For a practical privacy-first setup, start with your VPN app’s recommended protocol, leave MTU on Auto, use the VPN’s protected DNS, and enable a kill switch if you want traffic blocked when the tunnel drops. Make sure IPv6 is either routed through the VPN or prevented from escaping outside it. Use split tunneling only for apps that need your ordinary connection, and verify the settings after changing them. The right labels and behavior vary by VPN provider, operating system, and app version.
Which VPN settings should you change first?
Change settings to solve a specific need rather than to maximize the number of security switches. These defaults are a sensible starting point; check your provider’s current instructions because options and their interactions differ between apps.
As an Amazon Associate I earn from qualifying purchases.
| Setting | Starting point | Change it when |
|---|---|---|
| Protocol | Automatic or provider-recommended | The connection is unreliable or a network restriction prevents a connection. |
| Kill switch | On if a VPN failure must not send traffic over your ordinary connection | Choose an always-on mode only if you accept losing internet access whenever the VPN is off. |
| DNS | VPN app’s protected resolver | Use a different resolver only when your provider documents how to configure it without bypassing its protections. |
| IPv6 | Supported through the VPN, or blocked from escaping outside it | Check the app’s current platform-specific support and leak-protection controls. |
| Split tunneling | Off unless an app needs the ordinary connection | Exclude only the apps that require local-network access or do not work through the VPN. |
| MTU | Auto | Troubleshoot demonstrated packet or reliability problems; change one option at a time. |
| Local network access | Off unless you need LAN devices | Enable it for a printer, casting device, or other local service, and understand any kill-switch exception. |
Should you use WireGuard or OpenVPN?
Start with the automatic or recommended protocol in your provider’s app. Protocol choice can affect speed, stability, and connection availability, but a vendor’s general description is not a controlled speed comparison on your network.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Proton VPN describes WireGuard as lightweight and faster than traditional VPN protocols. Its documentation says OpenVPN over UDP is faster than OpenVPN over TCP, while TCP can help its implementation work in censorship-resistant conditions. These are Proton’s descriptions, not independent head-to-head measurements. See Proton VPN’s protocol documentation.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
If your current connection works reliably, there may be no benefit to switching. If it repeatedly fails or a restrictive network blocks it, try a supported alternative and compare stability and speed under the same conditions.
Should you turn on the VPN kill switch?
A kill switch blocks network access when the VPN connection drops, instead of allowing traffic to continue over the ordinary connection. Some apps offer both a switch that acts on an unexpected disconnect and an always-on mode that blocks internet access whenever the VPN is not connected.
Use the stronger always-on behavior only if you are comfortable being offline whenever the tunnel is off. Providers use different labels, so check what the option actually blocks. Private Internet Access documents both a disconnect-triggered kill switch and an advanced mode that blocks internet access unless connected in its desktop advanced-settings guide.
A 2022 VPNalyzer study reported kill-switch leaks in its tested sample, and found that setting names and capabilities varied. The study analyzed 230 experiments from 80 popular and diverse desktop VPN providers; those findings describe that sample and are not a current assessment of every provider. The authors’ paper is available from NDSS 2022.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
How do you stop DNS leaks with a VPN?
Leave DNS on the VPN app’s protected resolver unless there is a documented reason to choose another configuration. A VPN app may route DNS queries through its resolver inside the encrypted tunnel. Manually changing system DNS or enabling browser-level DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) can interact with that routing or make the app’s leak protection harder to enforce.
Proton VPN advises against third-party DNS and DoH/DoT with its own app, noting that it may not be able to see or control queries routed through third-party encrypted DNS. That is provider-specific advice; users of other VPN apps should consult those providers’ instructions. Proton also notes that a disconnect can otherwise send DNS requests to the system’s default resolver. See its DNS leak guidance.
If a DNS test shows an unexpected resolver, check the VPN’s DNS option, system-wide custom DNS, Android Private DNS, and browser Secure DNS settings. Proton recommends a standard or extended DNS leak test while connected; the result should not identify your real ISP resolver. A DNS check does not replace checking your public IP or IPv6 routing.
Recommended Free Tools
Should you disable IPv6?
Do not treat system-wide IPv6 disablement as a universal VPN privacy fix. The goal is to have IPv6 handled by the VPN or blocked from escaping outside the tunnel. An IPv4-only check cannot establish that IPv6 is protected.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
Support and defaults depend on the platform and app version. Proton’s support page documents IPv6 support on Linux and Android and says support is off in its Windows, macOS, and iOS/iPadOS apps while being developed. It recommends leaving IPv6 leak protection on. These details apply to Proton’s apps, so confirm current behavior for your VPN and operating system in its IPv6 guidance.
When should you use split tunneling?
Split tunneling sends selected apps through the VPN while excluded apps use the normal connection. Exclude an app only when it needs access to your local IP or otherwise does not work through the VPN; an excluded app can expose your ordinary IP address.
Do not assume the kill switch treats excluded apps the same way across providers. NordVPN says its Internet Kill Switch blocks split-tunnel-excluded apps when the VPN disconnects, prioritizing device-wide protection. Check the behavior documented for your own provider before relying on both features. NordVPN’s explanation is at its kill switch and split tunneling support page.
Free tools Windows power users keep installed
One-click scans. No signup required.
Should you change MTU?
MTU is the maximum packet size sent through a tunnel. Leave it on Auto unless troubleshooting a demonstrated problem rather than trying values at random. Private Internet Access recommends Auto for most users in its desktop documentation. It says large packets may improve performance on stable connections, while smaller packets may improve reliability on unstable ones; those recommendations are specific to its desktop client.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
If you are investigating packet or reliability problems, change one MTU option at a time and compare results under the same network conditions. Keep the setting that resolves the problem without introducing new failures.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When should you allow local network access?
Enable LAN access when you need the VPN-connected device to reach a printer, casting target, or other local device. Treat it as an intentional exception: Private Internet Access documents a setting that allows LAN traffic even with its kill switch enabled. The precise effect depends on the client, so check your provider’s description before turning it on.
How can you verify your VPN settings?
-
Record the current protocol, server or location, and the symptoms you want to address, such as disconnects or slow transfers.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Change one setting at a time and reconnect if the app requires it. This makes it easier to identify which change affected the result.
Best Value
Sale
TP-Link Dual-Band AX3000 Wi-Fi 6 Wireless Gigabit Internet Router for Home | EasyMesh, VPN Clients & Server, HomeShield, OFDMA, MU-MIMO, USB 3.0, Secure by Design - Archer AX55- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
-
While connected, check your public IP and DNS resolver. Repeat after reconnecting or switching networks; for DNS, use a standard or extended leak test and confirm the result does not identify your real ISP resolver.
-
Check IPv6 separately if your network and VPN client support it. An IPv4-only test does not verify IPv6 behavior.
-
Test a VPN interruption only if the client provides a safe test method. Confirm that the kill switch behaves as its documentation says; a checklist is not an independent security audit.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Compare speed using the same device, network, destination, and server conditions. Results vary with the route and server load, so a change that helps one connection may not help another.
What VPN privacy and speed settings cannot guarantee
No single configuration guarantees both maximum privacy and maximum speed for every person. A protocol that connects reliably on one network may fail on another; a kill switch may block useful connectivity by design; split tunneling can preserve access to an app while leaving that app outside the VPN tunnel.
VPNalyzer’s 2022 study reported IPv6 leaks, kill-switch leaks, and DNS leaks during tunnel failure among providers in its tested sample. It is evidence that behavior can vary and settings should be checked, not a current ranking of VPN providers. The authors did not report large-scale bandwidth comparisons because measurement time and ISP capacity can confound those results.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
