UC Santa Cruz

There are many valid reasons for someone to browse the internet privately, and Virtual Private Networks (VPNs) are one method of achieving this. Although primarily used to provide confidentiality and anonymity by encrypting internet traffic and masking IP addresses, users may choose to use a VPN for multiple purposes. However, this raises questions about whether, and how differently, content across the internet is portrayed to VPN users. VPN providers do not all route their traffic the same way, and this study analyzes these differences by investigating two major VPN providers, NordVPN and Surfshark. We measure and quantify the accessibility of popular websites to users of these two VPNs, comparing outcomes against a non-VPN control connection to determine whether, and to what extent, VPN use affects a user's ability to reach and use ordinary websites. This raises a central question: is VPN-related blocking better explained by the network a VPN happens to use, or by where its exit server is physically located? To investigate this, requests to the Tranco top 10,000 domains were compared between each VPN and a non-VPN control connection to measure blocking at full scale. A second set of experiments isolated exit servers by network (ASN) and by physical location across a smaller domain set, allowing the effects of these factors to be compared. At full scale, NordVPN showed 1.59\% VPN-attributable blocking and Surfshark showed 0.42\%. When exit servers were isolated by ASN and location, block-rate variation did not show a clear difference between the two factors, while the network path taken by a request varied substantially with location. These results suggest that VPN-related blocking is not explained by a single infrastructural factor, but instead depends on multiple properties of the network through which a VPN request is routed, including characteristics of the individual exit, network infrastructure, and geographic location. At full scale, NordVPN showed 1.59\% VPN-attributable blocking and Surfshark showed 0.42\%, measured across the Tranco top 10,000 domains using a single exit per provider. Under infrastructure isolation across five ASNs and five countries, crawling top 200 domains, block-rate variation was similar whether ASN or location was held fixed (2.5\% vs. 4.0\% mean within-group range). Per-provider significance testing further found that only a small number of ASNs showed significant differences in blocking. In contrast, network routing varied substantially with exit location: CDN routing varied by 76\% when location was held fixed, compared with 58\% when ASN was held fixed. These results suggest that VPN-related blocking is not explained by a single infrastructural factor, but instead depends on multiple properties of the specific exit and network path through which a VPN request is routed.