We test Mozilla’s new Wireguard-based $5/mo VPN service

[Karlston]

We test Mozilla’s new Wireguard-based $5/mo VPN service

Mozilla's VPN is available now for Windows, Android, and iOS.

Enlarge / Mozilla's new Wireguard-based service offers a very simple, attractive, and cleanly functional VPN user interface.

Jim Salter

35 with 29 posters participating, including story author

 

Mozilla, the open source company best known for the Firefox Web browser, made its VPN service generally available in the United States this month. The cross-platform VPN is based on Wireguard and delivered in partnership with well-known and especially techie-friendly VPN provider Mullvad. Mullvad itself was, to the best of our knowledge, the first publicly available VPN provider to offer Wireguard support back in 2017.

 

The Mozilla VPN service costs $4.95 per month and offers server endpoints in 30-plus countries. It currently has VPN clients available for Windows 10, Android, and iOS—but users of other operating systems, such as MacOS and Linux, are going to have to wait. Mozilla says that support for MacOS and Linux is coming soon—but unfortunately, even if you're an advanced user who understands Wireguard configs, you can't just roll your own connection now.

 

The service authenticates via Firefox cloud account. When you sign up for a Mozilla VPN subscription, you'll be asked to create a Firefox account if you don't already have one. The Firefox account is an SSO (Single Sign On) service which uses oauth2, much like a Google account—but it's not tied to a Google account, so even if you sign up using a Gmail address tied to an Android device, that device won't be automatically logged in.

 

Aside from the Firefox-based oauth2 integration, Mozilla's VPN appears to effectively be a Mullvad VPN, with a different client application and different billing entity. It is a bit less expensive through Mozilla, though—Mullvad costs €5 per month. This makes Mozilla's offering about $0.80 per month cheaper, at current exchange rates.

 

Before we go any further, we need to make something clear—we've repeatedly said that Ars Technica, as editorial policy, does not and cannot specifically recommend any public VPN service provider. While Mozilla does put its own stamp of approval on Mullvad's policies, we have neither sufficient access nor resources to audit those claims ourselves. Readers will need to decide for themselves whether Mozilla's endorsement and partnership constitutes sufficient assurances for their own level of privacy and security needs.

 

Readers who want a publicly available VPN service and a somewhat higher level of potential privacy might consider bypassing Mozilla and going directly to Mullvad. The Mozilla VPN service must be tied to a working email address and paid for with a credit card. By contrast, Mullvad accounts have no identifying information besides the account number itself, and they can be paid for with bitcoin—or even literal cash in a mailed-in envelope.

 

We don't have any better way to guarantee Mullvad's internal policies and handling than Mozilla's, of course—but never collecting a user's real-world information in the first place is a pretty solid start on the privacy game.

Testing Mozilla VPN—Android (Google Pixel 2XL)

        

 

     

 

On Android devices, the Mozilla VPN client is available directly from the Play store. It's a fairly small download (20MiB) and quick install. Once installed, bringing up the application directs the user to log in with a Firefox single sign-on account; assuming that account also has a paid subscription to the Mozilla VPN service, you're ready to go immediately—no additional configuration is necessary.

 

The application itself is about as simple as it could possibly be. By default on first login, a fairly nearby VPN endpoint is automatically selected by geolocation; the VPN itself is off until toggled on using a small slider. After toggling the slider on, the VPN itself connects in two seconds or less... and that's it. By default, all traffic from the phone is routed through the Mozilla VPN.

 

Diving into the Settings tab reveals a little more functionality. You can manage your Mozilla VPN account, change your VPN endpoint, or opt to pass individual apps on your phone or tablet directly through to the raw network connection.

 

The Mozilla VPN account management just opens a webpage in your default browser; logging in with your Firefox SSO once more gives you access to your payment and profile information. Selecting a VPN endpoint lets you first choose an endpoint country, and then you choose from one or more city locations in that country. The nice thing here is that changing your endpoint automatically breaks and reconnects your VPN connection as well—there aren't any additional clicks necessary.

 

Finally, the "Protect specific apps" setting does just what you'd expect, providing you with two lists—protected apps (those routed through the VPN) and unprotected apps (given direct network access). You don't see these lists at all unless you toggle the slider on; once you do, all apps by default are protected. If you prefer your defaults the other way around, you get a button to "unprotect all apps" as well as individual checkboxes for the apps themselves. So getting things just the way you like them is easy.

 

There is no option to pass LAN traffic directly through—so if you use apps that depend on local traffic, you'll unfortunately need to pass those entire apps through.

Testing Mozilla VPN—Windows 10 (build 2004)

 

 

 

 

 

If you read through the Android section above, you know just about everything you need to know about the Windows client as well. The interfaces are almost pixel for pixel identical, although you can resize the Windows client, since it's running on a full multiple-window desktop interface.

 

The one real difference we found between Android and Windows is the ability to pass local network traffic directly to the local network, bypassing the VPN. This allows connections to devices such as printers, local file servers, Plex media servers, and so forth to continue unmolested. It would be nice if Android offered the same option—one of the biggest complaints we saw in user reviews on the Play store was from people frustrated that enabling the VPN on their phones broke exactly those sort of connections.

 

On the other hand, the Windows client is missing the ability to route individual apps' traffic through the VPN or directly to the local interface. You win some, you lose some.

Performance testing with Mozilla VPN

 

 

 

 

The TL;DR here is simple—Mozilla VPN's performance is perfectly fine. We found very little difference between a raw, direct connection and one routed through a relatively nearby Mozilla/Mullvad endpoint, whether testing using a Pixel 2XL phone connected over Wi-Fi, or a Windows 10 build 2004 VM connected via Ethernet.

 

The nearest endpoint to our test location is in Atlanta, Georgia—where we also maintain a self-hosted Wireguard instance. Our self-hosted Wireguard instance in Atlanta was not meaningfully faster or slower than Mozilla's in the same city. We saw slightly better latency to our self-hosted endpoint (accessed via the vanilla Wireguard client on each platform) and slightly better throughput to the Mozilla endpoint.

 

The farther away your endpoint, the more difference you'll see in both latency and throughput. Routing from the US East Coast through London added about 80ms latency and lost about 15-20 percent of the possible throughput, on either Android/Wi-Fi or Windows/Ethernet.

Conclusions

Did we mention that we cannot specifically recommend any commercial VPN provider? Well, we're not going to stop mentioning it. Although Mozilla has earned many people's trust for its own advocacy for Internet privacy through both policy and code, we cannot verify how either it or its partner Mullvad actually handle its internal networks.

 

With that said, the stated policies of both Mozilla and Mullvad are on point, the Mozilla-provided Android and Windows clients are easy and intuitive to use, and the network performance was very good indeed. If you're in the market for a commercial VPN provider and you like Mozilla, this service is well worth a look.

 

 

We test Mozilla’s new Wireguard-based $5/mo VPN service