How your VPN protects your connection

The Obfusgated app handles the encrypted VPN connection directly, so you do not need a separate VPN client. It agrees on an encryption method with the server and uses it to protect the data passing between them. Supported AES-GCM connections also check that the data has not been altered. This keeps your browsing traffic private on the path through your Wi-Fi network or internet provider.

Connections that use temporary session keys also provide forward secrecy. Each session has its own keys, so obtaining a server’s long-term key later does not automatically reveal earlier sessions. The method is negotiated by the app and server. Use HTTPS websites to extend protection from the VPN exit to the website itself. The protocol guide explains the available connection methods.

The Obfusgated app supports TLS-based VPN connections directly. TLS is also the technology used to secure HTTPS websites. Using it for the VPN reduces obvious differences between your connection and ordinary encrypted web browsing, helping you stay connected on networks that filter recognizable VPN traffic.

Camouflage works alongside encryption: encryption protects what you send, while camouflage makes the connection less distinctive to the network carrying it. The effect depends on the selected mode and the network’s filtering rules. Browser-like connection setup adds another layer by changing the opening exchange that a network can inspect.

The Obfusgated app includes native support for browser-like TLS handshakes in supported connection modes. A handshake is the opening exchange in which your device and the server agree on connection settings. Arranging those settings like a common browser reduces the distinctive signs that the connection came from a VPN app.

Supported connection modes can also split the opening exchange into smaller pieces. This can make simple traffic-inspection rules less effective and help a connection get through certain filters. These controls are built into the app, with availability depending on the selected connection mode. See the available apps and connection methods.

The Obfusgated app lets you select both ordinary VPN destinations and cascade routes. With either route, websites see a VPN exit address shared with other users instead of your home or mobile address. That makes the address alone less useful for linking website activity to your household or device. Your connection remains separate from other users’ connections.

Selecting a cascade in the app sends your traffic through an entry server and then an exit server, joined by an encrypted connection. Your internet provider sees the entry server, while websites see the exit server. Separating those two addresses adds a step between your home connection and the address used for browsing. Use the route comparison above to see how the two routes differ.

The Obfusgated app includes an Ad Block and secure DNS setting. When you use the VPN-provided DNS service, website-name lookups travel through the encrypted tunnel. The VPN’s own resolver then looks up the answers by contacting the DNS servers responsible for the requested names, rather than forwarding all your requests to one external DNS provider. This avoids giving that provider a centralized record of your lookups, and the requests leave from the VPN infrastructure rather than your home connection.

The service also checks digital signatures for domains that publish them. These checks help reject altered DNS answers that could send you to the wrong server. With Ad Block enabled, listed advertising, tracking and harmful domains are blocked before your device connects to them, reducing opportunities for those services to collect browsing data. These checks run on the VPN servers; the app provides the setting, so no separate DNS software is needed on your device. Read how DNS filtering works, then use the DNS leak test and ad-block test to check your setup.