Blog
Why the system is shaped the way it is, in the same register as the rest of this site — checkable, not promotional.
- October 29, 2026 · 11 minutes read
DNS leak test: run it, read the resolver list
A DNS leak test lists the resolvers that answered you. Run it in three states, learn whose resolver is whose, and fix the one that should not be there.
- October 29, 2026 · 8 minutes read
DNS over HTTPS vs a VPN: who sees what
DNS over HTTPS hides your lookups from the network on the path; a VPN moves the whole path. See who sees what in four setups, from one packet capture.
- October 29, 2026 · 12 minutes read
WireGuard benchmark on Linux, Oct 2026
Quantum against wireguard-go, kernel WireGuard, boringtun and OpenVPN on Linux lab VMs in October 2026: throughput, CPU, memory, latency and the losses.
- October 29, 2026 · 8 minutes read
MikroTik container RAM: a measured VPN budget
Measured RAM and storage for a VPN container on a MikroTik cAP ax and a virtual CHR: memory-current, router free memory, flash use and what memory-high does.
- October 29, 2026 · 9 minutes read
MikroTik FastTrack and tunnel traffic
What RouterOS FastTrack skips, why a mangle mark or tunnel route can stop seeing a flow, and the exemption rule that fixes it, with a CHR counter run.
- October 29, 2026 · 12 minutes read
MikroTik kill switch, tested with a leak probe
A RouterOS 7 kill switch in three rules, then a 100 ms probe on a CHR with the tunnel stopped: what leaked, what stayed silent and why rule order matters.
- October 29, 2026 · 14 minutes read
MikroTik WireGuard: native or container VPN
Two ways to run a VPN client on RouterOS 7, the built-in WireGuard interface or a container, with commands run on a virtual router and CPU cost on real boards.
- October 29, 2026 · 7 minutes read
VPN keeps disconnecting: causes by verdict
A VPN that seems to keep dropping is often idle, switching networks or stalled. Read the app's message to tell which one and apply the matching action.
- October 29, 2026 · 12 minutes read
VPN kill switch not working? Test it yourself
Stop the tunnel, keep probing, read what got out. A method to test a VPN kill switch, what a working one still allows, and the causes when it fails.
- October 29, 2026 · 11 minutes read
WebRTC leak test: run it and read the result
A WebRTC leak test lists the addresses a web page can read from your browser. Run it in three states, learn which rows matter, and see what a VPN leaves alone.
- October 29, 2026 · 8 minutes read
WireGuard handshake did not complete: causes
What the 'did not complete after 5 seconds' line means and how each fault looks on both ends in a dated lab run: wrong key, wrong port, dropped UDP, clock.
- October 29, 2026 · 9 minutes read
PersistentKeepalive: when WireGuard needs it
What PersistentKeepalive does, which peer sets it, why 25 seconds, and a lab run that shows inbound packets dying behind a NAT without it and arriving with it.
- October 29, 2026 · 9 minutes read
WireGuard MTU: what to set and why 1420
Why the WireGuard MTU default is 1420, how to find the real value on your path with a DF ping, and a lab run of what stalls when large packets are dropped.
- October 16, 2026 · 9 minutes read
Port forwarding behind CGNAT: what works
Why a forwarded port never answers behind carrier-grade NAT, a three-step check to confirm it, and four ways out with what each needs at both ends.
- October 16, 2026 · 10 minutes read
IPv6 leak: how it happens and how to test
An IPv6 leak is IPv6 traffic that skips the tunnel. How it happens, how to test for one, and what our own phone run showed with the tunnel down and up.
- October 16, 2026 · 13 minutes read
MikroTik vs OpenWrt as a VPN router
Two shipped ways to run one VPN client on a home router, a RouterOS 7 container or an OpenWrt package: what each needs, how it routes and what is unverified.
- October 16, 2026 · 10 minutes read
VPN memory use on OpenWrt: measured on 128 MB
What a VPN adds to a 128 MB OpenWrt router: RAM held by a userspace client and by OpenVPN, the WireGuard kernel module, and how to read free.
- October 16, 2026 · 12 minutes read
OpenWrt: VPN for chosen devices only
Send only some devices through a VPN on OpenWrt: pbr by address, or the ForestVPN client's device modes. Lab results for address changes and tunnel loss.
- October 16, 2026 · 13 minutes read
OpenWrt WireGuard: three ways to run a VPN
Manual WireGuard in LuCI, OpenVPN or a managed client on an OpenWrt router: what each needs, what each skips, and which one fits you.
- October 16, 2026 · 11 minutes read
Self-hosted WireGuard vs a VPN service
We timed a WireGuard server build on Debian, key generation to first handshake, then set its upkeep against what a VPN service does for you.
- October 16, 2026 · 11 minutes read
Share a VPN with family: devices and seats
One ForestVPN subscription covers ten devices. Here is what a seat is, how an Apple TV or router joins, and why sharing an exit with a person differs.
- October 16, 2026 · 7 minutes read
VPN on Android TV: install, connect, verify
How to install a VPN on Android TV or Google TV and drive it with the remote, with the screens from our own run and the one that shows data flowing.
- October 16, 2026 · 8 minutes read
VPN connected but no internet: what to check
A tunnel can be up and carry nothing. Match what you see to the message the app shows, then apply the one fix that fits that message.
- October 16, 2026 · 9 minutes read
MikroTik WireGuard connected, no internet
A RouterOS 7 WireGuard tunnel can handshake and still carry nothing. Route tables from a CHR lab run show the three causes and the command that names each.
- October 16, 2026 · 7 minutes read
VPN data limit reached: which limit stopped you
In ForestVPN, the title Data limit reached sits on two codes. The line under it tells them apart, and the table maps all five limits that look alike.
- October 16, 2026 · 12 minutes read
VPN not connecting: find the stage that failed
A VPN that will not connect stopped at one of a few stages. Read the app's message, see which stage it names, and apply the one action that fits.
- October 16, 2026 · 11 minutes read
VPN on a router for a TV with no VPN app
Put a TV with no VPN app behind a router VPN: choose it by hardware address, check that it alone is in the tunnel, and see what happens when the tunnel drops.
- October 16, 2026 · 11 minutes read
VPN on the router or in the app?
A router VPN covers devices that cannot run an app, an app covers devices that leave home. What each one leaves uncovered, read from ForestVPN's own pages.
- October 16, 2026 · 7 minutes read
VPN on a Samsung or LG TV: use the router
Samsung Tizen and LG webOS TVs have no ForestVPN app on our download page. Pick a route by TV system, and see what a router VPN does for the TV.
- October 16, 2026 · 13 minutes read
VPN for smart TV: app, router or sharing
Which TVs run the ForestVPN app, which need a router, and how to tell a TV tunnel is carrying data. A route table read from our download page.
- October 16, 2026 · 8 minutes read
VPN without email: how each sign-in works
Seven providers' own pages on what a new user gives, set beside ForestVPN's account number and what the payment step still holds.
- October 16, 2026 · 16 minutes read
WireGuard vs OpenVPN: measured, then compared
A same-host run of kernel WireGuard and userspace OpenVPN 2.6 with every setting and date, then what each protocol does, where each loses, and which to pick.
- September 6, 2026 · 10 minutes read
Throughput per CPU cycle on real routers
A lab number and a hardware number rarely agree. We measured both, kept the intervals, disclosed the trap that gave a wrong result, and said where we lost.
- September 5, 2026 · 4 minutes read
Why your sign-in is a number, not an email
The account you don't need is a 128-bit number, issued by a machine that structurally cannot open your tunnel. Why both have to be true together.