What is a VPN exit?

How a VPN exit works

Every request on the internet carries a return address. Route the request through a VPN and the return address the destination sees is the tunnel’s far end — the exit — rather than your own connection. Your ISP still sees that you connected to the VPN; the destination sees only the exit. Each party gets half the picture, and neither gets both halves.

The address swap matters more for television than for casual browsing: streams are long-lived connections, and hours of traffic to one host paint a clear picture of who watches, from where, and when.

A consumer VPN app does this for your whole device: everything you do exits from the provider’s address. But an exit can also live inside a service’s own infrastructure, so that one specific kind of traffic — and nothing else on your device — leaves from it. That’s the shape Twiga uses.

It’s worth being precise about what an exit is not. It isn’t Tor: Tor chains relays run by different parties so no single operator sees both ends, while a VPN exit is one hop run by one operator — faster, and a different trust shape. And it isn’t invisibility: whoever operates the exit necessarily knows a connection passed through it. What an exit changes is who can link the traffic to you.

In Twiga

Streams route through Twiga’s VPN exits: Twiga’s servers connect to your IPTV provider, and that connection leaves from an exit address. Your provider sees Twiga’s IP, never your home IP — and your ISP sees a connection to Twiga, not to your provider.

Nothing is installed on your device and no tunnel is created from it; the routing happens entirely on our side of the blind relay. Playlist refreshes take the same VPN path, while the TV guide fetch goes over Tor. Pairing the exit with the blind relay closes the loop: Twiga can see that a stream ran — a timestamp and a token — but not what it carried. The exits themselves are on the status page, with live health per exit — verifiable, not asserted.