← back

network privacy

vpns, upnp, firewall, ztna, and nac — a layered guide for home and small office

vpn firewall upnp ztna

vpn: what it does and doesn’t do

tl;dr

a vpn only protects your network path, not your identity. anything you log into over a vpn is still tied to your real identity — the vpn only hides which network you were on. the value is against your isp, hotel wifi, coffee shop wifi, and opportunistic snooping; not against sites you’re actively using an account on.

a common misconception: “i’m using a vpn so i’m anonymous.” you’re not. when you sign into gmail through a vpn, google sees a vpn ip but recognizes you from your account cookies, browser fingerprint, and login — and now that identity is associated with both your isp ip and the vpn ip. what a vpn does prevent: your isp from logging every domain you visit, wifi network operators from man-in-the-middling unencrypted traffic, and geolocation-based restrictions that key on ip.

the trust model shifts, not disappears. you’re moving your trust from your isp to the vpn provider — so the provider’s logging policy, jurisdiction, and history matter more than raw speed.

recommended paid vpns

providernotes
Mullvad highly recommended. no account — you get a random account number, pay flat $5/mo (crypto/cash accepted), no logs. wireguard first-class. built-in kill switch, per-app exclusion, location switcher. sweden-based, transparent audit history
Private Internet Access privacy-focused, strict no-log policy proven in court. large server network. advanced per-connection controls. good for power users
NordVPN fast, huge server footprint, threat protection (ad/malware blocking) built in. good for streaming / geo-unblocking use cases; less minimalist than mullvad

any of these three is fine. mullvad is the cleanest pick for pure privacy (no email, no account, flat pricing means no marketing incentives). pia is the pick if you want granular controls. nord is the pick if performance and geo-unblocking matter most.

free vpns worth using

gotcha most free vpns are trap products. servers and bandwidth cost money — if you’re not paying, your traffic is the product (logged, injected with ads, or resold). the exceptions below are from companies that make money elsewhere and use the vpn as a loss-leader / privacy-brand exercise.

upnp

tl;dr

upnp lets apps on your lan open ports on your router without asking you. it’s convenient for game consoles and torrent clients and it’s an ongoing exposure risk for everything else. turn it off if you can; if your router doesn’t honor the setting, test what’s actually exposed.

upnp (universal plug and play) was designed to let apps behind nat request port forwards automatically. the problem: any malware on any device on your lan can also request forwards, and many routers accept upnp requests from the wan side too (they shouldn’t, but many do). the result is a router that quietly opens ports to the internet without you knowing.

firewall

tl;dr

reset windows firewall to defaults. the default rules block inbound connections and allow outbound — that’s what you want. years of software installs leave firewall rules behind that you don’t need.

to reset: control panel → windows security → firewall & network protection → restore firewalls to default. this wipes all custom rules; some apps will re-prompt on next launch to allow inbound (say no unless they need it). your router’s firewall (nat + stateful inspection) is the primary line of defense; windows firewall is defense-in-depth for other devices on the same wifi network that you may not trust.

gotcha set your active network profile to “public” on any network you don’t control (coffee shops, hotels, airports, conferences). “private” loosens firewall rules to allow file sharing, printer discovery, and network browsing — fine at home, dangerous on wifi you don’t own.

remote access (ztna — zero trust network access)

tl;dr

ztna replaces the “open a port on the router” model with an authenticated overlay network. no inbound ports, no dns leaks, and per-device / per-user access control. it’s the modern answer to “i need to reach my home nas / homelab from anywhere.”

for most people, tailscale is the answer. install it on your home server, your laptop, and your phone; you get a private ip range that works over cellular, coffee shop wifi, and behind cgnat without opening a single port on your router. it uses your identity provider (google, github, microsoft) for auth by default; you can lock that down with acls.

advanced: network access control (nac)

tl;dr — overkill for most homes, essential for small offices

nac fingerprints every device that joins your network, quarantines unknown ones, and applies access policy based on device type. it’s how you make sure the smart tv can’t reach your file server and a guest laptop can only see the internet.

for a home network the simpler alternative is vlans + a good firewall. run separate vlans for trusted (your computers), iot (smart bulbs, cameras, tvs), and guest, and firewall between them — most modern consumer routers (unifi, opnsense, pfsense) support this without any nac software.