We know that when you use a VPN, your ISP can't see what data is going inside the tunnel, but they can see that you are visiting the VPN server. Is it possible for the VPN to somehow configure your internet so that your ISP can't even see that you are using a VPN?

  • 5
    Your ISP needs to route your traffic to the VPN.
    – schroeder
    Sep 12, 2022 at 21:35
  • 1
    Additionally, instead of your ISP spying on you, now you have a VPN spying on you. Sep 12, 2022 at 23:29
  • There are various ways to obfuscate VPN traffic. I believe you can use obfsproxy with OpenVPN.
    – forest
    Feb 14, 2023 at 0:28

4 Answers 4


There's a few things that will allow your ISP to know you are using a VPN:

  1. The protocol that VPNs use: UDP. An ISP can filter your traffic and see if you move any data via this protocol; if you are, odds are you are using a VPN, although it could also be VoIP or a Google Meet, since they also use UDP.

  2. VPN clients have default ports: OpenVPN uses 1194, WireGuard uses 51820, L2TP uses 500 and 4500, and so on.

  3. The IP addresses of commercial VPNs, such as Mullvad or TunnelBear, are publicly known. If you make requests to these IPs, your ISP will know you are using a VPN.

You could make your own VPN server on a VPS, which would allow you to bypass known IPs, but 1. and 2. would still apply.

  • 2
    This does not answer the question, which already acknowledged an ISP could infer that someone was using a VPN. The question is about how to prevent them from being able to. The answer should be to reconfigure default port, to not use commercial VPN (and set up your own), etc. even though I doubt this would be enough. Also, many protocols uses UDP, and VPN certainly are not restricted to UDP.
    – Yuriko
    Sep 13, 2022 at 5:39
  • 1
    So .... the answer you almost got to was "use an IP that isn't known to be a VPN and don't use default ports", but you kinda breezed right past that. And UDP is a non-starter.
    – schroeder
    Sep 13, 2022 at 7:18

When strictly just trying to hide it from the ISP then it is possible with some work: Tunnel the VPN connection through something else, like an SSH connection, to an endpoint under your control and establish the VPN from there.

Of course, the traffic identification issue is not gone but just moved from the ISP to whoever owns the infrastructure of the endpoint used as they can see the VPN traffic.

Obfuscating steps like the ones mentioned by @foreverska can be used here as well to lower the likelihood of routine detection. A targeted investigation will not be fooled.


One could use DNSSEC to hide lookups, obfsproxy to try and trip up DPI, self managed VPNs hosted in a cloud using nonstandard ports and regularly changing IPs. Likely would fly under automated flagging.

The brightest of bots would likely determine a home network which only ever connects to a single ip/port at a time for the bulk of it's traffic is using a VPN no matter the ip/port. One could set up small computers to idly browse the internet and make the signal a bit noisier. Might trip up all but human review.


The ISP will know the IP address of the initial receiver. That's unavoidable, because the ISP has to deliver your message somewhere. If your VPN uses one known IP address, then your ISP can know that you are sending to a VPN IP address (99.99% likelihood for VPN traffic, 0.01% that your own computer is sending to the wrong IP address). If the VPN server has multiple IP addresses, your ISP could know them all.

If your ISP doesn't recognise the IP address, they can look at the structure of your message. They shouldn't be able to gain any knowledge about the real message other than the size, but they may be able to conclude that your message is a VPN message sent to an unknown VPN server and be right very often.

Last, if all your traffic goes to one IP address only, then that fact alone makes it likely that you are using a VPN. And if the ISP cannot make sense of the message because it is encrypted, and it doesn't look like https, then it is likely to be VPN.

So what can you do? Pick a VPN server that doesn't use a known IP address and a protocol that can be recognised. (So nothing technical, just pick the right VPN server). And the protocol should be such that it doesn't look like anything encrypted. For example, you could map an encrypted message to grammatically correct sequence of English words and back. Or wrap the VPN message into something that looks like SSL. That's something the VPN server would have to support. And use different IP addresses throughout the day.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .