双重 VPN

How Double VPN Chains Servers

Double VPN (also called multi-hop) routes traffic through two sequential VPNVirtual Private Network. A technology that creates an encrypted tunnel between a device and a remote server, protecting data in transit and masking the user's real IP address. Used for privacy, security, and accessing restricted networks. servers before it exits to the internet. The client encrypts data with both servers' keys; server 1 decrypts the outer layer and forwards a still-encrypted packet to server 2, which decrypts the inner layer and makes the final connection. Each server sees only the previous hop — server 1 knows your real IP but not your destination; server 2 knows your destination but not your real IP.

When Double VPN Matters

The primary use case is defending against an adversary who can observe both ends of a single VPN connection — a nation-state or a VPN provider colluding with law enforcement. By routing through two providers in different jurisdictions, correlation attacks require compromising both simultaneously. It is also used when connecting to TorThe Onion Router. An anonymity network that routes traffic through multiple encrypted relays (typically three) worldwide, making it extremely difficult to trace the origin of a connection. The basis of .onion hidden services. through a VPN to hide Tor usage from the ISP.

Performance Tradeoffs

Double VPN roughly doubles encryption overhead and adds the latency of an extra network hop. ThroughputThe actual rate of successful data transfer over a network, measured in bits per second. Unlike bandwidth (theoretical maximum), throughput reflects real-world performance after accounting for latency, packet loss, and protocol overhead. typically drops 30–60% compared to a single-hop connection. The VPN Kill SwitchA VPN feature that automatically blocks all internet traffic if the VPN connection drops unexpectedly, preventing the user's real IP address and unencrypted data from being exposed to the ISP or network. mechanism must account for both tunnel endpoints failing independently. For most users, a strict No-Log PolicyA VPN provider's commitment to not record user activity, connection timestamps, IP addresses, or browsing data. Verified no-log policies are often audited by independent third parties to confirm compliance. on a single trusted provider outweighs double-hop complexity; double VPN is reserved for high-threat scenarios. DNS Leak Test should be run after configuration to verify both hops are functioning correctly.