Private Internet Access
github.com · Egress and tunnels · 1 record · JSON
Private Internet Access Egress and tunnels
paidemailno cardDretention-clamped
| Free tier | No free tier. Buy page 2026-10-23: 1 Month $11.95 per month; 1 Year $3.99 per month billed at $47.88; 3 Years + 3 Months $2.03 per month, autorenews at $79 every 3 years. unit none; metered on none |
|---|---|
| Price | USD 11.95 per month; USD 3.99 per month on 1 year (47.88); USD 2.03 per month on 3 years (79) |
| Per-object cap | not applicable |
| Retention | not applicable |
| Egress | unverified for a byte figure: the buy page states Unlimited Device Security but no page read states a traffic allowance. PIA is widely described as unmetered, which did not confirm from a vendor sentence. ingress: tcp+udp free_allowance: none published |
| Identity | email An account with credentials used by the scripts as PIA_USER and PIA_PASS; payment by card or PayPal. |
| Limits |
|
| Binding | retention-clamped No byte cap is stated, so the binding constraint is the 15-minute bind renewal: the port exists only while a loop keeps re-signing it. That is the same class of failure as Proton's lease but with a 900-second period instead of 60. |
| Interface | cli, rest Token and port are HTTP calls to the connected gateway on port 19999 (/getSignature, /bindPort); the scripts wrap them. |
| Tooling | pia-foss manual-connections scripts with wg-quick and curl/jq, or the official app. |
| Composes with | A token endpoint plus a bind loop is a five-line cron job on a free VM; the VM then holds a stable public UDP endpoint for the life of the signature. |
| Reliability | Losing the 15-minute renewal loop silently drops the port mapping while the tunnel stays up. United States servers cannot forward at all. |
| Notes | Two candidates for why the helpdesk article 404s: (1) the helpdesk was migrated to a new platform and the path changed, supported by the redirect to a different article slug on the same host; The GitHub route was used instead. The port number itself is stable for the life of the signature, which is the property Proton lacks. |
| Evidence rung | documented Measured would need a token, a bound port, a live UDP request through it and a byte count. The 15-minute and 2-month sentences are in the vendor's own repository README, read today. |
| Checked | 2026-10-23 (live); stale on 2026-11-22 |
| Parsed numbers |
|
Evidence (3)
| date | source | what it proved |
|---|---|---|
| 2026-10-23 | github.com/pia-foss/manual-connections | Native WireGuard plus port forwarding from vendor scripts; port signature valid 2 months; /bindPort must be called every 15 minutes or the port is deleted; port forwarding is off in the United States. |
| 2026-10-23 | www.privateinternetaccess.com/buy-vpn-online | Prices: $11.95 monthly, $3.99 per month on 1 year at $47.88, $2.03 per month on 3 years at $79. |
| 2026-10-23 | helpdesk.privateinternetaccess.com/kb/articles/pdf/how-do-i- | Indexed copy of the vendor article: a random port is automatically assigned, only specific locations support port forwarding, and a manual option exists for non-app clients. The live path returned 404 from the restructured helpdesk. |
More fields (7)
{
"wg_path": "registration-api",
"wg_detail": "The vendor's own scripts obtain a token and then a WireGuard config: this repository contains documentation on how to create native WireGuard and OpenVPN connections, and also on how to enable Port Forwarding. Run with PIA_PF=true to bind the port on the same connection.",
"ingress": "tcp+udp",
"volume_tib_month": null,
"volume_stated": "unverified for a byte figure: the buy page states Unlimited Device Security but no page read states a traffic allowance. PIA is widely described as unmetered, which did not confirm from a vendor sentence.",
"bytes_transit": "yes",
"transit_note": "Traffic crosses the PIA server the client is bound to; the port is only valid on the gateway of that server."
}Unknown or withheld values (2)
$.per_object_cap.statednot-applicable$.retention.statednot-applicable