VPN server in the United States: the Cedar Knolls exit near New York

The city names in the server list come from the location data recorded for each server's address, and that data can name a nearby town rather than the city. For this exit it records Cedar Knolls, with the country code US, so the list says Cedar Knolls rather than New York.

Geolocation databases are estimates, and two of them can place the same address in different towns. While you are connected, a page that reports your IP address may therefore show Cedar Knolls, a neighbouring town, New York or only the state of New Jersey. Each of those answers describes the same exit.

For routing, the metropolitan area matters more than the town. Many North American networks exchange traffic with one another in the New York area, and several transatlantic cables come ashore on the New York and New Jersey coasts. An exit in the metropolitan area therefore usually has short onward paths to services hosted on the East Coast, and a short path to the cables that cross to Europe.

The exit serves a different purpose depending on where you connect from.

Light in optical fibre covers about 200 km in a millisecond, and a request and its reply each cross the distance between you and the exit. Dividing that distance in kilometres by 100 therefore gives the shortest round trip possible, in milliseconds, before any router or queue adds to it. Cables follow the sea bed, roads and railways rather than great circles, so measured latency is always higher than the floor.

The server list measures what the route costs from your own connection. The exit servers report no latency of their own, so the iPhone, iPad, Android and Windows apps time a request to each location themselves and show a figure in milliseconds. Because the apps time different kinds of request, a figure is a rough comparison between locations on one device, not a ping.

Calculated from great-circle distances, the floors from Cedar Knolls to cities near and far are:

Cedar Knolls is an East Coast exit. Seattle, Los Angeles and San Francisco are 3,850 to 4,100 km away, so the floor from the Pacific coast is close to 40 ms before any equipment adds to it. This is the main argument against the exit for anyone on that side of the continent.

The cost doubles when the destination is also in the west. A request from Los Angeles to a site hosted in Los Angeles crosses the continent inside the tunnel and crosses back outside it, which adds about 7,800 km to the path and a floor near 78 ms to each round trip. On the West Coast, Cedar Knolls suits shared networks such as hotel or café Wi-Fi, where the encryption matters more than the extra milliseconds, and services hosted in the east.

Distance does not favour Tokyo either: it is 7,700 km from Seattle and 8,800 km from Los Angeles, roughly twice as far as Cedar Knolls. The server list in the app is the current list of locations, so check it for anything nearer.

Hawaii is the exception. Honolulu is 7,950 km from Cedar Knolls and 6,200 km from Tokyo, so Tokyo is nearer by about 17 ms on the floor. Through Tokyo, however, websites see a Japanese address and tend to localise to Japan. Cedar Knolls remains the choice from Hawaii when a US address matters more than those milliseconds.

In Latin America the comparison is with São Paulo, and the great-circle figures give a first answer:

Websites commonly choose a language, a currency and a version of their content from the visitor's IP address. Through Cedar Knolls they see a visitor in the United States, and the defaults listed below follow. Most of these changes are a matter of preference, and sites with a language or country control usually remember the choice you make there.

Some signals do not come from the IP address and stay as they were. A browser that you allow to use your location reports where the device is, sites can read the time zone set on the device, and a signed-in account keeps the country stored in it. The App Store and Google Play take their country from the account, so a connection through Cedar Knolls leaves both storefronts unchanged.

The defaults that usually change are these:

A visit to the United States usually involves several networks that belong to someone else: hotel and airport Wi-Fi, café networks, public libraries, and the Wi-Fi on intercity trains and coaches. Many are open or share one password among every user, and many place a sign-in page in front of the connection.

On a network with a sign-in page, finish the page before connecting WrapVPN; the guide to using a VPN for travel explains why the tunnel has to wait. Some of these networks show the page again after a set time; if the connection stops working later, disconnect and open a browser to see whether the page has returned.

With the tunnel up, the operator of the network and the other people on it see encrypted traffic between your device and the exit server's address, and how much of it there is. The names and addresses of the sites you use travel inside the tunnel.

Inside the country, the distance to the exit depends on where you travel. From Chicago the floor to Cedar Knolls is about 11 ms, and from Miami about 18 ms; on the West Coast it rises to about 40 ms, for the reasons set out above.

Your traffic is encrypted from your device to the exit server. There it is decrypted and sent on as ordinary internet traffic from the exit's IPv4 address, which every user of the exit shares. The destinations see that address, not yours.

Forwarding requires the exit server to see where each packet goes. It cannot read the content of HTTPS connections, which protect most websites and current apps, but it can read anything sent without encryption.

Our privacy policy describes the records we keep, and two of them relate to the exit server. Every connection and disconnection is recorded with your account, the time, the exit server and the session's length. An hourly summary also reaches us from each exit server for every tunnel address: it lists the data transferred, the external addresses reached over TCP and the domain names associated with them, and it can be linked to your account.

Clean Web, the app's DNS filter, uses a resolver on the same exit server. With it on, the resolver gives no address for a domain on its blocklist, so an app that relies on it has no address to connect to. The filter works on domain names alone, and a browser or app that sends its own encrypted DNS queries goes around it.