If the key exchange happens when using lets say Wireguard or any other protocols that use IKA, and the connection never drops, could the ISP still detect the VPN traffic using Deep Packet Inspection?

  • Some VPN base on TLS connections, for such connections the only chance to identify them as VPN would be TLS fingerprinting in the handshake phase.
    – Robert
    Commented Oct 16, 2022 at 11:40
  • 1
    Most VPNs use well defined ports and most commercial VPNs use well known IP addresses. Commented Oct 17, 2022 at 16:50

2 Answers 2


Yes, the ISP could detect encrypted traffic (likely) corresponding to VPN. They could block it as well (such as blocking the server you are connecting to).

They could not block specific traffic inside the VPN or know what is being transferred (unless that's obvious from traffic volumetry)


What happens with VPN, for example when you are at home: Normally, all your traffic would go to your isp, who sends it to the destination. With vpn, your computer encrypts your traffic, and sends it to your isp, addressed to the vpn provider. Your isp sends it to the vpn provider, who decrypts it and passes it to the real recipient, with the return address forged so it isn’t yours, but the von provider.

Your isp can detect that you are sending to a vpn server. First, by analysing your traffic. Then there is the obvious fact that you send all your data to one single address, instead of different ones. So they can interfere with your traffic.

The vpn provider decrypts your traffic. They are in a very strong position to interfere. So you need to trust your vpn provider.

At last the vpn server sends your traffic to the recipient. It looks like it comes from a different address than yours. The recipient may have a list of addresses that Vpn addresses are detected and block anything coming from a vpn.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .