What a VPN Is Actually Good For
VPNs are sold hard, usually on claims that were shaky a decade ago and are mostly wrong now. That is a shame, because there are genuinely good reasons to run one. They are just not the reasons in the adverts.
Photo by Vasilis Karkalas on Pexels
This is an honest account of what a VPN does, what it no longer does, and the cases where we set them up for customers.
What a VPN actually is
A Virtual Private Network creates an encrypted tunnel between your device and a server somewhere else. Your traffic goes down that tunnel, comes out at the far end, and reaches the internet from there.
Two consequences follow. Whoever runs the network you are physically connected to cannot see what you are doing beyond the fact that you are connected to a VPN. And to the sites you visit, your traffic appears to originate from the VPN server rather than from you.
What has changed since we first wrote this
The original version of this article led on public Wi-Fi. The argument was that anyone in the coffee shop could trivially intercept your traffic, and that was true when most of the web ran over unencrypted HTTP.
That case is largely gone. The overwhelming majority of web traffic is now HTTPS, browsers warn on anything that is not, and HSTS stops downgrade attacks on sites that use it. Someone sharing your coffee shop network can see which sites you connect to; they cannot read your banking session or capture your passwords the way they could in 2014.
So the honest position is that a VPN is no longer essential protection on public Wi-Fi. It still helps at the margins, by hiding which sites you visit from the network operator, and by protecting the small amount of traffic that is still unencrypted. But anyone telling you that hotel Wi-Fi will empty your bank account without a VPN is selling something.
The other claim worth deflating: a VPN is not anonymity. You have moved the ability to see your traffic from your internet provider to your VPN provider. That is a change of who you trust, not an elimination of trust. A free VPN in particular has to make money somehow, and you are usually the product.
What a VPN is still genuinely good for
A fixed IP address for allowlisting. This is the strongest case, and it is the one we deal with most.
Restricting access by IP address is one of the most effective controls available. If your hosting control panel, your server’s admin interface, your database tools or your site’s back office only accept connections from a handful of known addresses, then a stolen password is worth very little to an attacker.
The problem is that most internet connections do not have a static IP address, and most commercial VPN services deliberately give you a different one every time you connect, which is useless for this. A VPN that gives you a consistent, known IP address solves it. You get one address that follows you, and that is the address you allowlist.
This is exactly how we work. Access to WHM and other administrative services on every server we run is restricted to a small set of IP addresses. When we need to work outside the office, we connect through a VPN with a fixed address, not for the encryption but because it is the address that is permitted through.
Our reseller customers hit the same requirement, since access to their server is IP restricted too. If you work from more than one location, or from anywhere with a dynamic address, a fixed-IP VPN turns an ongoing nuisance into a solved problem.
Reaching private networks. The original corporate use case, and still valid. A VPN into an office network gives you access to file shares and internal systems that are not, and should not be, exposed to the internet.
Hiding your browsing from the network you are on. Whether that is your internet provider, an employer, or a hotel. Whether that matters depends on your circumstances, and for some people it matters a great deal.
Appearing to be somewhere else. Useful for legitimate testing, checking how your site appears to customers in another country, or verifying geographic restrictions work. It is also used to get around regional content restrictions, which typically breaches the service’s terms even where it is not illegal, and providers now block known VPN addresses aggressively. Do not buy a VPN on that promise.
Choosing one
If you are buying a commercial service, the things that matter are:
Do you need a fixed IP address? If the reason you want a VPN is allowlisting, this is the only question that matters. Most consumer services cannot do it.
Who runs it, and how do they make money? You are handing them the visibility your internet provider had. Free services are the ones to avoid.
Have they been independently audited? “No logs” is a marketing claim until someone has checked.
Does it handle DNS and leaks properly? A VPN that tunnels your traffic while your DNS queries go out separately is not doing the job.
A note on what to secure first
If you are thinking about a VPN for security reasons, it is worth being clear where it sits in the order of things. Two factor authentication on your important accounts, unique passwords from a password manager, and keeping your software patched all remove far more risk than a VPN does. A VPN is a useful additional control, not a substitute for those.
Where it becomes genuinely valuable is once those basics are in place and you want to add IP restriction on top, because that is the point at which a fixed address stops being a convenience and becomes a requirement.
We set these up
We still provide and install VPNs for customers, and the requirements vary a lot: a fixed IP address for allowlisting, access to a private network, secure remote administration, or a combination. What is right depends on how you work and what you need to reach.
If any of the above sounds like your situation, open a support ticket with us and we will go through your specific requirements and what would suit you. It is not a one size fits all thing, and it is worth a conversation rather than a checkout button.
