IVPN Client

IVPN Client is the desktop application for a privacy-first tunnel service, and it makes a point of doing less marketing and more engineering than its rivals. The client is open source, the service has been audited repeatedly, the servers are bare metal in 41 countries with no virtual locations, and an account is a number rather than an email address. The window itself is plain. A connect button, a server picker with a map, a protocol choice between WireGuard and OpenVPN, and a settings panel where the interesting parts live.

Those parts are a firewall that doubles as a kill switch and can be left always on, multi-hop routes through two servers in separate jurisdictions, an AntiTracker that blocks advertising and tracking domains at the network level, obfuscation for networks that block tunnels, and WireGuard privacy controls that rotate keys and addresses on a schedule you set.

IVPN Client is aimed at people who have read about how tunnels leak and want each leak closed by a setting they can inspect, not at people who want a country flag and a big green button.

Protocols, and the quantum-resistant default

WireGuard is the IVPN Client default, and the client sets it up with a post-quantum key exchange switched on, at no measurable speed penalty, which is unusual for a consumer client. Keys are generated locally and the public half uploaded when you first select the protocol, then rotated on a schedule you choose, along with the internal address, so a long session does not carry one identity for days.

OpenVPN remains available for networks where it behaves better, with UDP and TCP and a spread of ports including 53, 80 and 443 to slip past restrictive firewalls.

Both protocols carry the same feature set, firewall, trusted networks, AntiTracker and multi-hop included, which is rarer than it sounds. Configuration files for either can also be generated in the account area for routers and for a standalone OpenVPN client.

The firewall, and why it is not just a kill switch

Most clients offer a kill switch that cuts the connection when the tunnel drops. In IVPN Client the equivalent is a firewall with two modes. On-demand raises it when the tunnel connects and lowers it after, which is the conventional behaviour.

Always-on blocks every non-tunnel connection whenever the client is running, tunnel or no tunnel, so a machine that boots before the tunnel is up sends nothing until it is. That covers the disconnect leak, the DNS leak and the IPv6 leak in one mechanism, and it can be set to allow local network traffic so printers and file shares keep working.

Trusted networks extend the idea. Mark your home network as trusted and the client disconnects there and reconnects automatically on any other network, so a laptop protects itself in cafés without being asked.

Pause suspends the tunnel for a chosen interval and restores it on its own, which is the answer to the site that refuses connections from tunnel addresses.

Multi-hop, AntiTracker and split tunnelling

IVPN Client multi-hop routes traffic through two servers in different countries, entry and exit chosen separately, so neither server sees both your address and your destination. It slows things down in proportion to the distance between the hops and it is meant for the moments that warrant it rather than for every session.

AntiTracker blocks a curated list of advertising, tracking and malicious domains at the DNS level, so it works in every application rather than one browser, with a hardcore mode that also blocks the domains of the largest platforms entirely.

Custom DNS servers, including over HTTPS, replace the built-in resolvers if you prefer your own. Split tunnelling excludes chosen applications from the tunnel on the desktop, which is how a video call or a local service stays fast while everything else goes through.

Obfuscation for hostile networks

Where tunnels are blocked outright, IVPN Client has two options. V2Ray obfuscation wraps the connection as VMess over QUIC or over TCP, the latter looking like ordinary web traffic to a network filter. obfs4 does the same for OpenVPN on the desktop. Neither guarantees success against a determined national filter, but they are the tools that work more often than not, and having them in the standard client rather than a special build is the difference between connecting and not when the situation arises.

A censorship circumvention tool exists for the same purpose with more relays and less privacy, and the two are complementary.

The account model and the audits

An IVPN Client account is a randomly generated ID with no email required and settled in ways that need not identify you, and the client supports two-factor authentication on top. The service has been audited eight times, covering the applications, the servers and the no-logs claim, and the reports are published rather than summarised. It also publishes what a tunnel cannot do, and declines to promise anonymity, which is more honest than the category usually manages.

For a comparison in the same spirit, Mullvad makes the same choices about accounts and audits and has dropped OpenVPN entirely, so anyone who still needs that protocol has a reason to be here instead. Both are small networks by the standards of the mass-market services, and neither is built for unblocking streaming catalogues.

Where it falls short

The network is small, at 41 countries, and streaming catalogues are not a target, so anyone choosing a tunnel to watch another region’s television will be disappointed. The interface is austere and the settings assume you know what a DNS leak is.

Port forwarding is not offered, which rules it out for anyone hosting a service behind the tunnel. And several privacy extras beyond the tunnel itself now arrive as separate services, so the client’s own feature list is the one to judge by rather than the wider bundle.

Conclusion

IVPN Client suits people who choose a tunnel for privacy rather than for television, and who want every leak closed by a setting they can see and a service whose claims have been checked by someone else. Journalists, travellers on hostile networks and anyone who has grown suspicious of the tunnel industry’s marketing will find it does what it says and says less than most.

It is the wrong choice for streaming, for hosting anything behind the tunnel, and for anyone who wants a friendly interface over a precise one. Turn the firewall to always-on, mark your home network trusted, and it becomes the sort of software you forget is running, which is the highest compliment a tunnel can earn.