Why a VPN Matters.
Every time you connect to the internet, your Internet Service Provider sees every website you visit, every service you connect to, and your physical location. A VPN — a Virtual Private Network — creates an encrypted tunnel between your device and a remote server. Your ISP sees only that you are sending encrypted data to a single destination. The contents, the destinations, and the patterns of your browsing become invisible to them.
For Canadians on satellite connections like Starlink, this matters even more. Starlink uses Carrier-Grade NAT and has visibility into your traffic metadata. A VPN is the most practical tool available to reclaim that ground. This guide covers three deployment strategies: single device, whole-home router, and hybrid split — so you can choose the architecture that fits your situation.
Choosing Your VPN Provider.
Not all VPN services are built the same. The two providers that consistently earn the highest marks for privacy, transparency, and technical rigour are Proton VPN and Mullvad VPN. Both are open-source, independently audited, and operate under strong privacy jurisdictions.
Proton VPN — The Ecosystem Builder
Proton VPN is headquartered in Switzerland, outside the 14-Eyes surveillance alliance. It integrates with the broader Proton ecosystem — encrypted mail, cloud storage, and password management. With over 15,000 servers across 120+ countries, it offers the widest network of any privacy-focused provider. Key features include Secure Core (multi-hop routing through hardened servers in Switzerland, Iceland, and Sweden), NetShield (DNS-level ad and tracker blocking), and native apps for every major platform including Android TV and Linux.
Mullvad VPN — The Privacy Purist
Mullvad is based in Sweden and takes a radically different approach to identity. There is no email, no username, and no password. You generate a random account number and can pay with cash or cryptocurrency. At €5 per month (flat, no discounts, no upsells), it is the most transparent pricing model in the industry. Mullvad has moved exclusively to WireGuard as of January 2026, dropping OpenVPN entirely. It was the first major provider to enable post-quantum WireGuard by default across all platforms, and offers DAITA — Defense Against AI-guided Traffic Analysis — a feature that obfuscates traffic patterns to defeat machine-learning-based surveillance.
Provider Comparison
| Feature | Proton VPN | Mullvad VPN |
|---|---|---|
| Jurisdiction | Switzerland | Sweden |
| Servers | 15,000+ in 120+ countries | 700+ in 49 countries |
| Protocol | WireGuard + OpenVPN | WireGuard only (as of Jan 2026) |
| Post-Quantum | Available | Default on all platforms |
| Account Required | Email address | None — random number only |
| Payment | Card, PayPal, crypto | Card, crypto, cash in envelope |
| Router Support | Excellent | Excellent |
| Streaming | Strong | Limited |
| Simultaneous Devices | 10 (Plus plan) | 5 |
| Best For | Daily driver, ecosystem integration | Maximum anonymity |
Strategy One: Single Device Setup.
This is the simplest deployment. You install the VPN application directly on the device you want to protect — your phone, laptop, or desktop. Only that device is encrypted. Everything else on your network remains exposed.
This approach is ideal for people who are just getting started, who travel frequently, or who need VPN protection on a specific device without modifying their home network.
How It Works
The VPN app creates an encrypted tunnel from your device to the VPN server. Your ISP (or Starlink) sees encrypted traffic going to one IP address. The VPN server then forwards your requests to the open internet on your behalf, masking your real IP and location.
For Proton VPN, visit protonvpn.com and select a plan. For Mullvad, visit mullvad.net and generate an account number — no email required.
Install the native app for your platform. Proton and Mullvad both offer apps for Windows, macOS, Linux, Android, iOS, and Android TV. On Linux, Proton provides both a GUI and CLI app; Mullvad offers the same.
Enable the Kill Switch (blocks all internet if the VPN drops). Set protocol to WireGuard for the best speed-to-security ratio. Enable NetShield (Proton) or the content blocker (Mullvad) for DNS-level ad and tracker blocking.
Use Quick Connect for the fastest nearby server, or manually select a country. For Canadians wanting to keep a local IP, choose a server in Calgary or Vancouver.
Visit a site like icanhazip.com to confirm your IP has changed. Run dnsleaktest.com to ensure your DNS queries are not leaking to your ISP.
Strategy Two: Whole-Home Router Setup.
This is the highest-security deployment. Instead of installing a VPN on each device, you configure the VPN directly on your router. Every device that connects to your Wi-Fi is automatically encrypted — phones, laptops, smart TVs, security cameras, IoT devices. No app required on any endpoint.
This approach treats the router as the privacy perimeter. Everything inside the perimeter is protected. Everything outside is not your concern.
Hardware Requirements
You need a router that supports WireGuard as a client. ISP-provided routers almost never support this. Recommended hardware includes ASUS routers running AsusWRT or AsusWRT-Merlin firmware, GL.iNet travel routers, or any router running OpenWrt or DD-WRT. If you are on Starlink, you will also need the Starlink Ethernet Adapter (Gen 2 dishes) or can plug directly into the built-in port (Gen 3 dishes).
Starlink Integration
The Starlink dish has a built-in router, but it does not support VPN configuration, custom DNS, or advanced security features. To take control, you place your own router between the Starlink dish and your devices.
Connect the Starlink dish (via Ethernet adapter if Gen 2) to the WAN port on your ASUS or third-party router. Your router is now receiving the internet feed.
Open the Starlink app. Go to Settings > Network > Bypass Mode. This disables the Starlink's built-in Wi-Fi and router functions. Your ASUS router now controls all networking.
Log into your router at 192.168.1.1 (or router.asus.com). Navigate to Administration > Firmware Upgrade. Ensure you are running the latest firmware with WireGuard support.
Log into your Proton or Mullvad account. Navigate to the WireGuard configuration generator. Select your desired server location and download the .conf file.
In the router admin panel, go to VPN > VPN Fusion (ASUS) or the equivalent WireGuard client section. Upload the .conf file. Enable "Block internet if VPN drops" as your kill switch.
Navigate to WAN > Internet Connection. Set DNS Server 1 to 9.9.9.9 (Quad9 — privacy-focused, Switzerland-based). Set DNS Server 2 to 1.1.1.2 (Cloudflare — malware blocking). If available, enable DNS-over-TLS and add dns.quad9.net to encrypt your DNS queries.
From any device on the network, visit icanhazip.com — it should show your VPN server's IP, not your Starlink IP. Visit dnsleaktest.com — you should see Quad9 or your VPN provider, not SpaceX.
| Benefit | Details |
|---|---|
| Every device is protected | Phones, laptops, smart TVs, IoT sensors, and guest devices are encrypted the moment they join your Wi-Fi. |
| No per-device apps required | Devices that do not support VPN apps (smart speakers, cameras, thermostats) are still covered. |
| Hardware kill switch | If the VPN tunnel drops, the router blocks all traffic instantly. No accidental leaks. |
| Counts as one connection | A router uses a single VPN connection regardless of how many devices are behind it. |
Strategy Three: The Hybrid Split.
This is the most practical architecture for households that need both security and flexibility. You maintain two separate Wi-Fi networks — one hardened through your VPN router, and one direct through Starlink — and assign devices to each based on their purpose.
The Architecture
Instead of enabling Bypass Mode (which kills Starlink's Wi-Fi), you keep both networks active. The Starlink dish feeds internet to both its own built-in Wi-Fi and to your ASUS router via Ethernet. The result is two distinct networks with completely different security profiles.
Hybrid Network Map
| Device | Wi-Fi Network | Protection Level | Best For |
|---|---|---|---|
| ThinkPad / Desktop | ASUS Router | Hardened Router-level VPN + encrypted DNS | Banking, email, privacy work |
| Phone (GrapheneOS / iOS) | ASUS Router | Hardened Router-level VPN + encrypted DNS | Daily communications, browsing |
| Smart TV | Starlink Direct | App-Level VPN app on TV only | Streaming, sports, geo-shifting |
| Gaming Console | Starlink Direct | Minimal No VPN unless app available | Low-latency gaming |
How to Configure It
Do not enable Bypass Mode. Both the Starlink Wi-Fi and your ASUS router will operate simultaneously.
Both Starlink and ASUS routers default to 192.168.1.1. Log into your ASUS router and change its LAN IP to 192.168.50.1 to prevent a Double NAT collision.
Follow the same WireGuard setup from Strategy Two. All devices on the ASUS network are encrypted.
On your Smart TV connected to Starlink Wi-Fi, install the Proton VPN app (or Mullvad). Set protocol to WireGuard for best streaming performance on satellite latency. You can now change VPN countries on the TV freely without affecting your hardened network.
On your phone and laptop, forget the Starlink Wi-Fi password. This prevents accidental reconnection to the unprotected network if the ASUS signal drops momentarily.
Essential Features to Enable.
Regardless of which deployment strategy you choose, these settings should be enabled on every VPN installation — whether on a device app or a router.
| Setting | Details |
|---|---|
| Kill Switch | If the VPN tunnel drops, all internet traffic is blocked instantly. This prevents your real IP from leaking during a momentary disconnection. On routers, this is often labelled “Block internet if VPN drops.” |
| WireGuard Protocol | Faster, lighter, and more secure than OpenVPN. Critical for satellite connections like Starlink where latency is already elevated. Both Proton and Mullvad support WireGuard natively. Mullvad now uses it exclusively. |
| DNS Leak Protection | Ensure your DNS queries route through the VPN tunnel or through an encrypted DNS provider (Quad9, Cloudflare, or your VPN’s built-in DNS). If DNS leaks, your ISP can still see which websites you visit even while the VPN is active. |
| NetShield / Content Blocker | Proton’s NetShield and Mullvad’s built-in blocker filter ads, trackers, and known malware domains at the DNS level. This provides a layer of protection that operates independently of your browser. |
| Secure Core / Multi-Hop | For high-sensitivity operations, route your traffic through two VPN servers. Proton’s Secure Core routes through hardened servers in Switzerland, Iceland, or Sweden before the exit node. Mullvad offers multi-hop with its own infrastructure. |
Platform-Specific Setup Notes.
Windows / macOS
Download the native installer from your VPN provider's website. Installation is straightforward — run the .exe (Windows) or .dmg (macOS), sign in, enable Kill Switch and WireGuard, and connect. Both Proton and Mullvad offer system tray apps for quick connect/disconnect without opening the full application.
Linux
Proton VPN provides both a GUI application (officially supported on Ubuntu, Debian, and Fedora with GNOME) and a command-line interface. Mullvad offers a lightweight GUI and CLI for all major distributions. For manual configuration, download a WireGuard .conf file from your provider, install the wireguard package, place the config in /etc/wireguard/, and manage it with wg-quick up ProtonVPN or systemctl.
Android / iOS
Both providers have native apps in the Google Play Store and Apple App Store. On Android, enable Always-On VPN in system settings to ensure the VPN reconnects automatically. On GrapheneOS, Proton and Mullvad apps work without Google Play Services.
Smart TVs & Streaming Devices
Proton VPN has a native Android TV app. For Fire TV, sideload or install from the Amazon Appstore. Mullvad also supports Android TV. If your TV does not support VPN apps, the whole-home router approach is your only option for protecting it.
ASUS Routers
Proton provides official step-by-step guides for AsusWRT, AsusWRT-Merlin, and newer ASUS models with WireGuard support (VPN Fusion). Models like the RT-AX55, RT-AX3000, and RT-AX86U all support WireGuard client configuration through the admin panel. Higher-end models with Merlin firmware offer more granular control including per-device VPN policies.
Verifying Your Setup.
A VPN is only useful if it is actually working. After any configuration, run these checks from every protected device.
Post-Setup Checklist
| Test | URL | Expected Result |
|---|---|---|
| IP Address | icanhazip.com | Shows VPN server IP, not your Starlink/ISP IP |
| DNS Leak | dnsleaktest.com | Shows Quad9, Cloudflare, or VPN provider — not SpaceX/Telus/Shaw |
| WebRTC Leak | browserleaks.com/webrtc | No local IP addresses exposed |
| Kill Switch | Disconnect VPN, try to browse | All traffic should be blocked — no pages load |
Sovereignty Starts with the Tunnel.
A VPN is not a silver bullet. It does not make you invisible, and it does not replace good operational security habits. But it does remove your ISP from the equation — and in a landscape where ISPs monetize your browsing data and comply with warrantless metadata requests, that is a meaningful step.
Start with a single device if you are new to this. Move to a whole-home router setup when you are ready to protect your perimeter. Use the hybrid split when you need both security and flexibility. The tools exist. The guides are published. The only variable is whether you deploy them.