VPNs Designed to Run Over Tor

While no mainstream VPN is built exclusively to run over Tor, select privacy-focused VPN providers explicitly support configurations that route VPN traffic through the Tor network. Understanding how these tools interact requires distinguishing between two distinct configurations: Tor over VPN (connecting to a VPN first, then Tor) and VPN over Tor (connecting to Tor first, then wrapping traffic in a VPN). This guide explains how VPNs function over Tor, which providers support this setup, and the practical implications for your privacy.

Tor over VPN vs. VPN over Tor

To understand how specific VPNs work with Tor, it is essential to recognize the directional difference in routing:

• Tor over VPN (Common): Your device connects to the VPN server first, and the VPN connection then routes your traffic through the Tor network. This prevents your Internet Service Provider (ISP) from seeing that you are using Tor and prevents the Tor entry node from seeing your real IP address.
• VPN over Tor (Advanced): Your device connects to the Tor network first, and your traffic exits the Tor network through a VPN server before reaching the destination website. This conceals your Tor usage from the final website, protects against compromised Tor exit nodes, and allows access to websites that block Tor traffic.

VPN Providers Supporting Tor Integration

True VPN over Tor is technically complex and unsupported by most standard VPN applications without manual configuration. However, several providers actively accommodate Tor routing:

1. AirVPN

AirVPN is one of the few services explicitly designed with built-in support for connecting via Tor. Using its proprietary client, Eddie, users can route OpenVPN connections directly through a local Tor SOCKS5 proxy with a single configuration setting. This makes AirVPN a leading choice for true VPN-over-Tor configurations.

2. Mullvad VPN

Mullvad supports custom SOCKS5 proxy configurations and allows advanced OpenVPN tunneling over Tor. Users can route Mullvad connections through the Tor network by binding the VPN client to a local Tor proxy port, effectively masking the Tor exit node with a Mullvad IP.

3. IVPN

IVPN offers comprehensive documentation and technical capability for routing OpenVPN through Tor. Like Mullvad, it supports multi-hop connections and proxy chaining, allowing users to configure a VPN-over-Tor setup manually.

4. Providers with Integrated “Tor over VPN”

If your goal is simple integration without manual proxy setups, providers like Proton VPN and NordVPN offer automated “Tor over VPN” (sometimes labeled “Onion over VPN”). These features route traffic through Tor servers natively, but they route to the VPN first, not the other way around.

Risks and Considerations

Before implementing a VPN-over-Tor setup, consider the following technical tradeoffs:

• Speed Penalties: Routing encrypted traffic through three Tor nodes combined with a VPN server significantly reduces bandwidth and increases latency.
• Payment Anonymity: Using a VPN over Tor only provides true anonymity if the VPN account was created and paid for anonymously (e.g., using cash or privacy-focused cryptocurrencies).
• Configuration Errors: Misconfiguring a manual SOCKS5 proxy tunnel can lead to IP leaks or complete connection failure.
• Tor Project Recommendations: The Tor Project generally advises against combining VPNs with Tor unless you have specific threat model requirements, as misconfigurations can introduce unique browser fingerprinting vectors.