VPN server in Spain: the Madrid exit server and its routes

Distance sets the lowest latency a connection can reach, whatever software runs at either end. Light in optical fibre travels at roughly two-thirds of its speed in a vacuum, close to 200 km in each millisecond. A request and its reply both make the journey, so each 100 km between you and Madrid adds at least 1 ms to the round trip.

The floors below apply that rule to great-circle distances from Madrid. Measured latency is always higher, because fibre follows coastlines, motorways and railway lines rather than the straight line, and every router on the way adds a little time.

Every route from Madrid listed here, except the one to the Canary Islands, has a floor in single figures. The Canaries lie 1,750 km away in the Atlantic, and that crossing is the one place where distance from Madrid starts to show.

Madrid can look like the natural exit for anyone who reads Spanish, but from the Americas it means crossing the Atlantic in both directions on every request. Two other exits are much nearer to most of Latin America: Cedar Knolls, in the New York area, and São Paulo. The figures below show which of them is nearer in the main cases.

The shared language is not a reason to accept the distance, because many sites choose which version to serve from the address they see. Through Madrid, that address is in Spain, so those sites tend to serve Spain's version: Spanish as written in Spain, prices in euros and search results ranked for Spain. Choose Madrid from Latin America only when Spain's version of a service is the one you need.

These are great-circle floors. Routes between the Americas and Europe run along submarine cables between particular landing points, so measured figures are higher, and the latency measured on your own connection is the figure to decide by.

Most reasons to choose Madrid come down to being near it, or to needing an address in Spain. The common cases are these.

An IP address carries an approximate location, and many websites use it to choose a language, a currency and which country's content to show. Connected through Madrid, expect Spanish pages, prices in euros, and maps, weather and search results centred on Spain. Where a site offers a language selector, a choice made there usually takes precedence over the address.

Formatting tends to follow. A site that sets its locale from your address writes amounts with a decimal comma and the euro sign after the figure, and puts the day before the month in dates.

Time can shift as well. Mainland Spain keeps Central European Time, one hour ahead of Portugal and the Canary Islands. A service that estimates your time zone from your address rather than from your device will show Madrid time, which matters for anything with a delivery slot or a booking time attached.

Downloads tend to come from a nearby copy. Content delivery networks commonly pick a cache from the location of the address that requests a file, or of the DNS resolver that looked up the name, and through WrapVPN both requests come from the exit's address. App updates, software packages and video therefore tend to arrive from a cache in or near Madrid, which is a short path from anywhere on the peninsula.

A summer visit to Spain's coasts or islands usually means Wi-Fi that belongs to someone else: a holiday rental's router, a hotel's guest network, or a café network whose password every customer shares.

A holiday rental feels private, but its network is not yours. The page on holiday-rental Wi-Fi, linked below, covers what the host's router can observe and what to change on your devices before joining it.

Hotel and resort guest networks are shared by everyone staying, so in high season more people divide the same capacity. The tunnel adds no capacity, but it changes what the hotel's equipment carries: one encrypted session to Madrid rather than the names of the sites you open.

An island trip multiplies the networks: the rental, the hotel, the ferry and the café are each a new one. Where a network has a sign-in page, disconnect, complete the page and connect again; on iPhone or iPad with Auto-Connect on, pause instead of disconnecting. Where it has none, the tunnel on iPhone, iPad, Mac and Android carries on across the change.

A tunnel moves the point where your traffic can be observed; it does not remove that point. Traffic in the tunnel is encrypted by WireGuard all the way to Madrid, so the rental's router, the hotel network and your mobile operator see a single session to a single address, with its timing and volume, but not what travels inside it.

In Madrid, the traffic leaves the tunnel and continues as ordinary traffic from the exit's address. To forward each packet, the exit server has to know where it is going, so destination addresses are visible there. Most websites and apps now encrypt their connections with HTTPS, and that content cannot be read at the exit; content sent without encryption can.

Every user of the Madrid exit shares its IPv4 address, so websites see the exit's address in place of yours, and the same address for many people at once.

Of WrapVPN's own records, two concern the exit server directly; for the others, see the privacy policy. Each connection and disconnection is recorded with your account, the time, the exit server and the length of the session. Each exit server also reports, once an hour and for each tunnel address, the data transferred, the external addresses reached over TCP and the domain names associated with them, and those reports can be linked to your account.

Clean Web, WrapVPN's DNS filter, runs on the exit server too. It answers a lookup for a domain on its blocklist as though the name did not exist, so an app that relies on the tunnel's DNS receives no address to connect to. It judges by domain name alone and does not inspect pages. It is on by default on Android and off by default on iPhone, iPad and Mac; on Windows, check its switch in Settings. A browser or app that sends its own encrypted DNS queries bypasses it.