Would it add any additional layer of security to use another VPN client while connected to a VPN router? Or would it just be overkill and slow things down for no reason?

  • 1
    It would definitely add another layer of security. But if this additional layer is actually worth the effort or if the bit of additional security does not justify the added slowness and increased costs depends on your specific setups and risks - which are all unknown to us. Commented Nov 19, 2019 at 13:21

1 Answer 1


What it would actually do is route your traffic from your device to the secondary VPN's endpoint through your router's VPN endpoint. Theoretically, it would add another layer of security, although depending on your threat model, this layer may be considered security via obscurity. And of course, this will slow down your connection speed and increase overhead.

Without more details, I will hypothesize a couple of scenarios in which one may wish to do this:

If you don't trust your router, LAN, ISP, local government, or gateway VPN's endpoint, then it may be worth the performance hit because (properly configured) it would protect you from attacks on your LAN, and it would hide your real IP address from your device's VPN provider/server.

If you don't trust the client's VPN provider or server's ISP or government... (if you are in the USA, also remember that you actually have more legal protections [or so they say] with traffic that does not leave the United States -- traffic routed overseas actually is easier to legally intercept in certain cases), then this setup (used properly) would effectively hide your IP address.

If you don't trust whatever services you are connecting to, then it never hurts to have another layer to make it harder to trace the origin of your traffic, but be careful of common gotchas such as web-rtc leaks and other user-created points of failure.

In general, this setup would add little anonymity and could be defeated by traffic analysis, application-level bugs/backdoors, and most importantly; mistakes made by the user (the user is usually the weakest link in any security chain).

However, it would make it more difficult for someone trying to track your web activities to obtain all of the necessary log files (depending on the integrity of the VPN providers [or their ISP's] and the legal jurisdiction that the services are hosted).

If your threat model is an intelligence agency or something like that, then a better setup would be to use a chain of proxies (some of which can be tor) in conjunction with your VPN. The exact setup you would want would depend on what you are trying to achieve (ie, do you want to proxy into your VPN, or access a chain of proxies through the VPN, or some combination thereof?). Personally, I would use something like Whonix, routed through a VPN server, and use an anonymous VPS server as your final hop (change it frequently and be careful about sending any data through this final exit that can personally identify you, otherwise this is all a waste of time).

As always, do not leave an audit trail -- whether that be using a credit card in your name to pay for both services, or not taking the proper precautions to hide the source of your traffic while setting up your configuration. I recommend implementing tor into your setup for scenarios that require high anonymity. However, I would not rely on tor alone.

Personally, I like to do something such as client > VPN > Tor > [randomly selected and frequently changed anonymous proxy server] > destination. Be careful about that final hop though. If you can deal with being captcha'd all over the place, omit it because it can act as a single point of failure defeating all of your efforts.

In conclusion, define your threat model, do much research, and make an informed decision about how much performance you should, or are willing to sacrifice to gain security and/or anonymity.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .