or the provider's website                                  | Settings > Network & internet > VPN, or VPN in quick settings |
| Mac          | App Store, the provider's website, or a VPN settings file you double-click | System Settings > Network, and the VPN status menu            |
| iPhone, iPad | App Store (VPN apps are built on Apple's Network Extension framework)      | Settings > General > VPN & Device Management                  |
| Android      | Google Play, or an app from your administrator                             | Settings > Network & internet > VPN                           |

## Use the built-in VPN client in Windows 11

Windows 11 has its own VPN client for connections that do not need a vendor app, typically a work VPN or a provider that publishes IKEv2 settings. Get the server address, VPN type and sign-in method first, then follow [Microsoft's steps](https://support.microsoft.com/en-us/windows/connect-to-a-vpn-in-windows-3d29aeb1-f497-f6b7-7633-115722c1009c):

1. Open **Settings > Network & internet > VPN** and select **Add VPN**.
2. For **VPN provider**, choose **Windows (built-in)**.
3. Enter a **Connection name** you will recognize, and the **Server name or address**.
4. For **VPN type**, choose the one your provider or IT team specifies. Prefer IKEv2 when it is offered, and never choose PPTP.
5. For **Type of sign-in info**, choose what you were given: user name and password, one-time password, certificate or smart card. Select **Save**.
6. Connect from the same page, or from the VPN button in quick settings on the taskbar. The connection shows **Connected**, and a blue shield appears on the taskbar when you are connected to a recognized VPN.

[Microsoft's Intune reference](https://learn.microsoft.com/en-us/intune/device-configuration/templates/ref-vpn-settings-windows) lists IKEv2, L2TP and PPTP, plus an Automatic option, as the native Windows VPN types; WireGuard and OpenVPN need their own apps. On a company laptop you may not have to type anything at all: IT can push the profile through Intune, set it to **Always On** so it reconnects when you sign in or change networks, and use a certificate on the device instead of a password.

## Add a work VPN on a Mac, iPhone or Android phone

Work VPNs usually arrive ready-made, as the vendor's client app, a configuration profile, or a profile pushed by device management. Use that when you have it, and enter settings by hand only when IT gives you the values.

### Mac

1. Choose **Apple menu > System Settings**, then click **Network** in the sidebar.
2. Click the **Action** pop-up menu, choose **Add VPN Configuration**, then choose the type: L2TP over IPsec, Cisco IPsec or IKEv2.
3. Enter a display name, then the server address, account name and authentication settings you were given. Click **Create**.
4. Connect and switch between VPNs from the VPN status menu in the menu bar.

If IT sent you a VPN settings file, [Apple's guide](https://support.apple.com/guide/mac-help/set-up-a-vpn-connection-on-mac-mchlp2963/mac) says you can simply double-click it instead.

### iPhone and iPad

Your company will normally send a configuration profile by email or through a web page, or install it with device management. iOS asks for permission before installing a profile and shows what it contains; afterwards you can review it in [Settings > General > VPN & Device Management](https://support.apple.com/guide/iphone/install-or-remove-configuration-profiles-iph6c493b19/ios). Deleting a profile also deletes the settings, apps and data that came with it.

The built-in client handles IKEv2, L2TP over IPsec and Cisco IPsec without extra apps; any other VPN needs the vendor's app. Managed iPhones can also use [per-app VPN](https://support.apple.com/guide/deployment/vpn-overview-depae3d361d0/web), which sends only the organization's managed apps through the tunnel and keeps personal traffic out of it.

### Android

1. Get the VPN details from your administrator. You may need to install their VPN app first and start setup there.
2. Open **Settings > Network & internet > VPN** (search for "VPN" if your phone's menus differ), tap **Add**, enter the details and tap **Save**.
3. Tap the VPN, enter your user name and password, and tap **Connect**.
4. To stay connected, tap the settings icon next to the VPN and turn on **Always-on VPN**.

[Google's Android help](https://support.google.com/android/answer/9089766) notes that some of these steps need Android 14 or later, that the always-on option is not offered there for a VPN set up through an app, and that with a work profile the VPN can apply to work apps only.

## Set up a VPN on your home router

A router VPN does one of two jobs, and they are easy to confuse:

- **Router as VPN server.** The router accepts connections from your phone or laptop when you are away, so you can reach a NAS, cameras or a printer at home, and route your browsing through your home connection when you are on public Wi-Fi.
- **Router as VPN client.** The router keeps a tunnel open to a VPN provider, and every device behind it uses that tunnel, including smart TVs and game consoles that cannot run a VPN app.

![A smart TV, a game console and a laptop connect to a home router, which sends all their traffic through one orange tunnel to a VPN server and on to the internet.](https://computese.com/images/blog/how-to-set-up-a-vpn/router.90b8430543-1536.webp)

*A VPN on the router covers devices that cannot run a VPN app, but only while they are at home.*

Both depend on your router's firmware, so check its admin pages or manual for a VPN section that offers WireGuard or OpenVPN. Prefer WireGuard where you have the choice. Open-source firmware shows what the setup involves: [OpenWrt's WireGuard server guide](https://openwrt.org/docs/guide-user/services/vpn/wireguard/server) uses its LuCI web interface like this:

1. Install the `luci-proto-wireguard` package (and `qrencode` if you want QR codes for phones), then restart the network service.
2. Add a new interface with the protocol **WireGuard VPN**, generate a key pair, and set a listen port (the guide uses 51820) and an internal address such as `10.0.0.1/24`.
3. Add a peer for each phone or laptop: generate its keys, give it one address such as `10.0.0.10/32`, and generate its configuration or a QR code to scan with the WireGuard app.
4. Allow the WireGuard UDP port from the WAN zone in the firewall, save and apply, then restart the WireGuard interface.

The phone's side of the tunnel ends up looking like this:

```ini
[Interface]
PrivateKey = <the phone's private key>
Address = 10.0.0.10/32
DNS = 192.168.1.1

[Peer]
PublicKey = <the router's public key>
Endpoint = home.example.com:51820
AllowedIPs = 192.168.1.0/24
PersistentKeepalive = 25
```

`AllowedIPs` decides what goes through the tunnel: WireGuard treats it as a routing table when sending and as an access list when receiving. With `192.168.1.0/24`, only traffic for your home network uses the tunnel. With `0.0.0.0/0, ::/0`, everything does, so a public hotspot only ever sees the tunnel. `Address` and `DNS` are [wg-quick](https://git.zx2c4.com/wireguard-tools/about/src/man/wg-quick.8) settings for the tunnel's own address and the DNS server to use while it is up.

A router VPN makes sense when you want devices without VPN apps covered, or one controlled way into your home network instead of exposing each device to the internet. It makes less sense when you only want protection on the move (a router client does nothing for your phone at a café), or when your connection has no reachable public address, in which case a router server cannot accept incoming connections. Either way, the router now runs an internet-facing service, so keep its firmware updated along with [the rest of your home network](https://computese.com/how-to-secure-your-home-network/).

## Set up remote access for a small business

Remote access usually means putting a service on the internet for anyone to reach. In September 2021, [NSA and CISA](https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2791320/nsa-cisa-release-guidance-on-selecting-and-hardening-remote-access-vpns/) described VPN servers as entry points into protected networks, which makes them attractive targets, and published joint guidance on selecting and hardening them. Its top recommendations remain the baseline: products tested and validated on the NIAP Product Compliant List, multi-factor authentication, prompt patching, and a smaller attack surface with non-VPN features turned off.

Start by deciding what staff actually need to reach:

| Option                           | How it works                                                                                                    | Fits when                                                                  |
| -------------------------------- | --------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- |
| Managed VPN gateway              | A firewall, appliance or cloud VPN terminates IPsec (IKEv2) or vendor TLS tunnels and puts users on the network | Staff need many internal systems, such as file shares and on-premises apps |
| Zero trust network access (ZTNA) | A broker checks identity, MFA and the device for each app, then connects the user to that app only              | Most work happens in a few apps, and identities and devices are managed    |
| Site-to-site VPN                 | Two gateways join two office networks (gateway-to-gateway)                                                      | You have a branch office, not remote people                                |

For a VPN gateway, CCCS recommends IPsec first, because it is an open standard; TLS VPNs often rely on custom, non-standard features and tie you to one vendor's client and server.

Whichever model you choose, set it up with these controls:

1. **MFA on every remote sign-in**, with phishing-resistant factors where you can, as both CCCS and [CISA's 2024 guide on network access](https://www.cisa.gov/resources-tools/resources/modern-approaches-network-access-security) recommend.
2. **Check the device, not only the person.** Let only managed, encrypted and patched devices connect; a ZTNA broker can check device posture on every connection, and a VPN can require a certificate issued to managed devices.
3. **Least privilege.** Give each person the systems their role needs, not the whole network, and land VPN users in a restricted network segment.
4. **Patch the gateway first**, within days for anything in CISA's catalogue, and retire hardware the vendor no longer supports.
5. **Shrink what the internet can reach.** Turn off features the VPN does not need and restrict the gateway to the ports it uses: for IPsec, UDP 500 and 4500 plus ESP; for TLS VPNs, TCP 443.
6. **Decide on split tunnelling deliberately.** CCCS says to avoid it as much as possible. [Microsoft's guidance for Microsoft 365](https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-vpn-split-tunnel) is narrower than it sounds: keep the tunnel, and exempt only the latency-sensitive Teams, SharePoint and Exchange Online endpoints it marks as Optimize, as least-privilege exceptions. Set that policy centrally, not per user.
7. **Log and watch.** Centralize management, alert on failed sign-ins, and scan your public-facing systems for vulnerabilities automatically.
8. **End access the day someone leaves**, including their certificates, sessions and devices.

> [!WARNING]
> VPN gateways keep being exploited. [CISA's 2024 guide](https://www.cisa.gov/resources-tools/resources/modern-approaches-network-access-security) says VPN solutions have been involved in many recent high-profile incidents and counts more than 22 Known Exploited Vulnerabilities related to VPN compromise. Treat the gateway as a server to patch within days, not a box to set and forget.

A sample of VPN and remote access flaws in CISA's [Known Exploited Vulnerabilities catalogue](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), by the date CISA added them (as of September 2026):

| Added to KEV | Product                                      | CVE                            | What CISA's entry describes                                                     |
| ------------ | -------------------------------------------- | ------------------------------ | ------------------------------------------------------------------------------- |
| Oct 18, 2023 | Citrix NetScaler ADC and NetScaler Gateway   | CVE-2023-4966 ("Citrix Bleed") | Information disclosure on devices configured as a gateway, including VPN        |
| Jan 10, 2024 | Ivanti Connect Secure and Policy Secure      | CVE-2023-46805, CVE-2024-21887 | Authentication bypass that can be chained with command injection                |
| Apr 12, 2024 | Palo Alto Networks PAN-OS (GlobalProtect)    | CVE-2024-3400                  | Unauthenticated commands run with root privileges on the firewall               |
| Sep 25, 2025 | Cisco Secure Firewall ASA and Threat Defense | CVE-2025-20333, CVE-2025-20362 | Remote code execution in the VPN web server, chained with missing authorization |
| Jun 8, 2026  | Check Point Security Gateway                 | CVE-2026-50751                 | A remote access VPN connection without a valid user password (IKEv1)            |
| Sep 9, 2026  | Citrix NetScaler ADC and NetScaler Gateway   | CVE-2026-19490                 | Authentication bypass on devices configured as a gateway, including SSL VPN     |

CISA's 2024 guide adds that Citrix Bleed let attackers bypass passwords and MFA by hijacking legitimate sessions, which is why MFA alone does not make an unpatched gateway safe. Two emergency directives show what patching alone can miss. [ED 24-01](https://www.cisa.gov/news-events/directives/ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure-vulnerabilities), issued on January 19, 2024, led to US federal agencies being ordered to disconnect Ivanti Connect Secure appliances by February 2, 2024, and warned that attackers may keep rootkit-level persistence that survives a factory reset. [ED 25-03](https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices), issued on September 25, 2025 for Cisco ASA and Firepower devices, states that applying Cisco's updates does not necessarily remove an attacker already on the device, and required agencies to disconnect ASA hardware whose support ended on or before September 30, 2025. For a small business the lesson is the same: when your VPN appliance appears in an advisory, patch it, then find out whether it was compromised before the patch.

Zero trust changes the question from "is this user on our network?" to "should this person, on this device, reach this application now?". [NIST SP 800-207](https://csrc.nist.gov/pubs/sp/800/207/final) defines zero trust as granting no implicit trust based on network location, and authenticating and authorizing both the user and the device before each session. In CISA's description of ZTNA, an access broker verifies identity and policy, can check device posture and enforce MFA, and grants access to each application on a least-privilege basis; the same 2024 guide urges businesses of every size to move toward zero trust, Secure Service Edge (SSE) and Secure Access Service Edge (SASE).

![A laptop with a checked shield passes through a gate that verifies it and reaches one application server by an orange path, while three other servers behind the gate stay locked.](https://computese.com/images/blog/how-to-set-up-a-vpn/ztna.cec185911b-1536.webp)

*A VPN puts a user on the network; zero trust access opens one application, for one verified person on one checked device.*

In a Microsoft 365 business, [Microsoft Entra Private Access](https://learn.microsoft.com/en-us/entra/global-secure-access/concept-private-access) is one example: remote workers with the Global Secure Access client reach internal apps and resources without a VPN, and Conditional Access policies decide who gets in.

Most of what good remote access depends on is identity and device management. Our [IT support](https://computese.com/services/it-support/) team sets up MFA and conditional access, enrols laptops and phones in Microsoft Intune or Jamf, and runs offboarding as one documented sequence, so access ends when employment ends. Our [security scanning](https://computese.com/services/security-testing/) checks exposed services, such as a VPN gateway, for known CVEs and ranks findings with the CISA KEV catalogue, so what attackers exploit today is fixed first. For the wider picture, see our [cybersecurity checklist for small business](https://computese.com/cybersecurity-best-practices/).

## Fix common VPN problems

| Symptom                                              | Likely cause                                                        | What to try                                                                                 |
| ---------------------------------------------------- | ------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
| Connects at home but not on hotel or guest Wi-Fi     | CCCS notes that some networks restrict or block IPsec traffic       | Switch to a TLS-based option if your app offers one; TLS VPNs usually use TCP port 443      |
| Drops when the phone moves from Wi-Fi to mobile data | The protocol cannot move the tunnel to a new IP address             | Use WireGuard or IKEv2 with MOBIKE, both designed to survive an address change              |
| Connected, but nothing loads                         | DNS or routes inside the tunnel are wrong                           | Try another server; on WireGuard, check `AllowedIPs` and `DNS` in the configuration         |
| A streaming service refuses to play                  | The service blocks addresses it recognizes as VPN servers           | Disconnect for that service, or exclude its app if your VPN allows split tunnelling         |
| Teams or Outlook is slow on the work VPN             | Microsoft 365 traffic is being forced through the company tunnel    | Ask IT about Microsoft's split tunnel exceptions for Teams, SharePoint and Exchange Online  |
| A managed phone has no internet when the VPN is down | Always On VPN drops all traffic until the tunnel returns, by design | Reconnect to a working network; if it persists, contact IT rather than removing the profile |

## Key terms
- **VPN (virtual private network)**: An encrypted connection that carries traffic across an untrusted network such as the internet, between a device and a VPN server or between two networks.
- **VPN tunnel**: The encrypted path between the VPN client and the VPN server. Anyone in between, such as the Wi-Fi operator or your ISP, sees only encrypted packets addressed to the server.
- **IKEv2/IPsec**: IPsec encrypts IP traffic; IKEv2 (RFC 7296) authenticates both ends and sets up the keys. Built into Windows, macOS and iOS, and the standards-based choice for business remote access.
- **WireGuard**: A modern VPN protocol that runs over UDP and authenticates each side by a public key, the way SSH does. Its code base is small enough to audit.
- **OpenVPN**: An open-source VPN built on SSL/TLS that authenticates with certificates, smart cards or passwords. It needs a client app on each device.
- **Kill switch**: A setting that blocks all traffic whenever the VPN tunnel drops, so apps do not fall back to your normal connection and reveal your real IP address.
- **Split tunnelling**: Sending only some traffic through the VPN and the rest straight to the internet. Sending everything through the VPN is called a forced or full tunnel.
- **Zero trust network access (ZTNA)**: Remote access that connects a verified user, on a device that passes its checks, to one application at a time instead of putting them on the whole network.
- **KEV catalogue**: CISA's Known Exploited Vulnerabilities catalogue: flaws with evidence of exploitation in the wild, used to decide what to patch first.
- **No-logs policy**: A VPN provider's promise not to record your activity or connection details. A published, dated audit by an independent firm is the best available evidence that it holds.

## Common questions

### Do I need a VPN at home?

Usually not for security. At home, the main party a VPN hides your browsing from is your ISP, and the VPN provider then sees the same things instead, while most sites already encrypt their traffic with HTTPS. A VPN at home is worth it for a work connection, for reaching your home network remotely, or when you trust the provider more than your ISP.

### Is it legal to use a VPN?

It depends on where you are. VPN legality differs by country: some governments restrict or ban VPN services, and the rules change, so check the local position before you travel with one. A VPN never makes an otherwise illegal activity legal.

### Are free VPNs safe?

Treat them with suspicion. A VPN has to pay for its servers somehow, and EFF notes that some free VPNs sell your data while freemium ones cap it. A listing in an app store is not proof of safety, so check the business model, the privacy policy and whether the provider publishes independent audits.

### Can I set up a VPN without installing an app?

Yes, when the VPN uses a protocol your device supports natively. Windows 11, macOS and iOS include clients for IKEv2 and L2TP over IPsec, and Android has a built-in client under Settings, Network & internet, VPN. You need the server address, VPN type and sign-in details from your provider or IT team; WireGuard and OpenVPN need an app.

### Which VPN protocol is best?

For most people, WireGuard or IKEv2 with MOBIKE: both are modern and keep the tunnel up when a phone switches between Wi-Fi and mobile data. Use OpenVPN when a network blocks the others or your provider recommends it, and avoid PPTP, whose encryption is broken. For business remote access, the Canadian Centre for Cyber Security recommends standards-based IPsec as the first choice.

### Does a VPN slow down your internet?

A little, usually. Your traffic takes a detour through the VPN server and is encrypted on the way, so a distant or crowded server adds delay. Choose a server near you and prefer WireGuard, which its developers designed to be faster than IPsec and OpenVPN.

## Sources
1. [Choosing the VPN That's Right for You](https://ssd.eff.org/module/choosing-vpn-thats-right-you), EFF Surveillance Self-Defense
2. [Virtual private networks (ITSAP.80.101)](https://www.cyber.gc.ca/en/guidance/virtual-private-networks-itsap80101), Canadian Centre for Cyber Security
3. [Are Public Wi-Fi Networks Safe? What You Need To Know](https://consumer.ftc.gov/articles/are-public-wi-fi-networks-safe-what-you-need-know), Federal Trade Commission
4. [Protect your web browsing in Safari with iCloud Private Relay on iPhone](https://support.apple.com/guide/iphone/protect-web-browsing-icloud-private-relay-iph499d287c2/ios), Apple Support
5. [Proton VPN passes 5th annual external audit of no-logs policy](https://protonvpn.com/blog/no-logs-audit), Proton VPN
6. [WireGuard: fast, modern, secure VPN tunnel](https://www.wireguard.com/), WireGuard
7. [RFC 7296: Internet Key Exchange Protocol Version 2 (IKEv2)](https://www.rfc-editor.org/rfc/rfc7296.html), IETF
8. [RFC 4555: IKEv2 Mobility and Multihoming Protocol (MOBIKE)](https://www.rfc-editor.org/rfc/rfc4555.html), IETF
9. [OpenVPN community HOWTO](https://openvpn.net/community-resources/how-to/), OpenVPN
10. [VPN overview for Apple device deployment](https://support.apple.com/guide/deployment/vpn-overview-depae3d361d0/web), Apple Platform Deployment
11. [Connect to a VPN in Windows](https://support.microsoft.com/en-us/windows/connect-to-a-vpn-in-windows-3d29aeb1-f497-f6b7-7633-115722c1009c), Microsoft Support
12. [Windows device settings to add VPN connections using Intune](https://learn.microsoft.com/en-us/intune/device-configuration/templates/ref-vpn-settings-windows), Microsoft Learn
13. [Set up a VPN connection on Mac](https://support.apple.com/guide/mac-help/set-up-a-vpn-connection-on-mac-mchlp2963/mac), Apple Support
14. [Install or remove configuration profiles on iPhone](https://support.apple.com/guide/iphone/install-or-remove-configuration-profiles-iph6c493b19/ios), Apple Support
15. [Connect to a virtual private network (VPN) on Android](https://support.google.com/android/answer/9089766), Android Help
16. [WireGuard server](https://openwrt.org/docs/guide-user/services/vpn/wireguard/server), OpenWrt Project
17. [wg-quick(8) manual page](https://git.zx2c4.com/wireguard-tools/about/src/man/wg-quick.8), WireGuard (wireguard-tools)
18. [NSA, CISA Release Guidance on Selecting and Hardening Remote Access VPNs](https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2791320/nsa-cisa-release-guidance-on-selecting-and-hardening-remote-access-vpns/), National Security Agency
19. [Modern Approaches to Network Access Security](https://www.cisa.gov/resources-tools/resources/modern-approaches-network-access-security), CISA, FBI, GCSB, CERT NZ and CCCS
20. [Overview: VPN split tunneling for Microsoft 365](https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-vpn-split-tunnel), Microsoft Learn
21. [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), CISA
22. [ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities](https://www.cisa.gov/news-events/directives/ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure-vulnerabilities), CISA
23. [ED 25-03: Identify and Mitigate Potential Compromise of Cisco Devices](https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices), CISA
24. [SP 800-207: Zero Trust Architecture](https://csrc.nist.gov/pubs/sp/800/207/final), NIST
25. [Learn about Microsoft Entra Private Access](https://learn.microsoft.com/en-us/entra/global-secure-access/concept-private-access), Microsoft Learn