fshy / Egress and tunnels / IP and proxies
NordVPN
nordvpn.com · Egress and tunnels, IP and proxies · 2 records · JSON
- NordVPN IP and proxiescaveatemailcardDper-ip-shaping
- NordVPN Egress and tunnelsfails: egressemail?card?Dwrite-gated
NordVPN IP and proxies
caveatemailcardDper-ip-shaping
| Free tier | No free tier. The cheapest plan read is Basic at $3.49 per month on a 2-year term, billed $94.23 for the first 27 months with 3 extra months and a 69% saving shown; the Dedicated IP is a separate add-on shown as Add at checkout with no price. unit none; metered on none; $3.49 per month is the 2-year Basic rate, not a monthly rate. The page states the price with a dollar sign and the locale read was the US one; the currency code was not printed, so the record repeats the symbol rather than asserting USD. |
|---|---|
| Price | $3.49 per month on a 2-year term (Basic); no per-TB price exists in the sources read |
| Per-object cap | not applicable |
| Retention | not applicable: an address, not an object |
| Egress | unverified: no source read for this record states a traffic allowance or a per-GB price; the plan is quoted by term only. A byte cap has not been ruled out, and one would change the verdict. metered is recorded false because no metered statement was found, which is an absence of evidence and not a vendor promise. free_allowance: none published |
| Identity | email An account created with an email address is what a plan is bought against; the class recorded here is email, as the facts supplied for this record state. The purchase flow itself was not walked, so whether a card is also required at signup is unverified, and a payment method is certainly required to buy. |
| Limits |
Two constraints found that name no vocabulary kind. (1) Address concentration: 775 /24s sit in 25 ASNs, and 347 of them, 45%, are in AS212238 Datacamp, so the number of distinct networks a rotation can reach is 25 and not 7,193. (2) The Dedicated IP is an add-on whose price is not published on the vendor's own pages read for this record; the checkout shows it as Add at checkout with no figure, and its measured subgroup is 209 /24s in 12 ASNs, 155 of them in AS212238. The connection ceiling is ten, not the eight the facts supplied for this record carried: the pricing page says Ten simultaneous connections on ten devices, the support article says You can connect up to 10 devices to a single NordVPN account at the same time, and the app's own error text says If you're connected on 10 devices, first disconnect one of them. |
| Binding | per-ip-shaping At about 599,000 requests and 45 GB a month no byte quota binds, because no per-GB price or byte allowance appears in the sources read. What binds first is the ceiling attached to the caller: 10 simultaneous connections on one account, of which at most five can share one server, so the 25-ASN pool is reached by rotating ten connections and not by opening 775 addresses. |
| Interface | rest Two access paths are established. The server list at https://api.nordvpn.com/v1/servers?limit=100000 answers without a credential and returns the whole pool, which is how it was measured. The vendor also documents HTTP proxy and SOCKS5 as connection methods alongside NordLynx, NordWhisper, OpenVPN TCP and OpenVPN UDP: a total of five devices can be connected to one server at the same time: through HTTP proxy, SOCKS5, NordLynx, NordWhisper, OpenVPN TCP, and OpenVPN UDP. That matters more than the tunnel for this topic, because a SOCKS5 or HTTP proxy endpoint is reachable without a WireGuard implementation. The schema's interface enum has no token for socks5, http-proxy, wireguard or openvpn, so the protocols are named here and not in the array; putting them in the array fails validation, which is the defect four sibling records in this topic already carry. |
| Tooling | Reading the pool needs nothing but an HTTP client: the servers API took no key. For a working exit the vendor documents SOCKS5 and HTTP proxy credentials as well as the tunnel, so the client can point a proxy-aware HTTP client at the exit without writing a WireGuard dialler; whether those credentials are issued on the Basic plan was not established. No wrapper for any of it was read or tested, which is a statement about tooling and not a reason to reject the provider. |
| Composes with | A Worker or a free compute node dials the tunnel and the traffic leaves at the exit address, so NordVPN supplies the address and carries the bytes; at about 45 GB a month the tunnel is one of the 10 connections the account allows, so chaining means rotating a handful of exits rather than reaching all 25 ASNs at once. |
| Reliability | No suspension, throttle or data loss was measured. The shared fleet's addresses are concentrated in AS212238 Datacamp, the datacenter network that also carries the measured Proton exit, so a block met through a shared exit is a datacenter-class block rather than an eyeball one. |
| Notes | What the record establishes, and what it refuses to. The 7,193 figure is a node count: the same response holds 775 distinct /24s, so 7,193 servers over 25 ASNs is a ratio of about 288, and a document that reads the server count as an address count overstates the reachable networks by 288x. That is the trap this topic exists to name, and it is a correction of a way of counting rather than of a sentence somebody wrote. Two supplied facts did not survive the reading, and the record carries what the sources say rather than what the brief said. First, the connection ceiling is 10, not 8, and there is no Shared tier with an 8-connection cap: the pricing page reads Ten simultaneous connections on ten devices secured with one NordVPN account, the support article reads You can connect up to 10 devices to a single NordVPN account at the same time, and the app's own error text reads If you're connected on 10 devices, first disconnect one of them. Three independent first-party sources agreeing is why the number in limits[] is ten. The qualifier that makes it bite is the per-server rule: a shared server takes at most five devices, one per protocol, so ten connections over one server is not ten exits. Second, NordVPN documents SOCKS5 and HTTP proxy as connection methods beside the tunnels, which is a materially better fit for a gateway than a WireGuard dialler and was missing from the brief. Reproduced before writing this record, not relayed: a fresh fetch of the API returned HTTP 200 and 26,946,981 bytes, 7,193 server records, 150 country codes and 775 distinct /24s from the station fields, and five sampled prefixes re-resolved through RIPE to the same ASNs the stored table carries. What that reproduction does not do is re-run all 775 lookups, so the 25-ASN count and the 347 /24s in AS212238 rest on the stored table plus a five-prefix spot check. The pricing page answered HTTP 403 to a bare fetch and 200 to a browser user agent, so the price is read rather than inferred, but the 403 is recorded because a later session with a different client will see the failure and not the page. The dedicated-IP feature page answered 403 outright and is cited for the add-on shape only, on the pricing table's Add at checkout row. Three candidates for the 25-ASN figure, and what each would take to settle: (1) the fleet really is 25 networks, supported by the arithmetic, since 7,193 nodes over 775 prefixes is about 9.3 nodes per /24 and no prefix is invented by counting; (2) the list under-reports the pool, so 25 is a floor, plausible and unsettled, and it would need a connect-and-observe sample recording the addresses actually handed out; (3) the RIPE resolution over-merged distinct holders into one ASN, which the 45% share argues against, because 347 /24s landing in one ASN is a property of those prefixes and the holder is named once for all of them. Candidate 2 is the live one and it is the one this record cannot close: the measurement is a single fetch of the list on one day, resolved through RIPE, and the pool as handed out at connect time was never observed. The caveat in the verdict is therefore the concentration, not the price: 45% of the shared fleet and 155 of 209 dedicated-IP /24s sit in the same ASN, so a NordVPN exit and a Proton exit can land in the same ASN. The Dedicated IP narrows the pool to 12 ASNs and does not leave AS212238, and its price is unpublished on the pages read, so it cannot be priced into a recommendation. Two attributions this record makes from a neighbour rather than from a page: the datacenter reading of AS212238, whose holder CDNEXT Datacamp Limited is named in dossier/ip-proxy/protonvpn-exits.json, and the Proton comparison itself, which is that record's measured exit. Neither is a hosting flag read from an IP-type database, so the class question stays at ASN and not at registration class. The interface array carries only rest because the schema's enum has no token for socks5, http-proxy, wireguard or openvpn; four sibling records in this topic already fail the gate on exactly that, and interface_detail names the protocols instead of breaking validation. Cross-topic: dossier/egress/nordvpn.json answers a different question, port forwarding, which this vendor sells only as a Dedicated Server, and it carries price_per_tb_month and identity_cost as unverified because its lane read no purchase page. This record supplies the price and the identity class. It does not change that record's verdict and does not edit it. |
| Evidence rung | documented The verdict rests on four fields: the plan price (read from the vendor's page, documented), the 10-connection cap (three first-party sources, documented), the identity class (email), and the address diversity (measured). The weakest of those is documented. The traffic-byte position is the one field left unverified, and it does not move the verdict, because the plan is sold by term with no allowance attached in the sources read. Measured would need the server list resolved again from the client's own network and a live connection recording the address actually handed out, because a /24 in the list is a pool and not an address. |
| Checked | 2026-10-25 (live); stale on 2026-11-24 |
| Parsed numbers |
|
Evidence (9)
| date | source | what it proved |
|---|---|---|
| 2026-10-24 | nordvpn.com/pricing/ | Basic is $3.49 per month on a 2-year term, and the plan table says Ten simultaneous connections on ten devices secured with one NordVPN account; the Dedicated IP row reads Add at checkout / Add-on with no price. |
| 2026-10-24 | support.nordvpn.com/hc/en-us/articles/19476515228305-How-man | You can connect up to 10 devices to a single NordVPN account at the same time; a shared server takes at most five devices, one per protocol, naming HTTP proxy, SOCKS5, NordLynx, NordWhisper, OpenVPN TCP and OpenVPN UDP. |
| 2026-10-24 | support.nordvpn.com/hc/en-us/articles/47181405478417-I-get-t | The client-side enforcement of the ceiling: You initiated too many connections or reached the device limit, wait 10 minutes, and the app's own text says If you're connected on 10 devices, first disconnect one of them. |
| 2026-10-24 | support.nordvpn.com/hc/en-us/articles/19484196251921-How-to- | Dedicated IP is bought per account and multiple IPs may be held, but you can't exceed ten simultaneous connections overall; no price appears in the article. |
| 2026-10-24 | nordvpn.com/features/dedicated-ip/ | Dedicated IP is sold as an add-on to the subscription; a direct fetch of this page answered HTTP 403, so the add-on claim rests on the pricing table's Add at checkout row and on the support article, not on this URL. |
| 2026-10-24 | api.nordvpn.com/v1/servers?limit=100000 | The vendor's own server list returns 7,193 servers across 150 countries; this response is the input the ASN measurement ran on. |
| 2026-10-24 | probe:nordvpn-api-asn-diversity-2026-10-24 | 775 distinct /24s resolved to 25 distinct ASNs; 347 of the 775, 45%, are in AS212238 Datacamp, the ASN measured for the Proton exit; the dedicated-IP subgroup is 209 /24s in 12 ASNs with 155 in AS212238. |
| 2026-10-24 | probe:api.nordvpn.com/v1/servers?limit=100000@2026-10-24T12:03Z | Reproduction of the pool from a fresh fetch: HTTP 200, 26,946,981 bytes, 7,193 server records, 150 distinct country codes, and 775 distinct /24s derived from the station fields, which is the same /24 count the ASN measurement used. |
| 2026-10-24 | probe:stat.ripe.net/data/prefix-overview five sampled /24s | A live re-check of five sampled prefixes agreed with the stored resolution: 109.204.49.0/24, 138.199.10.0/24 and 138.199.11.0/24 to AS212238 CDNEXT Datacamp Limited, and 130.195.218.0/24 and 135.136.7.0/24 to AS9009 M247 Europe SRL. |
More fields (10)
{
"rung": 4,
"rung_note": "Every distinct /24 in the vendor's own server list was resolved to an ASN with RIPE, so the record knows the exit sits in AS212238 rather than in an unnamed network; it stops at rung 4 because no exit was connected to and no IP-type flag was read, so the datacenter reading rests on the holder's name and not on a measured hosting field.",
"asn_diversity": {
"measured_on": "2026-10-24",
"servers": 7193,
"countries": 150,
"subnets_24": 775,
"asns": 25,
"largest_asn": "AS212238 Datacamp",
"largest_asn_subnets_24": 347,
"largest_asn_share": "45%",
"nodes_per_subnet_24": "9.3",
"servers_per_asn": "288, which is why a server count is not an address count"
},
"dedicated_ip": {
"product": "add-on",
"price": "unverified: not published on the vendor's own pages read for this record",
"subnets_24": 209,
"asns": 12,
"largest_asn": "AS212238 Datacamp",
"largest_asn_subnets_24": 155,
"note": "155 of the 209 /24s in the dedicated-IP subgroup sit in the ASN that also holds 45% of the shared fleet, so the add-on narrows the pool to 12 ASNs without leaving the ASN that binds."
},
"shared_asn_with": "AS212238 is the ASN measured for the Proton VPN exit in dossier/ip-proxy/protonvpn-exits.json, so the two subscriptions do not diversify against each other at the top of their pools.",
"price": "$3.49 per month on a 2-year term, Basic; $94.23 billed for the first 27 months of the 2-year plan with 3 extra months",
"connection_ceiling": {
"stated": "Ten simultaneous connections on ten devices secured with one NordVPN account.",
"value": 10,
"per_server": "at most five devices on one server, one per protocol",
"enforcement": "client error reads You initiated too many connections or reached the device limit: Wait 10 minutes before the next connection. If you're connected on 10 devices, first disconnect one of them",
"corrects_brief": "the brief carried 8 simultaneous connections on Shared; three first-party sources say 10 and none says 8"
},
"access_methods": "HTTP proxy, SOCKS5, NordLynx, NordWhisper, OpenVPN TCP, OpenVPN UDP; SOCKS5 and HTTP proxy are documented as ways to connect, which is what makes this reachable from a proxy-aware client without a WireGuard implementation.",
"reproduced_at": "2026-10-24T12:03:55Z",
"reproduced_how": "curl https://api.nordvpn.com/v1/servers?limit=100000 returned HTTP 200 and 26,946,981 bytes; 7,193 records, 150 country codes, 775 distinct /24s from the station fields, matching the /24 count in the stored ASN table. Five sampled prefixes re-resolved through stat.ripe.net prefix-overview to the same ASNs. The full 775-lookup pass was not re-run. nordvpn.com/pricing answered HTTP 403 to a bare curl and HTTP 200 to a browser user agent, which is where the price, the ten-device line and the Add at checkout row were read; features/dedicated-ip answered 403 either way."
}Unknown or withheld values (1)
$.per_object_cap.statednot-applicable
NordVPN Egress and tunnels
fails: egressemail?card?Dwrite-gated
| Free tier | No free tier, and no forwarding on the standard product: Unfortunately, at the current moment, we do not offer port forwarding, as multiple customers are using the same servers. unit none; metered on none |
|---|---|
| Price | unverified: no plan price was read |
| Per-object cap | not applicable |
| Retention | not applicable |
| Egress | unverified: no page read states a NordVPN traffic allowance. ingress: none free_allowance: none published |
| Identity | email (placeholder) unverified: the purchase flow was not read; an account is required. |
| Limits |
|
| Binding | write-gated On the shared product there is no inbound path; on the Dedicated Server there is, but that is a rented server with its own provisioning step, so the gate is commercial rather than technical. |
| Interface | cli Official app and Linux CLI; no port API. |
| Tooling | NordLynx and community .conf extractors for outbound; no port facility without the add-on. |
| Composes with | Client-side tunnel only unless the Dedicated Server is bought. |
| Reliability | No inbound path on the shared fleet; the Dedicated Server is a dedicated machine with its own reliability profile, which did not read. |
| Notes | Three candidates for a provider that both denies and documents forwarding: (1) the denial covers the shared fleet and the documentation covers a rented machine, confirmed, since both sentences are on the same support site and the second explicitly excludes standard servers; (2) the feature is region-limited, not supported by anything read; (3) the denial is stale, refuted because it sits beside a current article that says the same thing more precisely. The useful finding is that NordVPN sells ingress as a server, which prices it out's class. |
| Evidence rung | documented Both sentences are the vendor's support pages read today. The Dedicated Server path was established from the support article's own text, not from the add-on's price, which was not read. |
| Checked | 2026-10-23 (live); stale on 2026-11-22 |
Evidence (2)
| date | source | what it proved |
|---|---|---|
| 2026-10-23 | support.nordvpn.com/hc/en-us/articles/19483392309649-Does-No | NordVPN does not offer port forwarding on standard service because multiple customers share servers. |
| 2026-10-23 | support.nordvpn.com/hc/en-us/articles/46022896056593-How-to- | Forwarding exists only with the Dedicated Server add-on, not on standard servers or Dedicated IP; settings appear during provisioning. |
More fields (7)
{
"wg_path": "extractable",
"wg_detail": "NordLynx is the vendor's WireGuard build, and .conf extractors exist in the community; the tunnel is real but there is nothing to forward into, so a config does not pass the ingress test. The only forwarding path the vendor documents is a separate Dedicated Server product: Port forwarding is available exclusively with the Dedicated Server add-on. Standard NordVPN servers and Dedicated IP do not support port forwarding.",
"ingress": "none",
"volume_tib_month": null,
"volume_stated": "unverified: no page read states a NordVPN traffic allowance.",
"bytes_transit": "yes",
"transit_note": "Outbound only from the client's point of view on the shared fleet."
}Unknown or withheld values (3)
$.identity_cost.kindidentity-defaulted$.per_object_cap.statednot-applicable$.retention.statednot-applicable