{"eid":"protonvpn","name":"Proton VPN","domain":"protonvpn.com","resolved_by":"domain","topics":["egress","ip-proxy"],"n_records":2,"best_vorder":1,"review":null,"aliases":["Proton VPN","protonvpn.com"],"records":[{"rid":"ip-proxy/protonvpn-exits","card":{"rid":"ip-proxy/protonvpn-exits","eid":"protonvpn","topic":"ip-proxy","slug":"protonvpn-exits","provider":"Proton VPN","url":"https://protonvpn.com/pricing","domain":"protonvpn.com","category":"VPN subscription (exit source)","tier":"paid","verdict":"qualifies-with-caveat","vorder":1,"grp":"usable","confidence":"documented","binding":"none","identity_kind":"email","identity_basis":"stated","needs_card":0,"needs_phone":0,"needs_id":0,"needs_institution":0,"country":null,"crypto":null,"interfaces":"cli,rest","egress_metered":0,"per_object_bytes":null,"retention_days":null,"verified_at":"2026-10-24T10:07:11.000Z","verified_basis":"live","checked_on":"2026-10-25","stale_on":"2026-11-24","n_evidence":5,"usd_month":null,"usd_per_tb_month":3.49,"summary":"Free plan, quoted from the pricing page: Connect to servers in 10 countries (randomly selected) and Secure 1 device at a time; the same page answers Can I tr...","duplicate_of":null,"n_unknown":0},"record":{"topic":"ip-proxy","slug":"protonvpn-exits","provider":"Proton VPN","url":"https://protonvpn.com/pricing","category":"VPN subscription (exit source)","tier":"paid","free_tier":{"stated":"Free plan, quoted from the pricing page: Connect to servers in 10 countries (randomly selected) and Secure 1 device at a time; the same page answers Can I try Proton VPN for free? with a Free plan with no data limits, no artificial speed limits.","unit":"users","metered_on":"identity-count","source_url":"https://protonvpn.com/pricing","read_on":"2026-10-24","notes":"One device at a time, not one account. The 10 countries are drawn at random, so the free tier does not let a client choose its country."},"per_object_cap":{"stated":"not applicable: an exit address, not an object","bytes":null,"source_url":"https://protonvpn.com/pricing","notes":"The address is the whole product; there is no object whose size could be capped."},"retention":{"stated":"not applicable: a live tunnel and a rented exit address, not stored bytes","days":null,"source_url":"https://protonvpn.com/pricing","notes":"Nothing of the client's is stored at the exit; the address persists only for the life of the connection."},"egress":{"terms":"Proton VPN offers a Free plan with no data limits, no artificial speed limits, and no compromises on your privacy and security; a feature blurb on the same page offers fast download speeds and unlimited bandwidth. The page publishes no byte allowance and no overage price for any plan it lists.","metered":false,"free_allowance":"none published: the vendor states no data limits rather than a volume","price_per_tb":null,"source_url":"https://protonvpn.com/pricing"},"interface":["cli","rest"],"interface_detail":"The Linux CLI and the authenticated REST API at /vpn/logicals. The desktop and mobile apps and a web UI reach the same servers, and WireGuard and OpenVPN configurations are offered. The topic vocabulary's api, socks5, http-proxy, wireguard, openvpn and web-ui tokens are not in the interface enum of scripts/dossier/schema.json, so they are recorded in this sentence rather than as interface values.","endpoint":"/vpn/logicals — requires an authenticated session: HTTP 400 with Code 5002 Missing x-pm-appversion header when the app-version header is absent, HTTP 422 when it is present and the token is not valid.","tooling":"A Cloudflare Worker fetches through the exit with plain HTTP; nothing bespoke is needed and no wrapper exists for exit selection. The CLI and generated WireGuard or OpenVPN configurations reach the same servers, but picking a specific exit needs an authenticated session, because /vpn/logicals refuses unauthenticated reads.","chaining":"The Worker is the client and Proton supplies the only non-Cloudflare hop: the request leaves Cloudflare's ASN and reaches the target from AS212238, so the target sees a Datacamp address rather than a Cloudflare one. Secure Core is a hop topology, not a class change: it inserts an entry hop and leaves the exit's registration class where it was.","limits":[{"kind":"volume-quota","value":"none published: the vendor states no data limits and no artificial speed limits on the Free plan, and a feature blurb offers unlimited bandwidth; no byte allowance or overage price is listed","source":"https://protonvpn.com/pricing"},{"kind":"request-rate","value":"unmeasured: one Worker request through the exit returned HTTP 200 with a 14-byte body on 2026-10-03; no sustained rate was tested, so no rate limit is known either way","source":"cf-codex/evidence/experiments/05-proton-worker/logs/final.json"}],"limits_note":"Three constraints were found that the vocabulary has no kind for: the Free plan allows one device at a time; its server pool is 10 countries selected at random, so the exit cannot be chosen; and /vpn/logicals requires an authenticated session, so the 21,202-server fleet cannot be enumerated without an account. The measured exit sits in a hosting ASN (AS212238), which is why the record stops at rung 4.","binding":"none","binding_note":"Nothing in the vocabulary fails at 45 GB/month across about 599,000 requests: the vendor states no data limit, no rate was observed to be shaped, and the exit answered a Worker request at HTTP 200. What does bind sits outside the vocabulary — the Free plan's one device at a time, its random 10-country pool, and an authenticated session for /vpn/logicals. The caveat that keeps this off rung 5 is the ASN's class, not a quota.","identity_cost":{"kind":"email","detail":"An account registered with an email address. The facts record email as the only registration cost and name no second gate; the paid plans are sold against that account.","country":null},"reliability_note":"One exit was measured once: 149.50.216.236 answered a Cloudflare Worker request at HTTP 200 with a 14-byte body on 2026-10-03, and RIPE still maps the address to AS212238 on 2026-10-24; the fleet could not be enumerated, so nothing is claimed about the other servers' exits.","confidence":"documented","confidence_note":"The exit, its prefix and its ASN are measured: a Worker request returned the address and RIPE maps the /24 to AS212238. The price, the free-tier terms and the no-data-limit sentence are vendor-page reads, and the fleet count could not be enumerated, so the weakest rung the verdict rests on is documented. A paid account, a 45 GB transfer through one exit with a byte count at both ends, and an authenticated fleet listing would move the record to measured throughout.","evidence":[{"url":"https://protonvpn.com/pricing","date":"2026-10-24","proved":"List price $9.99 per month and $3.49 per month on the 24-month plan; Free plan is 1 device at a time in 10 randomly selected countries with no data limits and no artificial speed limits; the FAQ answer recommends a paid plan with servers in over 140 countries; a feature blurb offers unlimited bandwidth."},{"url":"probe:149.50.216.236","date":"2026-10-03","proved":"A Cloudflare Worker request left through the Proton exit: HTTP 200, 14 bytes, body 149.50.216.236. Log cf-codex/evidence/experiments/05-proton-worker/logs/final.json at 2026-10-03T19:09:40Z."},{"url":"https://stat.ripe.net/data/prefix-overview/data.json?resource=149.50.216.0/24","date":"2026-10-24","proved":"149.50.216.0/24 is announced and its announcing AS is 212238, holder CDNEXT Datacamp Limited; related prefix 149.50.0.0/15; query_time 2026-10-24T08:00:00."},{"url":"https://rest.db.ripe.net/ripe/aut-num/AS212238.json","date":"2026-10-24","proved":"AS212238 has as-name CDNEXT and org ORG-DL201-RIPE, status ASSIGNED, created 2020-12-02, last-modified 2026-07-14; org ORG-DL201-RIPE is Datacamp Limited, GB. RIPE carries no IP-type field, so the hosting classification is read from the holder, not from a registry class."},{"url":"probe:/vpn/logicals","date":"2026-10-24","proved":"Unauthenticated /vpn/logicals returns HTTP 400 with Code 5002 Missing x-pm-appversion header, and HTTP 422 once an app-version header is sent without a valid token, so the fleet cannot be enumerated without an account."}],"verdict":"qualifies-with-caveat","verified_at":"2026-10-24T10:07:11.000Z","price_per_tb_month":"$9.99 per month list; $3.49 per month on a 24-month plan; a subscription price, not a per-TB price","notes":"Proton VPN is the topic's baseline: it is the one non-Cloudflare exit measured working inside a Cloudflare Worker, so every other exit is judged against it. The measurement is a single sample — one exit, one request, HTTP 200, a 14-byte body — and the fleet could not be enumerated, because /vpn/logicals refuses unauthenticated reads. The brief records 401/422; the endpoint answered HTTP 400 with Code 5002 Missing x-pm-appversion header, then HTTP 422 once an app-version header was present and the token was not, which is the same conclusion by a different status. It does not clear rung 5: AS212238 is a hosting ASN, so the exit is a datacenter address and the class question is answered no. RIPE establishes the ASN and its holder (CDNEXT, Datacamp Limited, ORG-DL201-RIPE, GB) and carries no IP-type field, so the hosting classification is read from the holder's identity, one step above the registry; that step is the weakest link in the rung-5 judgement. Secure Core is a hop topology, not a class change: it inserts an entry hop and leaves the exit's registration class exactly where it was, so it cannot be used to reach rung 5. Two numbers conflict with the live page and both are named rather than smoothed: the brief gives 21,202 servers in 149 countries while the pricing page read 2026-10-24 says servers in over 140 countries, and neither fleet figure can be enumerated without an account, so both are vendor-stated. the pricing page states the Free plan has no data limits and no artificial speed limits, and a feature blurb on the same page offers unlimited bandwidth. What would settle the rest: an authenticated /vpn/logicals listing for a real fleet count, a 45 GB transfer through one exit with a byte count at both ends, and a second exit sampled from another country to see whether AS212238 is one server's upstream or the whole fleet's.","extras":{"rung":4,"rung_note":"The exit address, its /24 and its announcing ASN are measured, but the ASN belongs to a hosting provider, so the record stops at ASN and does not reach registration class.","exit_ip":"149.50.216.236","asn":"AS212238","asn_name":"CDNEXT","asn_holder":"CDNEXT Datacamp Limited","asn_org":"ORG-DL201-RIPE","prefix":"149.50.216.0/24","related_prefix":"149.50.0.0/15","measured_in":"Cloudflare Worker","measurement_log":"cf-codex/evidence/experiments/05-proton-worker/logs/final.json","measurement_at":"2026-10-03T19:09:40Z","response_bytes":14,"fleet_stated":"21,202 servers in 149 countries per the brief; servers in over 140 countries per the pricing page read 2026-10-24","secure_core":"hop topology, not a class change","price_usd":{"monthly_list":9.99,"per_month_on_24":3.49}}},"claims":[{"path":"$.free_tier.stated","kind":"free-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.limits[0].value","kind":"limit:volume-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.limits[1].value","kind":"limit:request-rate","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.price_per_tb_month","kind":"price-per-tb","num":3.49,"unit":"TB","per":"month","currency":"USD","usd":3.49,"fx_date":null,"parse":"ok"}],"unknown":[],"history":[],"drift":[]},{"rid":"egress/proton-vpn","card":{"rid":"egress/proton-vpn","eid":"protonvpn","topic":"egress","slug":"proton-vpn","provider":"Proton VPN","url":"https://protonvpn.com/support/port-forwarding","domain":"protonvpn.com","category":"vpn port forward","tier":"plus","verdict":"paid-only","vorder":3,"grp":"paid","confidence":"documented","binding":"write-gated","identity_kind":"email","identity_basis":"stated","needs_card":0,"needs_phone":0,"needs_id":0,"needs_institution":0,"country":null,"crypto":null,"interfaces":"cli","egress_metered":0,"per_object_bytes":null,"retention_days":null,"verified_at":"2026-10-23T00:00:00.000Z","verified_basis":"live","checked_on":"2026-10-23","stale_on":"2026-11-22","n_evidence":4,"usd_month":null,"usd_per_tb_month":120.6158,"summary":"Port forwarding is currently available on our Windows, macOS, and Linux GUI apps for everyone with a paid Proton VPN plan. The plan table marks P2P/BitTorren...","duplicate_of":null,"n_unknown":2},"record":{"topic":"egress","slug":"proton-vpn","provider":"Proton VPN","url":"https://protonvpn.com/support/port-forwarding","category":"vpn port forward","tier":"plus","free_tier":{"stated":"Port forwarding is currently available on our Windows, macOS, and Linux GUI apps for everyone with a paid Proton VPN plan. The plan table marks P2P/BitTorrent as absent from Proton Free and present on VPN Plus.","unit":"none","metered_on":"none","source_url":"https://protonvpn.com/support/port-forwarding","read_on":"2026-10-23","notes":""},"per_object_cap":{"stated":"not applicable","bytes":null,"source_url":"https://protonvpn.com/support/port-forwarding","notes":""},"retention":{"stated":"not applicable","days":null,"source_url":"https://protonvpn.com/support/port-forwarding","notes":""},"egress":{"terms":"unverified: no page read states a Proton VPN traffic allowance for the paid tier the plan table lists features and speeds, not bytes.; ingress: tcp+udp","metered":false,"free_allowance":"none published","price_per_tb":null,"source_url":"https://protonvpn.com/support/port-forwarding"},"interface":["cli"],"interface_detail":"Account web page generates configs; port control is NAT-PMP on the tunnel gateway, not a REST API.","tooling":"natpmpc from libnatpmp, or the official app; WireGuard config from the account page.","chaining":"Provides the public endpoint; the loop that keeps the lease alive is a small daemon the client must run beside the service.","limits":[{"kind":"write-gated","value":"NAT-PMP mapping expires in 60 seconds and must be looped: natpmpc -a 1 0 udp 60 -g 10.2.0.1, with sleep 45 between calls; closing the terminal terminates the loop","source":"https://protonvpn.com/support/port-forwarding-manual-setup"},{"kind":"per-ip-shaping","value":"P2P servers only; port forwarding is not compatible with NAT type 2 (moderate NAT)","source":"https://protonvpn.com/support/port-forwarding"}],"limits_note":"","binding":"write-gated","binding_note":"At 1 TiB/month nothing in the pages read states a byte cap, so the thing that fails first is the mapping: a 60-second NAT-PMP lease driven by a loop, on a port the vendor says usually changes when you reconnect. That is a keepalive dependency, not a volume limit.","identity_cost":{"kind":"email","detail":"An account with an email address; the signup page offers Or sign up for free and then a paid plan, with card, PayPal or Google Pay.","country":"None"},"reliability_note":"The forwarded port expires 60 seconds after the last NAT-PMP renewal; a crashed loop closes the port silently.","confidence":"documented","confidence_note":"Measured would need an account, a natpmpc loop and a byte count. The moving-port sentence comes from the GUI guide, so the stability claim is documented and the byte ceiling is openly unverified.","evidence":[{"url":"https://protonvpn.com/support/port-forwarding","date":"2026-10-23","proved":"Port forwarding is on all paid plans and not on Free; The port number usually changes when you reconnect to VPN."},{"url":"https://protonvpn.com/support/port-forwarding-manual-setup","date":"2026-10-23","proved":"A WireGuard config can carry NAT-PMP port forwarding; mappings last 60 seconds and must be renewed in a loop; example allocation port 53186 for both UDP and TCP."},{"url":"https://protonvpn.com/pricing","date":"2026-10-23","proved":"Proton Free has no P2P/BitTorrent and connects to servers in 10 countries; VPN Plus carries P2P."},{"url":"https://account.protonvpn.com/signup?plan=vpn2024&currency=EUR","date":"2026-10-23","proved":"VPN Plus prices: 9.99 EUR per month monthly, 5.32 EUR per month billed at 63.81 EUR for 12 months, 4.49 EUR per month billed at 107.76 EUR for 24 months."}],"verdict":"paid-only","verified_at":"2026-10-23T00:00:00.000Z","price_per_tb_month":"EUR 9.99 per month; EUR 5.32 per month on 12 months (63.81 EUR); EUR 4.49 per month on 24 months (107.76 EUR)","notes":"Three candidate explanations for a port-forwarding product on a shared IP: (1) the port is per-account and stable, refuted by The port number usually changes when you reconnect to VPN; (2) the port is allocated per session and leased, confirmed by the 60-second natpmpc lease and the 45-second sleep loop; (3) the port is fixed per server, refuted because the guide tells you to re-derive the public port after each session and paste it into the client. The practical consequence is that ingress works but the endpoint is not addressable across a reconnect without a control loop that rewrites the consumer's config.","extras":{"wg_path":"native-conf","wg_detail":"A WireGuard configuration file is generated in the account with the port-forwarding toggle baked in: Select a VPN server that supports P2P (double-arrow icon) and generate a WireGuard configuration file. When doing this, ensure that Select VPN options then NAT-PMP (port forwarding) is enabled. Mappings are then made with natpmpc from the client.","ingress":"tcp+udp","volume_tib_month":null,"volume_stated":"unverified: no page read states a Proton VPN traffic allowance for the paid tier the plan table lists features and speeds, not bytes.","bytes_transit":"yes","transit_note":"Traffic exits at the P2P server's address for the duration of the mapping."}},"claims":[{"path":"$.free_tier.stated","kind":"free-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.limits[0].value","kind":"limit:write-gated","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.limits[1].value","kind":"limit:per-ip-shaping","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.price_per_tb_month","kind":"price-per-tb","num":107.76,"unit":"TB","per":"month","currency":"EUR","usd":120.6158,"fx_date":"2026-10-23","parse":"ok"}],"unknown":[["$.per_object_cap.stated","not-applicable"],["$.retention.stated","not-applicable"]],"history":[],"drift":[]}]}