Why your VPN refuses at exactly the wrong time
You are in Switzerland, want to watch the eight o’clock news via the Dutch public broadcaster, put your VPN on a Dutch server — and are told that the service is “not available in your region”. Exactly what you use the VPN for goes wrong. How is that possible? And does it say something about how safe — or unsafe — such a VPN actually is?
That is a surprisingly educational question, because the answer reveals exactly how VPNs work and where the real differences are. We therefore start with the irritation that everyone knows, and work from there to what it means for you as an entrepreneur.
Streaming services (Netflix, Disney+, Prime, but also NPO Start, Ziggo GO or Sky) rely largely on one thing: the reputation of your IP address. They maintain lists of IP ranges associated with data centers and hosting providers — and with major commercial VPNs. A normal home connection (Ziggo, KPN, Swisscom) looks very different from a server in a data center. As soon as your traffic comes out through a data center IP, or through an address where suddenly a hundred “households” are suddenly streaming at the same time, the flag goes up. Commercial exit VPNs share their handful of exit IPs with thousands of users; those addresses will be on the blacklist in no time. It is a cat-and-mouse game that the streaming service structurally wins. In addition, there are more subtle signals: a mismatch between your account country and your apparent location, DNS requests from a country other than your IP, or leak (DNS, IPv6 or WebRTC leaks) so that your real location can still be revealed.
Does this have to do with network technology? Partly — and it helps to keep two layers of detection apart. One checks if you at all uses a VPN by recognizing the tunnel protocol: the common protocols all have a characteristic “handshake” that can be fingerprinted with deep packet inspection. For example, a strict network or provider (think of censorship, sometimes a TV provider) can block VPN use in its entirety. The other layer — and streaming services mainly use them — ignores the protocol and looks purely at it exit IP. For that layer it doesn’t matter which protocol you use: if you come out via a data center, you’re in the clear.
Does that also make it less safe? Being blocked doesn’t in itself make you unsafe — it’s just incredibly annoying. But there is a real, indirect connection. First of all, a lot of detection relies on this leak, and those leaks are also a privacy problem: if your real IP or DNS leaks to Netflix, it leaks to others as well. A VPN that is easily caught is often a VPN that leaks. Secondly, and more fundamentally: to watch NPO from Switzerland you need the endpoint model — your traffic has to exit somewhere in the Netherlands. And that is exactly the model in which you have to completely trust the provider and share an exit IP with strangers. The insecurity does not lie in the blockade itself, but in the model and the quality of implementation you need for it.
The elegant solution: your own connection as a trusted hub
Here’s where it gets interesting. There’s another kind of VPN — one that doesn’t send your traffic “outside somewhere,” but rather connects your own devices into one private network. And that is precisely what makes the best solution possible: let your traffic come out via your own connection. Place a small device at home in the Netherlands — a Raspberry Pi, a NAS, an old cabinet — and route your laptop in Switzerland via that device. To NPO it then looks like… an ordinary Dutch home connection. Because that’s what it is: yours. No data center IP, no shared blacklist VPN, nothing to catch. And it’s immediately more privacy-friendly — you only trust your own home, not a third party.
And exactly that trick is worth much more to an entrepreneur than watching TV. That same box makes you home office a trusted hub in your own network. Your laptop on a terrace, on the train or at a customer’s home talks directly to your files, your accounting system or the office server through an encrypted tunnel — as if you were just sitting at your own desk. No open ports to the internet, no company data in someone else’s cloud: your own devices and locations, privately connected. Do you work in multiple places, or does your team have that? Then you can connect your home, office and on the road just as easily.
Let’s be honest: the streaming trick only works if you have such a device in the target country, and your speed is limited by the upload of that connection. If you don’t have that, you still need a classic exit — and we’ll come back to that below.
For the enthusiast: how it works under the hood
So much for practice. For those who want to know why this is how it works, we have listed the technical differences — and we make an honest effort to keep it understandable. Would you rather go straight to what we can offer? Feel free to skip this part.
Two types of VPN that have nothing to do with each other
Broadly speaking, there are two models, and they are constantly confused.
1. The exit VPN (the consumer model). Your traffic goes to the internet via the provider’s server. For the website you are visiting it seems like the provider the visitor, not you. Useful to hide your IP or bypass geoblocks. The core: the provider is the end point — all your traffic passes through him.
2. The private mesh VPN (the network model). Here you connect your own devices, servers and locations in one encrypted private network. Your laptop talks directly to your home server, your office to your data center — end-to-end encrypted, without the traffic having to go “through a service somewhere.” The core: there is no central endpoint that sees your internet traffic. This is the model behind the box home from above.
Both are called “VPN”. But the first thing turns around anonymity to the outside world, the second at safe access inside. That distinction is the common thread.
The network layer
At the network layer, a VPN is basically an encrypted tunnel. How the tunnel is set up varies greatly, and that determines speed, safety and manageability.
- OpenVPN — the veteran. Builds the tunnel with TLS/SSL (same family as https). Flexible and the workhorse standard for years, but relatively heavy: a lot of code, more CPU, slower.
- IPsec / IKEv2 — anchored in the kernel of operating systems, native on mobile and Windows. Fast and popular for business, but notorious for its complex configuration.
- WireGuard — the new standard. A modern, audited tunnel with a tiny codebase (thousands of lines where OpenVPN has hundreds of thousands), runs in the Linux kernel and is lightning fast. Smaller also means less attack surface. It is no coincidence that many major consumer VPNs have quietly switched to WireGuard in recent years — sometimes under their own product name, but underneath it is just WireGuard.
- Proprietary overlay protocols — some players use a proprietary approach at the Ethernet level or a proprietary encryption framework. Powerful for specific cases, but it deviates from the widely supported WireGuard standard.
The real innovation is not in the tunnel itself, but in the layer surrounding it. Modern mesh VPNs combine a WireGuard data layer (the actual encrypted traffic) with a coordinator (a control layer that exchanges public keys and the network card) and relays which are only used if a direct connection through firewalls fails. Crucial: that coordinator sees never the content of your traffic — the keys don’t leave your own devices. He arranges the introduction; the conversation itself is direct.
The most popular mesh VPN — and the legal catch
One service made this mesh model world famous: Tailscale. Rightly popular — it just “works”, everywhere, with minimal configuration. But there’s a catch that you only notice when you do something like this as a service to others want to offer. The Tailscale coordinator runs at Tailscale itself, as a cloud service. And the standard terms and conditions expressly prohibit the use of the service “sell, resell, rent or lease”. If you want to build your own VPN product, you can only do so through their separate reseller/partner program. You then remain dependent on their conditions, their prices and – more importantly – their control layer, in their jurisdiction. That’s fine for yourself, but it becomes a problem when privacy and independence are the core of your offer. That is exactly the point where we take another turn.
The end point is: the pros and cons
The key question with every VPN is: who is the end point of your traffic? With a classic exit VPN, this is the provider. That has real advantages — and at least such real downsides.
Benefits of endpoint are (for the user): your real IP remains hidden from the websites you visit; you bypass geoblocks and censorship; all your traffic comes in one place, easy to filter centrally.
Disadvantages — and they weigh heavily:
- The provider can watch. All your traffic passes through its servers. Your trust lies entirely in his promise not to log anything.
- Legal liability. Whatever a user does, it comes out via the provider’s IP. Abuse complaints, copyright claims and claims from investigation services land there.
- A concentration of power and risk. One party that sees everything is one party that can be hacked, coerced or subpoenaed.
In short: being an end point provides anonymity outside but shifts the trust — and the risk — entirely to the provider.
Our approach: we don’t want to see anything — and we can neither
Our choice is conscious and radical: we never become the end point of your traffic. We deploy a self-hosted coordinator on a WireGuard foundation. That means, technically and not as an empty promise:
- The encryption keys never leave your devices. We coordinate the introduction between your devices; the traffic itself is direct, end-to-end encrypted.
- A possible relay only sees encrypted packets that he cannot decrypt — a conduit, not a look-in.
- We never run an exit node. Your internet traffic therefore never comes through us. There is nothing to log with us, and therefore nothing to donate.
The difference with the promise “we don’t log anything” is fundamental. That’s one belief — just trust us. Our approach is one design: there is simply no place where we can see your traffic, even if we were put under pressure. Privacy that does not depend on good behavior, but on architecture.
Who we build this for — and what you get
We focus primarily on self-employed people and SMEs: entrepreneurs who want to securely connect their home office, office and on-the-go work without an expensive IT department. We do not shy away from larger companies — our network includes many professionals who can set up and manage more complex environments together with us. You can start small and grow with us.
Your VPN runs on your own server. Not a shared platform, but your own VPS that is yours. Disconnected from our infrastructure — your keys, your network, your blast radius. If something ever goes wrong on our end, it will not affect your network, and vice versa. Independence is not a marketing term here but an architectural choice.
Manage it yourself or have it taken care of. The technology underneath is open and completely customizable — for those who enjoy diving into config files and a terminal. But most people don’t want that, and that is where our added value lies:
- A management dashboard (with a paid / more extensive subscription) to manage your VPN without a command line: add devices with one click, set employees and access rules, see who is connected, updates that are arranged. The convenience of a cloud service, on your own server.
- Our payment gateway underneath — including paying with crypto — so that taking out a subscription is just as smooth as with the major players, without having to contact a major player.
Why choose that paid level? Because you want the control and privacy of self-hosting, without the management burden. You get the owner benefits — your server, your keys, no intermediary looking over your shoulder — with the operation of a decent service. Exactly the combination you don’t get with a classic, see-everything endpoint VPN.
And what if you still need a classic exit? Not everyone has a device in the target country, and sometimes you just want an exit VPN to hide your IP or bypass geoblocks. If there is sufficient demand, we therefore also offer one managed exit service on. When we do that, we do it differently than the mega providers: on our own server or on a server assigned to you, with exit IPs that you do not share with thousands of strangers. That’s more reliable for unblocking — and your IP reputation doesn’t depend on what some stranger does with it. With the same payment gateway and the same dashboard underneath.
We are honest about what this means for your privacy. An exit VPN is by definition the endpoint model: whoever runs the exit sees metadata — which addresses your traffic goes to (the content to https sites remains end-to-end encrypted all the way to that site). This is deliberately a different, lower privacy level than our zero-knowledge mesh. We overcome this with a strict no-log policy, strict isolation, and preferably an exit that is op your own dedicated server is running — then even that metadata is yours, not ours. It remains a trade-off: maximum unblocking convenience versus maximum privacy. We place both clearly next to each other, so that you choose instead of it being chosen for you.
Would you like to think about whether this suits your situation? Please contact us via the contact form — we are expanding this and are happy to think about what a private network can do for you and your company.