Overview
The everyday case for a tunnel client is not exotic. It is a laptop on a hotel network, a phone tethered in a cafe, a shared office connection, or any of the other situations where the network between you and the internet is operated by somebody you have no reason to trust. Encrypting the whole connection at the machine means that whoever runs that network sees an encrypted stream to one address and nothing else about what you are doing.
This client covers that with a straightforward interface: pick a location or take the fastest, connect, and the whole machine's traffic routes through the tunnel. The premium tier is unlocked here, which means the full server list rather than a handful of overloaded free ones, no transfer cap, and no limit on how many devices the same configuration runs on.
Connecting and choosing a location
The main window lists the available locations with a latency figure and a load indicator, and the fastest option picks for you based on both. For general privacy purposes the nearest lightly loaded server is the right answer, since every additional kilometre is latency you pay on every request.
Protocol selection offers a modern tunnel protocol as the default, which is fast and establishes a connection almost instantly, and older protocols as fallbacks for networks that interfere with the default. On a restrictive network the fallback protocols are the reason a connection works at all, since they are harder to distinguish from ordinary encrypted traffic.
Connection can be set to establish automatically at startup, or automatically whenever the machine joins a network that is not on a trusted list. That second option is the one worth setting, since it means the laptop protects itself on an unknown network without anybody remembering to do anything.
The kill switch and leak prevention
The kill switch blocks all traffic if the tunnel drops, which sounds like a detail and is the single most important setting in the program. Without it, a momentary reconnection sends whatever was in flight over the ordinary connection, in the clear, at exactly the moment nobody is watching. With it, the applications simply stall until the tunnel returns.
Name resolution is handled through the tunnel rather than the local network's resolver, which closes the leak where the connection is encrypted but the list of addresses being looked up is not. There is a leak test built into the client that checks the resolver path, the address seen by the outside and whether the older address family is escaping the tunnel.
Split tunnelling routes chosen applications outside the tunnel, which is useful for something that must see the local network, or for a service that refuses to work over a tunnel at all. Use it sparingly, since every application on the outside list is one whose traffic is not protected.
What a tunnel does and does not do
It moves the point at which your traffic joins the public internet, and encrypts everything between your machine and that point. That defeats the network operator between you and the server, which covers the hotel, the cafe, the office and the connection provider. It is genuinely useful and it is the whole of what the technology does.
It does not make you anonymous. The tunnel operator can see what you route through it, which is why the choice of operator is the entire security question and not a detail. Sites you sign into know who you are regardless of where the connection appears to come from, and browser fingerprinting works exactly the same through a tunnel as outside one.
For privacy from the sites themselves, a browser with tracking protection and a content blocker does more than any tunnel will. The two address different problems and are worth running together rather than treating either as a substitute for the other.
What you get
- Full premium server list rather than a limited free selection
- No transfer cap and no device count limit
- Modern tunnel protocol by default with older fallbacks for restrictive networks
- Kill switch that blocks all traffic if the tunnel drops
- Name resolution routed through the tunnel to close the resolver leak
- Built in leak test for resolver, external address and address family escape
- Automatic connection on startup or on joining an untrusted network
- Trusted network list so the home connection is left alone
- Split tunnelling for applications that must stay outside
- Latency and load shown per location with a fastest option
Inside the archive
- AMAN VPN client installer for 32-bit and 64-bit
- Premium server list configuration
- Protocol fallback profiles for restrictive networks
- Notes on the kill switch and split tunnelling
- Language files for the interface list shown above
System requirements
| Operating system | Windows 10, Windows 11, 32-bit or 64-bit |
|---|---|
| Processor | Any dual core processor from the last decade |
| Memory | 2 GB |
| Storage | 200 MB free |
| Network | Any connection, the client adapts the protocol to what works |
| Privileges | Administrator for the initial install of the network adapter |
Installing it
- Unpack the archive to a local folder.
- Suspend real time protection for the length of the install.
- Run the installer as administrator so the virtual network adapter can be created.
- Open the client and enable the kill switch before connecting to anything.
- Add your home network to the trusted list if you do not want the tunnel there.
- Connect once and run the built in leak test to confirm nothing is escaping.
Mirrors
| Route | Region | Note | State |
|---|---|---|---|
| Direct, primary | Europe | No wait, resumable | Online |
| Direct, secondary | Asia Pacific | No wait, resumable | Online |
| Torrent magnet | Global | Small file, direct is faster | Online |
Release history
- Kill switch now engages during a protocol fallback rather than after it
- Fixed name resolution briefly using the local resolver at connection time
- Server list refreshed with additional locations
- Automatic connection on untrusted networks added with a trusted list
- Leak test extended to check the older address family
- Split tunnelling reworked to match applications by path rather than name
- Reduced reconnection time after a machine wakes from sleep
Questions about this release
Should I leave the kill switch on?
Yes, always. Without it a momentary drop sends traffic over the ordinary connection in the clear at exactly the wrong moment.
Does it make me anonymous?
No. It moves where your traffic joins the internet and encrypts the path to that point. Sites you sign into still know who you are.
Which protocol should I use?
The default modern one, unless the network interferes with it. The fallbacks exist for restrictive networks and are harder to distinguish from ordinary traffic.
Can I exclude my banking application?
Yes, with split tunnelling, though be aware that anything on the outside list is unprotected. Use it only where something genuinely refuses to work through the tunnel.
Is there a device limit?
No. The premium state is applied here, so the same configuration runs on as many machines as you need.
Comments
Ran the built in test, resolver was going through the tunnel properly. Previous build leaked at connection time.
Fallback protocol got me connected on an office network that blocked the default outright.
Comments are read before they appear. If a build stops working, say so here and it gets rebuilt rather than quietly left up.
Auto connect on untrusted networks is the setting that made me actually use this. Laptop protects itself now.