Windscribe

A conventional VPN — encrypt the uplink, appear somewhere else.

What it does

Windscribe tunnels all traffic through one of its servers, which changes your apparent location and hides traffic from the local network and ISP. The client supports WireGuard, OpenVPN and IKEv2, split tunnelling per app or per destination, a firewall-based kill switch, and an ad/tracker blocker (R.O.B.E.R.T.) applied at their DNS.

Different job to Tailscale

Tailscale connects you to your own machines. Windscribe changes where the public internet thinks you are. Running both is normal, but route conflicts are common — put the lab subnet in Windscribe’s split-tunnel exclusions, or Tailscale traffic disappears into the tunnel.

Notes

A VPN provider is a party you are choosing to trust with the traffic your ISP would otherwise see. That is a trade, not an upgrade — judge it on the provider’s jurisdiction, audits and logging policy.

Alternative to

Alternative	Type	Trade-off
Mullvad	Subscription	No account, cash accepted, the strongest privacy reputation of the group
Proton VPN	Freemium	Audited, with a larger free tier than this one
NordVPN, Surfshark and ExpressVPN	Subscription	Bigger networks and bigger marketing budgets
IVPN	Subscription	Small, audited, transparent about ownership
Your own WireGuard server	Open source	Private by construction, but the exit IP is traceable to you