Developers use VPNs differently from the typical consumer streamer. We care less about watching Netflix Brazil and more about routing API calls through a controlled IP, encrypting traffic on hostile networks (hotel, conference, coworking), and on-call access to internal services without exposing them publicly. The current consensus divides the "VPN for developers" space into two product categories that solve very different problems: consumer privacy VPNs (Mullvad, NordVPN, ExpressVPN, Proton VPN, Surfshark) and overlay networks for zero-config access (Tailscale, ZeroTier). In this guide we walk through both and explain which problem each solves.
The two categories
| Consumer VPN | Mesh / Overlay VPN | |
|---|---|---|
| Primary job | Encrypt your traffic to the internet; geo-shift your IP | Connect your devices + cloud networks to each other |
| Examples | Mullvad, NordVPN, ExpressVPN, Proton VPN | Tailscale, ZeroTier, Netmaker |
| You want this when… | Working from a hostile network or masking origin | SSH/RDP into internal hosts without exposing them |
You will probably use both. The mesh VPN gets you from the laptop to the database inside the private VPC; the consumer VPN is a separate tunnel that wraps your outbound traffic to the public internet.
1. Mullvad — privacy-first, anonymous signup, fixed €5/mo
Mullvad is the developer community favorite for one reason: there is no account. You create an account by generating a random 16-digit number, pay anonymously (crypto, cash, Apple Pay), and you have a flat €5/mo forever — no annual plan games, no promo pricing that triples on renewal. WireGuard and OpenVPN endpoints in 40+ countries, no activity logs, and they accept returns with no questions.
For developers, Mullvad's wireguard config files are easy to slot into a single bash alias, and they ship an official CLI for Linux. Perfect for spinning up a "USA East" route to test the geo-blocking on your own USA API or for working from a coffee-shop network without leaking traffic to the local sniffer.
Pros: flat price, no email required, audited apps, SOCKS5 proxy extras for split-tunneling.
Cons: smaller server fleet than Nord; occasional buffering on long-distance routes during peak hours.
2. NordVPN — biggest fleet, fast, marketed honestly enough
NordVPN has 5,000+ servers in 60 countries. For developers who need a low-latency route from many specific cities (testing a CDN's edge behavior, for example), NordVPN's fleet breadth beats Mullvad. NordLynx (their optimized WireGuard) is genuinely fast, and the company's third-party audits have largely resolved the 2018 server breach episode.
This is an affiliate-friendly product, which is partly why every third VPN-listicle pushes it. To be honest: we recommend it because the fleet is big and the client is stable, not because of the commission.
Pros: largest fleet, fast WireGuard via NordLynx, dedicated IP options, meshnet P2P included.
Cons: the 2-year-plan promo funnels you toward auto-renewal; the desktop app is noisy; some streaming sites block Nord IPs more aggressively than Mullvad.
3. ExpressVPN — premium-priced, rock-solid app
ExpressVPN wins when you need stability and easy router-level integration. Their Lightway protocol is reportedly fast and the apps are the most reliable across weird platforms (some dev's homebrew OS — they probably have an app for it). They are also audited; the company has held a credible no-logs story for years.
Pros: best apps on unusual platforms; easy router setup; reliable on hostile networks.
Cons: highest sticker price of the consumer VPNs; fewer simultaneous connections on the base plan.
4. Proton VPN — generous free tier, EU privacy
Proton VPN (from the ProtonMail team) is the closest thing to a free VPN that respects privacy. The free plan is genuinely free, with no data cap niggle, and includes access to a few countries. For developers it shines at the higher tiers with Secure Core (routes through hardened datacenters in privacy-friendly jurisdictions) and good Switzerland/EU endpoints.
Pros: honest free tier; strong privacy story; opensource clients.
Cons: Paid plans are middle-of-pack speed-wise; smaller fleet than Nord.
5. Surfshark — cheap with unlimited devices
Surfshark targets price-sensitive households and small teams — the single subscription works on unlimited devices simultaneously. Apps are mature, fleet is reasonable, and the year-end promo prices are aggressive.
Pros: unlimited devices; cheap; reliable app.
Cons: renewal prices climb after the promo period; UI ads upsell their add-ons.
6. Tailscale — mesh VPN, the favorite for internal access
Now the different category. Tailscale is built on top of WireGuard and lets you build a private mesh of your devices instantly, with no port forwarding, no DNS juggling, no certificate wrangling. Each machine just authenticates with your identity provider (Google, GitHub, Microsoft) and magically appears at 100.x.y.z inside the Tailnet.
For developers, Tailscale is the one tool that lets you genuinely retire the bastion host. Your laptop, your staging box, the prod database (with an ACL), and a teammate's machine all live on the same flat overlay network. Run ssh staging-db over Tailscale without ever exposing port 22 to the public internet.
Pros: near-zero setup; SSO; ACLs; MagicDNS; Harmless Extras like Taildrop; works on nearly every OS, including Kubernetes.
Cons: Free tier covers 100 devices in personal mode; enterprise pricing is reasonable but non-trivial; some network admins object to the SSO-control-plane architecture.
# connect from anywhere via Tailscale hostname
ssh root@staging-db.tail-xxxx.ts.net
# debug an internal-only service via its tailnet IP
curl http://100.85.17.2:9000/healthz7. ZeroTier — open-source mesh alternative
ZeroTier is comparable to Tailscale but with an open-source management plane you can self-host. If your security policy forbids routing the control plane through any SaaS vendor, ZeroTier is the credible alternative.
Pros: self-hostable, free for personal use up to 25 members, mature.
Cons: setup is incrementally more painful than Tailscale; community-led and the docs are less polished.
Which problem are you solving?
"I work from a coffee shop / airport / hotel and want my API traffic encrypted"
Pick Mullvad. Flat €5/mo, simple CLI, anonymous signup, no marketing email, no renewal surprises. If you want to test geo-restricted endpoints, the same Mullvad tunnel routes you through new cities with one CLI flag.
"I need to reach the staging database without exposing port 22"
Use Tailscale. The setup is curl -fsSL https://tailscale.com/install.sh | sh && tailscale up. The first hour building the Tailnet will save hundreds of hours of bastion maintenance over the next year.
"I want both"
That is normal. Use Tailscale for machine-to-machine traffic and Mullvad for outbound traffic. Tailscale's app supports an "exit node" mode where one of your devices routes your Tailnet's outbound traffic via Mullvad — that is a power-user setup worth trying once you are comfortable with both tools.
Split-tunneling & per-app routing
Most modern VPN clients support split-tunneling — selected apps go through the VPN, the rest stay direct. For developers this is essential: you usually want your terminal/SSH traffic through the VPN but leave your video call traffic direct (lower latency for audio). Mullvad and NordVPN both support this; ExpressVPN and Proton support it on some platforms.
Calling geographically restricted APIs
Some SaaS APIs only accept requests from whitelisted countries (often the US, sometimes the EU). Without a VPN a developer in another continent cannot test them. The fix is to tunnel through a US endpoint before hitting the API:
# Connect Mullvad WireGuard to US endpoint
mullvad relay set location us
# Now curl passes through the US exit
curl https://api.example.com/geo-only-endpointFor QA pipelines that need this in CI, run the CLI as a sidecar in CI before the test step:
- name: Connect Mullvad (US exit)
run: |
mullvad account set $MULLVAD_TOKEN
mullvad relay set location us
sleep 2
curl https://api.ipify.org # verify it shows a US IPPair this with our own address API test-suite — you can verify that a US-IP caller sees data for US-IP customers, while a non-US-IP caller sees the same data but through different latency.
What a VPN does not protect you from
- HTTPS-encrypted APIs: TLS already encrypts the body. A VPN hides the IP you are coming from, not the content of an already-encrypted call.
- Hostile apps on your own machine: if your laptop itself is compromised, the VPN happily forwards the malware's C2 traffic encrypted.
- Identity inference: a DNS leak or telemetry fingerprint can still identify you even when the source IP is hidden. Enable Mullvad's DNS leak protection.
Recap table
| VPN | Best for | From | Affiliate? |
|---|---|---|---|
| Mullvad | Daily privacy, flat price | €5/mo flat | No |
| NordVPN | Largest fleet, fast | Promo ~$3/mo (2-year) | Yes |
| ExpressVPN | Premium reliability | ~$7/mo (annual) | Yes |
| Proton VPN | Generous free tier, EU privacy | Free; paid from $5/mo | Yes |
| Surfshark | Cheap, unlimited devices | Promo ~$2.5/mo | Yes |
| Tailscale | Mesh overlay for internal access | Free personal; Teams from $5/user | Yes (Teams) |
| ZeroTier | Self-hosted mesh alternative | Free up to 25 members | No |
Final recommendation
If you only pick one tool from this list, pick Mullvad for privacy and Tailscale for internal access. They cover the full surface developers actually need, are audited, and they respect your time and your data. If your needs are narrower and you want a giant fleet, NordVPN remains a credible paid option. Whatever you choose, enable DNS leak protection, set up split-tunneling, and verify your exit IP with curl https://api.ipify.org every time you sit down at a new network — the magic five-second test that catches a misconfigured VPN before it bites you.