Update April 2023: We’ve updated this article to introduce NetShield Privacy Panel.
Today, we’re releasing an exciting new feature that makes it easier for Proton VPN users with a Proton VPN Plus, Proton Unlimited, or Visionary plan to keep your devices secure and your browsing private.
NetShield is now available on our Android, iOS, macOS, and Windows apps and is in beta on our Linux command line tool. It blocks malware, ads, and online trackers before they even load. This helps keep your device safe and improves your browsing speed.
How NetShield Ad-blocker protects you
When you turn NetShield on, it offers you two levels of protection:
- The first level prevents your browser from loading resources from domains that host malware, spyware, or other malicious software.
- The second level blocks ads and the online trackers that adtech companies use to target you, in addition to blocking malware. This advanced level of protection is on by default when you first enable NetShield.
If you want to use NetShield Ad-blocker to block ads and have a faster and more private browsing experience, upgrade to a Proton VPN Plus or Proton Unlimited plan.
When you enable NetShield, any time you try to go to a website, the Proton VPN app will check that website’s address against a massive database of sites known to host malware, spyware, or any other malicious software. If it finds the domain of the website you are trying to visit or any of its components (scripts, images, etc.) on one of these lists, NetShield will automatically block it from loading.
If you enable ad blocking in NetShield, not only will it protect you from malware, but it will also block the annoying ads that clutter your screen. And unlike most popular ad blockers that only work in your browser, NetShield’s ad and tracker blocking works for the entire device. In addition to being annoying, these ads also eat up data and slow down your browsing experience.
With NetShield Ad-blocker, you can enjoy a faster, ad-free internet and reduce your data usage. And with the Netshield Privacy Panel, you can see how NetShield is protecting your privacy using easy-to-understand statistics that measure how many ads and trackers have been blocked, and how much data has been saved for the current session.
How NetShield works
To visit a website, you need to type in or click on a URL to get to the specific webpage you want. However, most people don’t realize there is a step between entering the URL and arriving at your desired webpage. That extra step involves making a domain name system (DNS) request.
Website URLs are created to be memorable for humans (e.g., www.protonvpn.com), but they don’t mean much to computers. They prefer IP addresses, (e.g., the IP address for Proton VPN’s website is 185.159.159.140). The DNS is the system that translates a human-friendly URL to a machine-friendly IP address. When you type in a URL and hit enter, your browser automatically tries to match it to the correct IP address by sending out a DNS request.
To prevent DNS leaks that could let attackers track your online browsing, Proton VPN encrypts all DNS requests in the VPN tunnel and handles them with a dedicated DNS server.
If you enable NetShield, when your device makes a DNS request, the DNS resolver on Proton VPN’s server runs a quick check against databases of web domains known to host malware, trackers, spyware, and any malicious software that could compromise your device’s security. NetShield checks not only the website’s domain, but also all additional domains for the scripts, images, and any other resources associated with that webpage.
If NetShield finds a match between your DNS request and this list, it stops the DNS request. This prevents you from loading the corresponding IP address and resource.
If you think a website or online resource is being blocked in error, you can turn NetShield off to access it.
The system works the same for ad and tracker blocking, only NetShield checks your DNS request against a database of known advertising agencies and online trackers. These lists are continuously updated so they will block new ads and trackers.
Proton VPN does not keep any logs of your DNS requests, so none of this data can be shared with any third parties.
Netshield Privacy Panel
The Netshield Privacy Panel shows how NetShield Ad-blocker is protecting you and improving your browsing experience. With just a glance, you can see:
- The number of ads blocked
- The number of trackers blocked
- The total amount of data saved
These statistics are for your current session and are reset when you manually disconnect from the VPN. The Netshield Privacy Panel doesn’t reset if you suffer an accidental disconnection, change your kill switch settings, or change VPN protocols.
The Netshield Privacy Panel is available to everyone on a paid Proton VPN plan.
Protect yourself with NetShield Ad-blocker
You can protect your browsing with NetShield today. You will need to have the latest version of the Proton VPN app to use NetShield to block ads and trackers. (You can check for updates in the Settings or About section of the app.)
NetShield is part of our effort to make safe online browsing easier and faster. Let us know what you think of NetShield on on Twitter, Facebook, Reddit, Instagram, and Linkedin. And thank you to the Proton VPN community. Without your support, advancements like NetShield would be impossible.
Hi, does ProtonVPN need to be running in order for NetShield to work? In other words, do I need to have an active VPN connection or will NetShield still work even if the VPN connection is not active?
Hi,
I just download new 1.9.3. version of ProtonVPN for MacOS.
Is Netshield dispeared ? Can’t find the option in thie new version.
Thank you
pflbs
I think I asked this as a reply to a comment. Let me try again.
Are there consequences when using Cloudflare Quad 1 with NetShield? If so, what are they? And…
Does NetShield address CNAME vulnerabilities?
Thank you!
Do I still need Malwarebytes if I have NetShield?
I am a ProtonVPNPro user. I have it set up on my router which is running DDWRT firmware and OpenVPN. Is it possible to run NetShield on it? If I try to add +f1 or +f1 to my OpenVPN username there is no space and I do not know how to change my OpenVPN username from my Proton Dashboard. How can I set my router up to use NetShield? Thank you.
Netshield is a boon to humanity. It takes 3 seconds to turn on if running the latest Proton. I didn’t think it was possible to read Quality UK newspapers without huge numbers of ads. Instantly, none at all. And a noticeable speed increase on an already quick machine. Fantastic. Thanks.
Follow-up to my earlier comment (which doesn’t appear here as yet) re:ads on Youtube. After deciding I prefer how Adblock Latitude handles Youtube ads, I switched off Netshield on the command line but there did not appear the reminder to re-connect with Protonvpn. On starting the client again with the command, ¨protonvpn-cli c¨ and choosing a server, the line stating connecting to xx server appeared and then the terminal reverted to awaiting command but didn’t confirm connection and, indeed,no server was connected so I had to reboot. Not what one would desire.
I’m using Linux Mint 19.3 Tricia 64-bit and normally use Pale Moon browser with Adblock Latitude 5.0.8 (among others e.g Umatrix).
After switching to Netshield, the websites I habitually visit appear the same as with Latitude, but Youtube still shows ads before rendering the selected video, whereas with Latitude a greyed-out still-image of the ad appears with a ¨Skip¨ button visible and immediately useable.
And it’s still a faff to have to ue the Terminal to control Protonvpn. When’s the gui coming, as Windoze and Chrome users have?
I think you are supposed to be trustworthy and transparent. How can we trust a feature that we don’t know what it does? I mean, if I use PiHole, AdGuard Home or PfBlockerNG I always have control, I know exactly what is being blocked, I can whitelisted or blacklisted. Your solution is a black box, no different from those walled gardens that you usually rant about. IMHO, you should provide the means to let us see what’s going on, as well as, a feature to whitelist/blacklist customization. In addition, I condemn AdBlocking per se, that is unfair to developers that live from ads. What everybody should be blocking is tracking, that is not the same and is indeed a shady practice.
Hi, thanks for this great feature!
Is it possible that at some point Netshield options would contain Pi-hole and other blocklists to choose from or combine?
I have OPENDNS set up on the router as the default DNS service. Does that affect how the VPN and NetShield function? And if so, what should I change the router setting to?
1. What are the consequences of discontinuing use of Cloudflare 1.1.1.1 and 1.1.1.2 as DNS servers and replacing them solely with selecting NetShield (or the consequences if you continue to use them along with NetShield)?
2. Does NetShield address CNAME tracking and if so, how?
Thank you!
Well, I feel bloody stupid, but how do I enable Netshield? I went to settings but cannot find it.
I have Proton’s Basic VPN plan and run Linux Mint. As there is no GUI for Linux available, like the one for Android or Win, I have to start the VPN via Terminal command line. How can I activate the NetShield option for Linux? Thanks for reply.
Hans
I see that “NetShield is now available on our Android, iOS, macOS, and Windows apps and is in beta on our Linux command line tool.” Nothing about ChromeOS?
I use the Vilfo VPN router https://www.vilfo.com for whole home protection with ProtonVPN. After appending +f2 to my username, I can confirm my entire home, ~60 devices are all now benefiting from the ad and malware protection. Thank you Proton team! I have a feature request. Please add an additional DNS filter (call it +f3) that combines your +f2 with filtering out adult content. If you do, I can stop paying for CleanBrowsing.org to protect my children from adult content. My ideal scenario is that the ProtonVPN app also filter adult content as mentioned, and have the option to turn off on defined networks like competitor VPN apps allow. This way, when at home, since all devices are already protected by ProtonVPN using the Vilfo router https://www.vilfo.com/ , the ProtonVPN app would automatically disconnect. As soon as the device leaves the network, the ProtonVPN app (for example iOS) would connect to ProtonVPN. This would insure devices are always protected by ProtonVPN with the best performance and end user experience.
Hi,
I’m looking for both tech (VPN & Ads blocking) in one service. Currently I use Blokada free part service. I’m very satisfy with the results. No one ads or tracker on my phone since 2017. Since I’m an user of ProtonMail service, I was waiting for this announcement to take a Plus subscription.
Befor, I have a question: does NetShield deals with Black Lists domains and can we customize the blocking list.
Thank you.
With NetShield are Automatic settings for DNS safe? I currently set the DNS manually to 1.1.1.1
I have a lifetime account and it appears protonvpn doesn’t recognize my account as lifetime visionary instead as a free account. What should I do?
Thanks Douglas for your reply !
I activated NetShield in my router (with +f2 next to my user name).
So now I’ve at home : Devices -> Router+PiHole -> ProtonVPN+NetShield
Outside on my Android phone : Only ProtonVPN+NetShield
Is my home setup OK? Or is it a duplicated anti-tracking ?
Sorry for the maybe silly questions, I’m new to this.
Thank you !
Hello, I am currently using Raspberry Pi-Hole with Cloudflare DNS for this purpose. Can I replace it with NetShield? Is it more efficient?
What do you recommend to me? (I am already a customer with you)
H Joel. You’re probably quite well covered for DNS filtering with your setup. The main advantage for you for switching to NetShield is that it is, rather than Cloudflare, who will resolve your DNS queries. It will also be useful on mobile deices and suchlike, when you are away from your Pi-Hole.
I don’t remember how I changed my Protonvpn DNS to Open DNS, but when I look up the current DNS I get 10.18.0.1 I did a restore from a backup recently and I don’t know if the restore was before I had made the DNS change or not. How can I be sure that ProtonVPN is protecting me as it is intended? I’m not sure how to undo what I did or even if it’s necessary now. Thank you!
Hi Douglas. In our Windows app, go to Settings -> Connection tab, and disable Custom DNS servers.
Hello, why the mexico location vpn are not available now? ultil a few hours ago they were available, now it doesnt
i want to hire your service but i need this location
Hi barba. Our Mexico servers are currently under maintenance. Normal service will be resumed soon.
You rolled this feature out in an update, then rolled back the available update to a previous release and now the “What’s New” changelog goes from 1.17.6 to 1.18.5 with no mention of NetShield. Is it in the now current version (1.18.5)?
Where do you post a detailed changelog?
Please don’t start bloating your software.
Hi all,
I am encountering numerous slow or denied connections to banks and merchant sites when using the Free version of ProtonVPN. Is there some way I can resolve the site’s fear of me as a “bot” or malicious evil-doer without disconnecting from ProtonVPN ? Is NetShield employed by the Free version and if so can it be turned on and off while online using ProtonVPN ? Would upgrading to “Basic” make any difference. What speed is offered by “Basic” ? Thanks
Hi cbc. No, Netshield is a premium feature available to Plus and Visionary users. What you describe shouldn’t be happening, so please contact our Support Team for assistance.
I had to change dns for protonvpn client to “open dns” in order for one of my apps to update. Does this affect my security in any way?
Hi Douglas. I means that, instead of being sent through the VPN tunnel to be handled by us, your DNS queries are being handled by OpenDNS, a company known for keeping logs. Another issue is that OpenDNS does support encrypted DNS quires using DNS over HTTPS (DoH), but if this is not configured then your dns quires will be sent across the internet in plaintext (and will therefore be advisable to your ISP should it choose to look).
Is the list of the blocked content available somewhere? It would be helpful to see what is/is not on it.
Hello,
could You please upload a recent version of ProtonVPN android app into anF-droid? :)
tuniek
I want to add ProtonVPN Visionary for all of my family’s devices and am wondering if you can recommend an antivirus/anti-malware application that can be used with your products. For Windows machines, is it OK to use the Microsoft Defender? What about an iOS machine?
Hi MB. We can’t comment on third party products, although Microsoft Defender provides good basic protection for Windows users. Apple does not recognize malware as problem on its iOS platform, and therefore does not allow anti-malware apps on its App Store.
Will this feature be released to the fdroid version of the app?
Hi Mr. wiggles. Yes.
Is there a way to flag or give input to the block/non block lists? Whether on a group-overall level (curated by proton) or a individual in app good/bad (sub).domain.level.
I find the ad-tracking blocker setting also prevents regular “outlook mailbox updates” in the iOS mail app. I know the web version of outlook is using a mixed bag/clutter of Microsoft domains, maybe that is also the scanner in the wheels here. Changing and reconnecting is an option but also tedious after a while.
And thanks to the team for adding this option/these options.
Hi KB. Please leave feature suggestions on our Feedback Forum.
I’m currently running Malwarebytes on my MacBook Air with OS 11.1 BigSur. I added Netshield a few days ago. Will this combination create any conflicts or problems? I’d be willing to uninstall Malwarebytes if necessary.
Thank you.
Hi Bill. There shouldn’t be any conflicts. If you do run into any problems, please let us know about them.
Hi Guys,
Love your work and this is a fantastic addition to your VPN. Thank you for introducing a much needed feature.
However, the iOS version eats 48% of my battery on a new iPhone SE in about 4 hours now that I have updated to this version. Am I alone on this or has this already been reported to you?
Russell.
Hi Russel. This should not be happening. Please contact our Support Team for assistance.
Nice
Correction: Works only in the paid version (as of the date of this comment)
Hi Isa. That is correct. Netshield is available for Basic, Pro, ands Visionary customers.
If we find something is blocked erroneously, how do we report that? (I haven’t found anything yet, but mistakes do happen.)
Hi M. Please report any issues to our development team at service@protonvpn.com.
I really wish there was a whitelist that you could add when you connect to a specific profile. It would make it a lot better for people who need to access a specific site, but dont want to be vulnerable.
Hi RacrZer. Please leave feature suggestions on our Feedback Forum.
Wow, this is awesome! I wondered about the new update for the VPN client and this blog entry was very good at explaining how it does, what it does. Thanks!
How do we know which specific spyware is blocked?
nice Netshield, but lets us see the block lists you use! i will choose witch host lists to use .
After installing latest update with Netshield, my browser Vivaldi still detects and blocks tracers and ads.
Don’t see any contribution of Netshield against tracers and ads.
Hi Ron. NetShield blocks malicious domains at the DNS server level. Your browser is almost certainly detecting and blocking domains before they are sent through the VPN tunnel to our DNS server.
What are sources of dns blocklists for NetShield? More or less lists than GoodbyeAds or Energized basic blocklists or Steven Black Hosts? Or just EasyLists and malware domains?
I want to know because if more than GoodbyeAds or Energized basic blocklists, I will stop using Adguard dns protection in Adguard app or nextDNS with ProtonVPN.
Am unclear whether this service can/does stop the irritating, irrelevant and spurious ads that are part of the Youtube experience. So when I want to watch Netrebko sing a duet with Horostovsky, I have to sit glued to the computer in order to bypass google’s horrible interruption of my viewing experience, instead of locating the clip and playing it through to the finish as in the old days. Please let me. know if Netshield is a workaround for this type of situation.
Thank you
Hi Mark. NetShield can only block ads that make a direct call to a blocked domain. With YouTube, its YouTube itself that injects the ads, so we can’t block their ads without blocking YouTube.
next step is build a nextdns inside this
Thanks a lot for this very useful feature !! very useful for iOS on various apps with ads and more generally for all websites on computer and mobile phone.
You are doing a great job! I‘ve been using ProtonVPN since it was published an I love it!
Is there an advantage or benefit to using NetShield as well as browser extensions such as AdBlock or Privacy Badger?
Hi Micheal. NetShield is an all-in-one solution that affects your entire internet connection – not just one browser.
O.M.G. Amazing, fabulous!! Works well and strips all the pesky advertising in apps too. Thank you so much.
For people who don’t use your native apps, this feature is worthless :(
Maybe it was better to create a separate filtering DNS server?
For example, CloudFlare Normal 1.1.1.1 and CloudFlare Filtered 1.1.1.2
Hi Andrew. This is already possible! Simply append
+f1or+f2to your OpenVPN/IKEv2 username.+f1for blocking malware only, or+f2for malware and ads.If NetShield blocks these things at the DNS server level why do I have to install a new version with it?
Hi hamington. This is because our server only filters connections where NetShield is enabled in the app.
This is a great option to provide to ProtonVPM users.
Please identify
1) the services and sources on which blocking decisions are made,
2) where we can continue to find this information as it changes,
3) what is returned to queries for blocked records, and
4) how identify we can identify when a record is blocked, especially when it’s one of very many used by a web site or service for its functionality, but which is not visible in the client.
Hi Andrew. At present we don’t make DNS blocklists public. You can see which domains are blocked, though, by opening your web browser’s Console. DNS requests blocked by NetShield will show a 404 error.