C04 · Decision
Why a VPN Router Isn't Enough: Put the VPN on Every Device
Nothing loads from YouTube until you press play. The video then plays in YouTube’s privacy-enhanced mode.
Why the Communication Suite puts the VPN on every device, not just the travel router. Principle P3: a guarantee only the perimeter provides fails the moment traffic bypasses it, through direct cellular, a forgotten SSID or a captive portal. The earlier design's "direct cellular backup path" that sank router-only enforcement, how Android's always-on VPN with lockdown and the Mullvad desktop app's lockdown mode enforce the tunnel on each device, why the router becomes defence in depth, and the precise claim: no app traffic leaves outside the tunnel, not "nothing leaves the phone".
What you’ll learn
- Know principle P3
- See the bypass that sank the router-only design
- State the endpoint guarantee precisely
Chapters
The honest limits
Radio-layer identifiers are untouched by any VPN. The claim is "no app traffic leaves outside the tunnel", not "nothing leaves the phone". The network experiments validated the Debian laptop, not every phone and app combination: verify the phone separately.