Tools & networks

The lanes below the VPN

Thirteen tools fill the space a VPN does not cover - anonymity (Tor, I2P[1][4]), censorship (Psiphon, Lantern, Hiddify, the Reality stack[2][5][6][7]), DNS hygiene (NextDNS, AdGuard, Pi-hole[8]), bridging (Snowflake[3]) and ecosystem routing (Private Relay). None replaces a VPN; several beat one at their specific job.

Tor versus VPN, one more time, precisely

Tor's three-relay design gives you what no VPN can: the destination sees a shared exit, the relay chain hides your origin, and no single operator holds both your identity and your traffic[1]. The costs are speed, exit-node trust for non-HTTPS traffic, and hostile-exit nuisance. A VPN is faster, covers your whole system, and trades all of that for trusting one operator - which is why the operator's evidence class (the no-logs hub) is the whole ballgame in the commercial lane.

The censorship stack, ordered

For censored networks the stack reads bottom-up: encrypted DNS is trivially blocked; plain VPN protocols are fingerprinted (the China hub documents the detection methods); the Reality/Hysteria class of tools borrows legitimate TLS shapes and survives longer[5][6]; Snowflake and Tor bridges are the last-resort lane[3]. Psiphon and Lantern wrap several of these techniques with funding and infrastructure for the users who need them most[2][9].

How to combine without fooling yourself

Two rules keep the stack honest. One: each layer answers a different adversary - DNS tools against trackers, VPNs against local network observation, Tor against destination-side profiling - and no single tool spans all three. Two: layering has failure modes (DNS below a tunnel that does not route it, VPN-then-Tor versus Tor-then-VPN), which is why the alternatives guide and the leak test exist. The tools are lego bricks; the threat model decides the order[1][2][8].

The two failure patterns worth memorizing

First, the DNS detour: a tunnel that does not route DNS leaves the resolver visible, and the resolver leaks every destination - the most common broken stack, and the reason DNS tools sit below the tunnel layer[8][1]. Second, the partial-coverage illusion: a browser-only proxy plus a system full of apps is a lock on one window of a house, which is the browser lane's defining flaw and the reason this page's two products sit below the commercial gate. Tool lanes reward precision about adversaries; Both failures come from imprecision about which layer was supposed to cover what - write the layer list down, test it, and most stacks assemble correctly on the first try.