fshy / Egress and tunnels / IP and proxies
Proton VPN
protonvpn.com · Egress and tunnels, IP and proxies · 2 records · JSON
- Proton VPN IP and proxiescaveatemailno cardD
- Proton VPN Egress and tunnelspaidemailno cardDwrite-gated
Proton VPN IP and proxies
caveatemailno cardD
| Free tier | Free plan, quoted from the pricing page: Connect to servers in 10 countries (randomly selected) and Secure 1 device at a time; the same page answers Can I try Proton VPN for free? with a Free plan with no data limits, no artificial speed limits. unit users; metered on identity-count; One device at a time, not one account. The 10 countries are drawn at random, so the free tier does not let a client choose its country. |
|---|---|
| Price | $9.99 per month list; $3.49 per month on a 24-month plan; a subscription price, not a per-TB price |
| Per-object cap | not applicable: an exit address, not an object |
| Retention | not applicable: a live tunnel and a rented exit address, not stored bytes |
| Egress | Proton VPN offers a Free plan with no data limits, no artificial speed limits, and no compromises on your privacy and security; a feature blurb on the same page offers fast download speeds and unlimited bandwidth. The page publishes no byte allowance and no overage price for any plan it lists. free_allowance: none published: the vendor states no data limits rather than a volume |
| Identity | email An account registered with an email address. The facts record email as the only registration cost and name no second gate; the paid plans are sold against that account. |
| Limits |
Three constraints were found that the vocabulary has no kind for: the Free plan allows one device at a time; its server pool is 10 countries selected at random, so the exit cannot be chosen; and /vpn/logicals requires an authenticated session, so the 21,202-server fleet cannot be enumerated without an account. The measured exit sits in a hosting ASN (AS212238), which is why the record stops at rung 4. |
| Binding | none Nothing in the vocabulary fails at 45 GB/month across about 599,000 requests: the vendor states no data limit, no rate was observed to be shaped, and the exit answered a Worker request at HTTP 200. What does bind sits outside the vocabulary — the Free plan's one device at a time, its random 10-country pool, and an authenticated session for /vpn/logicals. The caveat that keeps this off rung 5 is the ASN's class, not a quota. |
| Interface | cli, rest The Linux CLI and the authenticated REST API at /vpn/logicals. The desktop and mobile apps and a web UI reach the same servers, and WireGuard and OpenVPN configurations are offered. The topic vocabulary's api, socks5, http-proxy, wireguard, openvpn and web-ui tokens are not in the interface enum of scripts/dossier/schema.json, so they are recorded in this sentence rather than as interface values. endpoint: /vpn/logicals — requires an authenticated session: HTTP 400 with Code 5002 Missing x-pm-appversion header when the app-version header is absent, HTTP 422 when it is present and the token is not valid. |
| Tooling | A Cloudflare Worker fetches through the exit with plain HTTP; nothing bespoke is needed and no wrapper exists for exit selection. The CLI and generated WireGuard or OpenVPN configurations reach the same servers, but picking a specific exit needs an authenticated session, because /vpn/logicals refuses unauthenticated reads. |
| Composes with | The Worker is the client and Proton supplies the only non-Cloudflare hop: the request leaves Cloudflare's ASN and reaches the target from AS212238, so the target sees a Datacamp address rather than a Cloudflare one. Secure Core is a hop topology, not a class change: it inserts an entry hop and leaves the exit's registration class where it was. |
| Reliability | One exit was measured once: 149.50.216.236 answered a Cloudflare Worker request at HTTP 200 with a 14-byte body on 2026-10-03, and RIPE still maps the address to AS212238 on 2026-10-24; the fleet could not be enumerated, so nothing is claimed about the other servers' exits. |
| Notes | Proton VPN is the topic's baseline: it is the one non-Cloudflare exit measured working inside a Cloudflare Worker, so every other exit is judged against it. The measurement is a single sample — one exit, one request, HTTP 200, a 14-byte body — and the fleet could not be enumerated, because /vpn/logicals refuses unauthenticated reads. The brief records 401/422; the endpoint answered HTTP 400 with Code 5002 Missing x-pm-appversion header, then HTTP 422 once an app-version header was present and the token was not, which is the same conclusion by a different status. It does not clear rung 5: AS212238 is a hosting ASN, so the exit is a datacenter address and the class question is answered no. RIPE establishes the ASN and its holder (CDNEXT, Datacamp Limited, ORG-DL201-RIPE, GB) and carries no IP-type field, so the hosting classification is read from the holder's identity, one step above the registry; that step is the weakest link in the rung-5 judgement. Secure Core is a hop topology, not a class change: it inserts an entry hop and leaves the exit's registration class exactly where it was, so it cannot be used to reach rung 5. Two numbers conflict with the live page and both are named rather than smoothed: the brief gives 21,202 servers in 149 countries while the pricing page read 2026-10-24 says servers in over 140 countries, and neither fleet figure can be enumerated without an account, so both are vendor-stated. the pricing page states the Free plan has no data limits and no artificial speed limits, and a feature blurb on the same page offers unlimited bandwidth. What would settle the rest: an authenticated /vpn/logicals listing for a real fleet count, a 45 GB transfer through one exit with a byte count at both ends, and a second exit sampled from another country to see whether AS212238 is one server's upstream or the whole fleet's. |
| Evidence rung | documented The exit, its prefix and its ASN are measured: a Worker request returned the address and RIPE maps the /24 to AS212238. The price, the free-tier terms and the no-data-limit sentence are vendor-page reads, and the fleet count could not be enumerated, so the weakest rung the verdict rests on is documented. A paid account, a 45 GB transfer through one exit with a byte count at both ends, and an authenticated fleet listing would move the record to measured throughout. |
| Checked | 2026-10-25 (live); stale on 2026-11-24 |
| Parsed numbers |
|
Evidence (5)
| date | source | what it proved |
|---|---|---|
| 2026-10-24 | protonvpn.com/pricing | List price $9.99 per month and $3.49 per month on the 24-month plan; Free plan is 1 device at a time in 10 randomly selected countries with no data limits and no artificial speed limits; the FAQ answer recommends a paid plan with servers in over 140 countries; a feature blurb offers unlimited bandwidth. |
| 2026-10-03 | probe:149.50.216.236 | A Cloudflare Worker request left through the Proton exit: HTTP 200, 14 bytes, body 149.50.216.236. Log cf-codex/evidence/experiments/05-proton-worker/logs/final.json at 2026-10-03T19:09:40Z. |
| 2026-10-24 | stat.ripe.net/data/prefix-overview/data.json?resource=149.50 | 149.50.216.0/24 is announced and its announcing AS is 212238, holder CDNEXT Datacamp Limited; related prefix 149.50.0.0/15; query_time 2026-10-24T08:00:00. |
| 2026-10-24 | rest.db.ripe.net/ripe/aut-num/AS212238.json | AS212238 has as-name CDNEXT and org ORG-DL201-RIPE, status ASSIGNED, created 2020-12-02, last-modified 2026-07-14; org ORG-DL201-RIPE is Datacamp Limited, GB. RIPE carries no IP-type field, so the hosting classification is read from the holder, not from a registry class. |
| 2026-10-24 | probe:/vpn/logicals | Unauthenticated /vpn/logicals returns HTTP 400 with Code 5002 Missing x-pm-appversion header, and HTTP 422 once an app-version header is sent without a valid token, so the fleet cannot be enumerated without an account. |
More fields (16)
{
"rung": 4,
"rung_note": "The exit address, its /24 and its announcing ASN are measured, but the ASN belongs to a hosting provider, so the record stops at ASN and does not reach registration class.",
"exit_ip": "149.50.216.236",
"asn": "AS212238",
"asn_name": "CDNEXT",
"asn_holder": "CDNEXT Datacamp Limited",
"asn_org": "ORG-DL201-RIPE",
"prefix": "149.50.216.0/24",
"related_prefix": "149.50.0.0/15",
"measured_in": "Cloudflare Worker",
"measurement_log": "cf-codex/evidence/experiments/05-proton-worker/logs/final.json",
"measurement_at": "2026-10-03T19:09:40Z",
"response_bytes": 14,
"fleet_stated": "21,202 servers in 149 countries per the brief; servers in over 140 countries per the pricing page read 2026-10-24",
"secure_core": "hop topology, not a class change",
"price_usd": {
"monthly_list": 9.99,
"per_month_on_24": 3.49
}
}Proton VPN Egress and tunnels
paidemailno cardDwrite-gated
| Free tier | Port forwarding is currently available on our Windows, macOS, and Linux GUI apps for everyone with a paid Proton VPN plan. The plan table marks P2P/BitTorrent as absent from Proton Free and present on VPN Plus. unit none; metered on none |
|---|---|
| Price | EUR 9.99 per month; EUR 5.32 per month on 12 months (63.81 EUR); EUR 4.49 per month on 24 months (107.76 EUR) |
| Per-object cap | not applicable |
| Retention | not applicable |
| Egress | unverified: no page read states a Proton VPN traffic allowance for the paid tier the plan table lists features and speeds, not bytes.; ingress: tcp+udp free_allowance: none published |
| Identity | email An account with an email address; the signup page offers Or sign up for free and then a paid plan, with card, PayPal or Google Pay. |
| Limits | |
| Binding | write-gated At 1 TiB/month nothing in the pages read states a byte cap, so the thing that fails first is the mapping: a 60-second NAT-PMP lease driven by a loop, on a port the vendor says usually changes when you reconnect. That is a keepalive dependency, not a volume limit. |
| Interface | cli Account web page generates configs; port control is NAT-PMP on the tunnel gateway, not a REST API. |
| Tooling | natpmpc from libnatpmp, or the official app; WireGuard config from the account page. |
| Composes with | Provides the public endpoint; the loop that keeps the lease alive is a small daemon the client must run beside the service. |
| Reliability | The forwarded port expires 60 seconds after the last NAT-PMP renewal; a crashed loop closes the port silently. |
| Notes | Three candidate explanations for a port-forwarding product on a shared IP: (1) the port is per-account and stable, refuted by The port number usually changes when you reconnect to VPN; (2) the port is allocated per session and leased, confirmed by the 60-second natpmpc lease and the 45-second sleep loop; (3) the port is fixed per server, refuted because the guide tells you to re-derive the public port after each session and paste it into the client. The practical consequence is that ingress works but the endpoint is not addressable across a reconnect without a control loop that rewrites the consumer's config. |
| Evidence rung | documented Measured would need an account, a natpmpc loop and a byte count. The moving-port sentence comes from the GUI guide, so the stability claim is documented and the byte ceiling is openly unverified. |
| Checked | 2026-10-23 (live); stale on 2026-11-22 |
| Parsed numbers |
|
Evidence (4)
| date | source | what it proved |
|---|---|---|
| 2026-10-23 | protonvpn.com/support/port-forwarding | Port forwarding is on all paid plans and not on Free; The port number usually changes when you reconnect to VPN. |
| 2026-10-23 | protonvpn.com/support/port-forwarding-manual-setup | A WireGuard config can carry NAT-PMP port forwarding; mappings last 60 seconds and must be renewed in a loop; example allocation port 53186 for both UDP and TCP. |
| 2026-10-23 | protonvpn.com/pricing | Proton Free has no P2P/BitTorrent and connects to servers in 10 countries; VPN Plus carries P2P. |
| 2026-10-23 | account.protonvpn.com/signup?plan=vpn2024¤cy=EUR | VPN Plus prices: 9.99 EUR per month monthly, 5.32 EUR per month billed at 63.81 EUR for 12 months, 4.49 EUR per month billed at 107.76 EUR for 24 months. |
More fields (7)
{
"wg_path": "native-conf",
"wg_detail": "A WireGuard configuration file is generated in the account with the port-forwarding toggle baked in: Select a VPN server that supports P2P (double-arrow icon) and generate a WireGuard configuration file. When doing this, ensure that Select VPN options then NAT-PMP (port forwarding) is enabled. Mappings are then made with natpmpc from the client.",
"ingress": "tcp+udp",
"volume_tib_month": null,
"volume_stated": "unverified: no page read states a Proton VPN traffic allowance for the paid tier the plan table lists features and speeds, not bytes.",
"bytes_transit": "yes",
"transit_note": "Traffic exits at the P2P server's address for the duration of the mapping."
}Unknown or withheld values (2)
$.per_object_cap.statednot-applicable$.retention.statednot-applicable