A WireGuard tunnel from your devices to a gateway I run, plus a DNS resolver that answers inside it. That is the whole product: no client app, no bundled browser, no telemetry SDK. You get a WireGuard configuration (or a QR code) and your operating system’s own WireGuard client does the rest — see the client setup guide.
The three tiers exist because of one question: who resolves your DNS, and is anything filtered? Every tier hides your source IP from the sites you visit. Only two of them also keep your name lookups away from your ISP.
Which one do I want?
- Keep your own resolver — you already run encrypted DNS (DoH/DoT) you trust, or you have split-DNS and corporate names to resolve → pipe
- Stop your ISP seeing your DNS, no filtering — anything you ask for resolves → privacy (the default recommendation)
- Both, plus ads and trackers blocked before they load → security
The three tiers
DNS: untouched. The configuration carries no DNS setting, so your device keeps the resolver you already run.
Hides: your source IP from every site you visit. Leaves alone: your lookups — they go to your own resolver over your ISP, outside the tunnel.
For you if: you already run encrypted DNS you trust, you have split-DNS or corporate name setups, or you want the exit IP and nothing else.
DNS: ours, inside the tunnel. Your device resolves through 172.16.40.1, reachable only from inside the tunnel, which forwards upstream over DNS-over-TLS.
Gains: your ISP stops seeing which names you resolve — it sees one encrypted stream to the gateway. Does not do: filtering. Whatever you ask for resolves.
Everyday privacy without a filter deciding what loads. This is the tier I recommend by default.
DNS: ours, with filter lists. AdGuard Home at 172.16.41.1 resolves inside the tunnel and forwards upstream over DoT, blocking ads, trackers and known-malware domains before your device ever connects to them.
Gains: everything the privacy tier does, plus per-device blocking that does not depend on a browser extension. Isolation: its own resolver instance on its own interface, so filter lists and caches never touch the other tiers. If a list breaks something: the portal has a filter-list page where you can see what is blocked and ask for an entry to be allowed through.
For phones, tablets, family devices, and any browser where you would rather not install an adblocker.
The tiers differ in DNS only — never in speed. Both gateways shape traffic identically: a guaranteed 100 Mbit/s per connection, bursting to 1 Gbit/s when the line is idle. Nothing about the product is capped or upsold by bandwidth.
How a tier gets assigned
The tier is chosen per device when you add it in the portal, and different
devices on the same subscription can run different tiers — a laptop on privacy,
a phone on security, a work machine on pipe. To move a device between tiers,
remove it and add it again under the new tier: each device gets its own tunnel
configuration, so switching means downloading a new config file or QR code rather
than editing the existing one.
The price
$10/mo (USD), billed monthly by card through Stripe. One subscription covers all three tiers: they are DNS postures on the same connection, so there is no “better” plan to upsell you into and nothing to meter — no data cap, no per-gigabyte billing, no usage-based fees. Cancel any time; access runs to the end of the paid period, and partial periods are not pro-rated. The details live in terms & fair use.
Being straight about what this is not: it is a privacy service, not a geo-unblocking one. There is a single gateway, no rotating exit addresses, and no residential proxy pools. It is fast and it is honest, and it will not pretend to be a Netflix-region machine.
What we do not keep
- No browsing history. No DNS query records. No connection times. Not on any tier — the resolvers run with query logging and statistics disabled, so the tiers’ names are not “more logged” than each other.
- What we do hold, and why: your email and password hash, your Stripe subscription record, your device records (name, tier, assigned tunnel IP, public key) and aggregate byte counters per device for fairness. Byte totals carry no destinations.
- The full list, with retention, is on the what we log page — it names the exceptions instead of hiding them.
Verify it, don’t trust it
- Read the audit. The infrastructure audit reviews the gateway configuration, both tier resolvers, and tests the no-log assertions rather than asserting them in prose: infrastructure audit. The signed report is also published at vpn.ymrtech.com/logging-audit.
- Read the source. The infrastructure is declarative Nix; nothing is hand-configured on a running machine. git.ymrtech.com
- Read what we hold. What we log — the exact list, with retention windows.
- Test it yourself. The portal shows whether the current browser is on the VPN at all, and the DNS leak test sends a uniquely-named probe lookup and confirms whether it reached our resolver through the tunnel — plus a link to an external test that lists the full resolver chain. Open the portal.
- Watch it live. Service status publishes the checks we watch — the portal, both tier tunnels, both tier resolvers, the website, the forge and mail — so a blip can be told from an outage before anyone opens a support thread.
Questions
Which devices can I use it on?
Three devices per account, each with its own tier. Any client that speaks WireGuard: the official Windows, macOS, Linux, iOS and Android apps, or a router that supports WireGuard imports. The setup guide covers each platform.
Can I bring my own DNS?
Yes — that is the pipe tier. Your device keeps whatever resolver it already
has, including in-browser DNS-over-HTTPS.
How do I know my DNS is going through the tunnel?
The portal answers this two ways. It reports whether the browser you are using is on the VPN at all, and the DNS leak test mints a unique probe name, has your browser look it up, and then checks whether that lookup reached YMR’s resolver inside the tunnel. If a device’s client is falling back to its own resolver or to in-browser DNS-over-HTTPS, the query never arrives and the test says so. It deliberately does not try to enumerate the whole resolver chain, so the page also links an external test that lists every resolver the outside world can see.
How do I know the service is up?
Service status is a live public page, checked once a minute: the portal, both tiers’ tunnels and both tiers’ resolvers, plus the website, the forge and mail. If something a device depends on is down, it shows there. If a check you rely on is missing from that page, say so through contact.
What happens if I cancel?
Access stops at the end of the paid period, and the device records are gone with the account. Cancellation and refunds are covered in terms & fair use.