Skip to main content
NetShield is a DNS-based filtering feature built into Proton VPN. When you connect to a VPN server, all DNS queries from your device pass through Proton’s servers. NetShield intercepts those queries and blocks requests to domains associated with ads, trackers, and malware — before they ever reach your device. No extra software or browser extensions are required. NetShield works system-wide, covering all apps and browsers.
NetShield is available on Proton VPN Plus and higher plans. Free plan users can see the NetShield setting but must upgrade to enable it.

​
Modes

NetShield has three modes. You can switch between them at any time from the settings panel — changes take effect immediately without reconnecting.
DNS filtering is disabled. All DNS queries pass through without modification.Use this mode if you want full unfiltered browsing, or if you are troubleshooting a website that may be incorrectly blocked.

​
NetShield stats

When NetShield is active in the Block ads, trackers & malware mode, the VPN home screen shows a live stats panel for the current session: Stats reset when you disconnect or reconnect.

​
How to enable NetShield

1

Open Settings

Tap the Settings icon in the bottom navigation bar.
2

Tap NetShield

Find NetShield in the settings list and tap it to open the NetShield sub-setting screen.
3

Toggle NetShield on

Use the toggle to enable NetShield. Once enabled, the app defaults to Block ads, trackers & malware mode.

​
Limitations

NetShield filters DNS queries only. It does not inspect the full content of network requests, so it cannot:
  • Block ads delivered from the same domain as the content you are loading (first-party ads)
  • Block tracking embedded directly in page HTML or JavaScript that does not make a separate DNS call
  • Decrypt or inspect HTTPS traffic
Some ads and trackers may bypass NetShield depending on how they are served. For stronger ad blocking, NetShield can be combined with a browser-level content blocker.
If you have custom DNS configured in Proton VPN settings, NetShield will be disabled automatically. Custom DNS and NetShield use the same DNS resolver mechanism and cannot run at the same time. A banner in the NetShield settings screen will explain this conflict and offer the option to disable custom DNS.
If your device has Android’s Private DNS (DNS-over-TLS) enabled in system settings, NetShield will also be unavailable. Private DNS bypasses the VPN’s DNS configuration. A conflict banner will appear with a link to open Android’s network settings.