After a thorough evaluation, we can confirm that the technique described in the paper has minimal impact on ExpressVPN users, thanks to the robust design of our kill switch, Network Lock.

In short:

• Android is not affected at all
• Aircove is completely protected as it has Network Lock on by default and cannot be disabled
• Desktop apps are not affected if Network Lock is turned on
• iOS can be affected, due to limitations set by Apple. This is consistent with historical iPhone security limitations. As noted by the researchers, using 4G or 5G rather than Wi-Fi mitigates this issue.

We highly recommend that all ExpressVPN users enable the kill switch at all times. We’re also adding new reminders in our apps to encourage users to keep the kill switch toggled on.

If you are interested in more information, you can find it in our TunnelVision blog post. We also detail our investigation and how it relates to ExpressVPN’s apps on each platform we support below.

About our investigation

In their TunnelVision paper, the researchers assert that it is possible to induce a leak of VPN traffic when using something called DHCP Option 121 classless static routes, and that this affects all VPN providers and VPN protocols that support such routes.

To put this simply, it means that under certain conditions (and only when you connect to a network you don’t control, like hotel or airport Wi-Fi), an attacker with control of the Wi-Fi router could designate that any traffic bound for a particular destination be diverted outside the VPN.

It takes a specific sequence of conditions to be met for anyone to be affected by this issue, and ExpressVPN’s customers are among the best protected, in part because of the strength and structure of Network Lock.

When Network Lock is on, we found that leaks do not occur. Traffic bound for the destination designated by an attacker would result in “denial of service”—it would simply be blocked, resulting in a blank webpage or error message. Traffic that was headed to any other destination (in other words, anywhere not specified for diversion by the attacker) would pass through the VPN as normal. However, if a user has manually turned Network Lock off, then the traffic would indeed be allowed to pass via the diverted route, causing a leak.

As such, we highly recommend that all ExpressVPN users enable the kill switch at all times. We’re also adding new reminders in our apps to encourage users to keep the kill switch toggled on.

About our platforms

The potential of this technique depends on the operating system or device being used.

Starting with our desktop users: thanks to Network Lock, the ExpressVPN kill switch on Mac, Windows, Linux, and routers, the potential for exposure is limited. Whether you use Mac or Windows our investigations found that this technique could only pose a threat if our kill switch, Network Lock, had been manually disabled by a user. As Network Lock is enabled by default, users who have never modified their settings cannot be affected.

So if you, like many ExpressVPN users, simply open your app, hit the big On button, and occasionally change locations, then you have never been exposed to this issue. The way we designed our kill switch ensures that our desktop users are defended against this technique and other attacks that attempt to force traffic outside of the VPN.

On Aircove and Aircove Go routers, you cannot be vulnerable as the kill switch is always on and cannot be disabled. Mobile users: On Android, you cannot have been exposed, as this technique does not impact ExpressVPN’s Android app at all. This is because DHCP Option 121 is not supported on that platform. On iOS, due to  limitations set by Apple, we cannot guarantee that. As noted by the researchers, using 4G or 5G rather than Wi-Fi mitigates this issue entirely.

How we built and designed Network Lock to protect users

As we’ve explained, Network Lock is the ExpressVPN kill switch on Mac, Windows, Linux, and routers. It keeps user data safe by blocking all internet traffic until protection is restored. A similar feature is available under the Network Protection settings of our iOS and Android apps. We offer these features because a reliable kill switch is an essential feature of a VPN, key to protecting users and ensuring their privacy. That’s why we also turn our kill switch on by default and have spent a lot of time investing in its reliability since we first rolled it out in 2015.

We also made a lot of careful engineering and design decisions to implement the feature. Our Network Lock feature prevents all types of traffic including IPv4, IPv6, and DNS from leaking outside of the VPN, such as when the user’s internet connection is disrupted, when switching between Wi-Fi networks, and other various scenarios where other VPNs might leak.

Our kill switch functionality on router firmware and all desktop platforms works by applying a “block everything” firewall rule followed by a rule that permits traffic exclusively through the VPN tunnel. These kill switch rules are first engaged when the VPN connects, and they remain active during reconnect cycles and unexpected disconnects. This is exactly what the researchers are referencing in the “Industry Impact” section of their report when they state that they “have observed a mitigation from some VPN providers that drops traffic to non-VPN interfaces via firewall rules.”

This setup safeguards against the TunnelVision exploit and similar threats. It blocks any traffic trying to bypass the VPN, including any routes that TunnelVision may have introduced.

The post What do I need to know about the TunnelVision technique? appeared first on ExpressVPN Customer Support.

iOS

1. On your iOS device, swipe up from the bottom of the homescreen, keeping your finger pressed until app previews appear on the left.
2. Swipe to find the app preview you want to force-close.
3. Swipe up to close the app.

Android

1. On your Android device, open your multitasking interface. The way to do this varies depending on your device:
   • If your device has three icons at the bottom of the screen, tap either the three vertical lines icon or the square icon.
   • If your device features a single horizontal line at the bottom of the screen, swipe up from the bottom to the middle of the screen, hold for a second, then release.
2. Swipe to find the app preview you wish to force-close.
3. Swipe to close the app. The direction you need to swipe will vary depending on your device.

Android TV

1. Go to Settings.
2. Select Apps, and scroll to find the app you want to force-close.
3. Select the app, then select Force Stop.

Fire TV/Fire Stick

1. Go to Settings.
2. Select Applications > Manage Installed Applications.
3. Scroll to find the app you want to force-close.
4. Select the app, then select Force Stop.

Apple TV

1. Double-click the TV icon on your remote to see the apps currently running.
2. Swipe to find the app preview you want to force-close.
3. Swipe up to close the app.

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

The post How to force-close apps appeared first on ExpressVPN Customer Support.

After this date, Version 10 of the ExpressVPN app for Windows will no longer receive feature or security updates. We will also only officially support Windows versions that are still supported by Microsoft (meaning Windows 10 and 11), via Version 12 of the ExpressVPN app for Windows.

Why we are ending support for Version 10

Our decision is tied to Microsoft’s decision to stop supporting Windows 7, 8, and 8.1. Without regular security updates from Microsoft, any vulnerabilities on these versions of Windows will remain unpatched. As a result, your personal data could be at risk if you continue to use these versions of Windows.

As a security-focused company, we want to ensure our apps offer the latest and most secure technology. We also encourage everyone to use devices and software with the latest security updates.

Version 10 was the only version of our Windows app that could be used by these older versions of Windows, but it is no longer needed and is currently only used by a dwindling number of customers. Ending support for Version 10 will allow us to focus on delivering new features and security updates for Version 12.

We’re proud to say that Version 12 is both faster and more reliable, and it contains all of our most advanced features, including:

• Threat Manager, which protects against nosy apps, trackers, and malware
• Ad blocker, which reduces annoying display ads while you’re browsing
• Parental controls, so you can protect anyone from accessing harmful or adult content on your computer
• Auto-update, so you never need to remember to manually update our apps
• The latest security improvements.

What you need to do next

If you are running Windows 7, 8, or 8.1:

1. Upgrade to Windows 10 or Windows 11.
2. Download Version 12 of the ExpressVPN app for Windows.

If you are running Windows 10 or newer and are using Version 10 of the ExpressVPN app for Windows:

1. Download Version 12 of the ExpressVPN app for Windows.

If you are unsure which Windows operating system you are using, refer to this guide.

If you are unsure whether you are using Version 10 or Version 12 of the ExpressVPN app for Windows:

1. Open the ExpressVPN app for Windows.
2. Click .
3. Go to Help & Support > About ExpressVPN.
4. The version number will be displayed.

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

The post Ending support for Version 10 of the ExpressVPN app for Windows appeared first on ExpressVPN Customer Support.

Before proceeding, please note that:

• ExpressVPN for Android makes use of as few permissions as possible to provide a reliable VPN service.
• Permissions marked as “Permission prompt is shown” are not required in order to use the app. However, you will need to enable them to use certain features, such as auto-connect and two-factor authentication for ExpressVPN Keys.
• ExpressVPN does not monitor or collect any data of your online activity or connections. To learn more about our commitment to your privacy, see the ExpressVPN Privacy Policy.

Permissions used by all versions of the app

Permissions only used by the Beta app

The post Permissions for the ExpressVPN Android app appeared first on ExpressVPN Customer Support.

Version 12.73.0 of our Windows app temporarily removed the split-tunneling feature while we addressed an issue that may have left some users’ DNS requests unprotected. Starting with Version 12.74.0, split tunneling has been restored. The issue that prompted its removal has been fixed. You can read more about this on our blog.

If you are using Version 12.73.0 and do not see split tunneling available to you, please update to the latest version. 

In addition, we are no longer supporting Version 10 of our Windows app, with the final update being Windows 10.53.0. Split tunneling has been permanently removed from Version 10.

What exactly was the issue?

We found two bugs related to split tunneling, which we have now fixed. 

The first bug only affected Version 12 of the Windows app.

Versions 12.23.1–12.72.0 of our Windows app, published between May 19, 2022, and Feb. 7, 2024, had a bug that allowed some users’ DNS requests to go unprotected when the user had chosen one of our two split-tunneling modes, “Only allow selected apps to use the VPN.” In these instances, the apps being routed through the VPN might, under some circumstances, send DNS requests to third-party DNS servers instead of our servers. All other aspects of VPN protection (e.g., encryption) were not impacted.

Version 12.73.0 of our Windows app removed split tunneling while we addressed the issue. It has now been resolved, and starting with Version 12.74.0, split tunneling has been restored to all Windows users.

During further investigation and testing, a second bug was discovered. It only affected Windows users who had other VPN apps installed on their computer and were also using split tunneling. In these cases, users’ DNS requests could go unprotected. 

This issue is an edge case. We estimate that it could have occurred for less than 1% of Windows users. We believe an even smaller proportion of users would have had the relevant interacting apps installed on their machines, so the affected user group is smaller than half a percent of Windows users.

Recent updates to Version 12 of our Windows app have resolved this issue, as verified by an independent audit. We have ended support for Version 10 of our Windows app, but the last released version does not contain the split-tunneling feature. 

What does it mean for DNS requests to go unprotected?

When a user’s DNS requests are not sent to our servers and instead go to a third party, that normally means the user’s ISP, unless the user has previously designated otherwise. The ISP is able to determine the web domains visited by that user (e.g., google.com), but not any individual webpages, searches, or other online behavior. All contents of the user’s traffic remain encrypted by the VPN and unviewable by the ISP or any other third party. 

Is there anything I need to do?

If you are a Version 12 user: We recommend that you upgrade to the latest Version 12 app, if your app has not already automatically updated. 

If you are a Version 10 user: You should upgrade to Version 12 of the Windows app, as we no longer support Version 10. If your computer is running Windows 7, 8, or 8.1, you should know that Microsoft is no longer releasing critical security updates for these discontinued operating systems. Therefore we strongly urge you to upgrade your operating system to Windows 10 or 11, which will also allow you to begin using Version 12 of our Windows app.

I want to use split tunneling. What can I do?

You should update to the latest version of our Version 12 app for Windows.

The post Split tunneling not available in Windows app appeared first on ExpressVPN Customer Support.

• Can’t stream Netflix
• Can’t stream BBC iPlayer
• Can’t stream YouTube TV
• Cannot connect to the VPN
• Connected to the VPN but cannot access certain content
• Connected to the VPN but the internet is slow
• Connected to the VPN but cannot browse the internet
• The VPN keeps disconnecting

Important: If you are still having issues with ExpressVPN not working with Netflix, Hulu, or any other streaming services, or the issue is not mentioned in these guides, contact the ExpressVPN Support Team for immediate assistance.

The post ExpressVPN streaming support appeared first on ExpressVPN Customer Support.

After each step, check whether the issue is fixed before proceeding to the next section.

1. Change to a different VPN server location

If you are a U.S. user having issues streaming Netflix, try changing to these VPN server locations in the following order:

1. USA – Washington DC
2. USA – San Francisco
3. USA – New York
4. USA – New Jersey – 3
5. USA – Los Angeles – 3
6. USA – Denver

Below are instructions for changing your VPN server location on:

• Windows
• Mac
• iOS
• Android
• Android TV
• Apple TV
• Linux
• Routers

If you are a non-U.S. user having issues streaming Netflix, proceed to the next step.

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

2. Sign out of the Netflix app, then sign in again

If you are using the Netflix app, sign out of it, restart your device, and then sign back in.

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

3. Watch Netflix from your browser

Try streaming Netflix via your browser by going to https://www.netflix.com/ and signing in with your Netflix account details.

If you are having issues streaming Netflix from your browser while connected to the VPN:

1. Get the ExpressVPN browser extension (available for Windows, Mac, and Linux). To use the browser extension, you must also have the ExpressVPN app installed on your computer.
2. U.S. users should try connecting to these server locations in the following order:
   1. USA – Washington DC
   2. USA – San Francisco
   3. USA – New York
   4. USA – New Jersey – 3
   5. USA – Los Angeles – 3
   6. USA – Denver

   Non-U.S. users should proceed to the next step.

3. Try using a different browser. The ExpressVPN browser extension is available on Windows, Mac, and Linux, and it works with Chrome, Firefox, Vivaldi, Chromium, Brave, and Microsoft Edge. The ExpressVPN app must also be installed.

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

4. Contact Support

If you are still unable to stream Netflix while connected to the VPN, contact the ExpressVPN Support Team anytime by clicking or tapping on the chat box at the bottom right-hand corner of your screen.

You can also email the team directly at: support@expressvpn.zendesk.com

Back to top

The post Troubleshooting steps for streaming Netflix appeared first on ExpressVPN Customer Support.

After each step, check whether the issue is fixed before proceeding to the next section.

1. Sign in to YouTube TV from your browser

If you are having issues streaming YouTube TV while connected to the VPN, make sure you are using the browser version of YouTube TV rather than the app version.

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

2. Use the ExpressVPN browser extension

Make sure you are using the ExpressVPN browser extension (available for Windows, Mac, and Linux). To use the browser extension, you must also have the ExpressVPN app installed on your computer.

If the issue persists, try using a different browser. The ExpressVPN browser extension works with Chrome, Firefox, Vivaldi, Chromium, Brave, and Microsoft Edge.

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

3. Change to a different VPN server location

Try changing to these different VPN server locations in the following order:

1. USA – San Francisco
2. USA – Washington DC
3. USA – New York

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

4. Contact Support

If you are still unable to stream YouTube TV while connected to the VPN, contact the ExpressVPN Support Team anytime by clicking or tapping on the chat box at the bottom right-hand corner of your screen.

You can also email the team directly at: support@expressvpn.zendesk.com

Back to top

The post Troubleshooting steps for YouTube TV appeared first on ExpressVPN Customer Support.

After each step, check whether the issue is fixed before proceeding to the next section.

1. Change server location

If you are a UK user having issues streaming BBC iPlayer, try changing to these different VPN server locations in the following order:

1. UK – East London
2. UK – Dockland
3. UK – London
4. UK – Wembley
5. UK – Midlands

Below are instructions for changing your VPN server location on:

• Windows
• Mac
• iOS
• Android
• Android TV
• Apple TV
• Linux
• Routers

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

2. Stream BBC iPlayer in a web browser

Try streaming BBC iPlayer from your web browser by going to https://www.bbc.co.uk/iplayer.

If you are having issues streaming BBC iPlayer from your browser while connected to the VPN:

1. Try changing to these different VPN server locations in the following order:
   • UK – East London
   • UK – Dockland
   • UK – London
   • UK – Wembley
   • UK – Midlands
2. If you are still experiencing problems, try signing out of your BBC iPlayer account and clearing your cache and cookies. To clear your cache and cookies on Chrome:
   1. Sign out of your BBC iPlayer account.
   2. Click > Clear Browsing Data…
   3. Under Time range, select All time.
   4. Check the boxes for Cookies and other site data and Cached images and files.
   5. Click Clear data.

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

3. Contact Support

If you are still unable to stream BBC iPlayer while connected to the VPN, contact the ExpressVPN Support Team anytime by clicking or tapping on the chat box at the bottom right-hand corner of your screen.

You can also email the team directly at: support@expressvpn.zendesk.com

Back to top

The post Troubleshooting steps for streaming BBC iPlayer appeared first on ExpressVPN Customer Support.

ExpressVPN command line interface (CLI) can be used to control the ExpressVPN app for Windows in Windows Command Prompt.

This is an advanced tool that can be used as a means of controlling and automating the app to connect, disconnect, and more.

Jump to…

View list of commands
Activate the app
Connect to a VPN server location
Disconnect from a VPN server location
Connect to a different VPN server location
Switch to a different VPN protocol
Connection information
Enable (or disable) Network Lock
Check app version
Sign out of your account

View list of commands

To see a list of commands you can use, run any of the three following commands:

ExpressVPN.CLI -?

OR

ExpressVPN.CLI -h

OR

ExpressVPN.CLI --help

Need help? Contact the ExpressVPN Support Team for assistance.

Back to top

Activate the app

Open Windows Command Prompt and run the command:

ExpressVPN.CLI activate <activationCode>

Replace <activationCode> with your ExpressVPN activation code.

Need help? Contact the ExpressVPN Support Team for assistance.

Back to top

Connect to a VPN server location

To connect to the VPN, run the command:

ExpressVPN.CLI connect

ExpressVPN will use Smart Location to select the best server location for you based on factors such as speed and proximity.

Need help? Contact the ExpressVPN Support Team for assistance.

Back to top

Disconnect from a VPN server location

To disconnect from a VPN server location, run this command:

ExpressVPN.CLI disconnect

Need help? Contact the ExpressVPN Support Team for assistance.

Back to top

Connect to a different VPN server location

List of server locations

To find a list of VPN server locations to connect to, enter the following command in the terminal:

ExpressVPN.CLI list

Connect to a specific VPN server location

To connect to a specific server location, enter:

ExpressVPN.CLI connect <location>

For example, to connect to USA – New York, enter:

ExpressVPN.CLI connect “USA - New York”

Connect to the Smart Location

To connect to the Smart Location:

ExpressVPN.CLI connect smart

Need help? Contact the ExpressVPN Support Team for assistance.

Back to top

Switch to a different VPN protocol

For the best experience, ExpressVPN recommends using the Automatic protocol option. This is selected by default and automatically picks the protocol most appropriate for your network.

In some cases, switching to a different protocol can give you faster connection speeds.

To switch to Lightway – TCP, run the following command:

ExpressVPN.CLI protocol lightway_tcp

To switch to Lightway – UDP, run the following command:

ExpressVPN.CLI protocol lightway_udp

To switch to OpenVPN – TCP, run the following command:

ExpressVPN.CLI protocol tcp

To switch to OpenVPN – UDP, run the following command:

ExpressVPN.CLI protocol udp

To use the Automatic option, run this command:

ExpressVPN.CLI protocol auto

Need help? Contact the ExpressVPN Support Team for assistance.

Back to top

Connection information

To check your connection status, run the following command:

ExpressVPN.CLI status

To view connection diagnostic information, run the command:

ExpressVPN.CLI diagnostics

Need help? Contact the ExpressVPN Support Team for assistance.

Back to top

Enable (or disable) Network Lock

Network Lock is enabled by default.

To disable Network Lock, enter the following command:

ExpressVPN.CLI network_lock off

Network Lock is enabled by default. If you disabled Network Lock previously, you can enable it by running:

ExpressVPN.CLI network_lock on

Need help? Contact the ExpressVPN Support Team for assistance.

Back to top

Check app version

To check which version of the ExpressVPN app you are using, run the command:

ExpressVPN.CLI --version

Need help? Contact the ExpressVPN Support Team for assistance.

Back to top

Sign out of your account

To sign out of your ExpressVPN account on the ExpressVPN app for Windows, run the following command:

ExpressVPN.CLI logout

Need help? Contact the ExpressVPN Support Team for assistance.

Back to top

The post How to use the ExpressVPN CLI for Windows appeared first on ExpressVPN Customer Support.