What Is NetShield and Does It Actually Block Ads?

This page is part of the Proton VPN FAQ Hub.

How does NetShield work?

NetShield intercepts at the DNS stage. Every time your device wants to load something it first asks a DNS server to turn a domain name into an IP address, and when you are connected to Proton VPN that question goes to Proton’s resolver, the one layer at which Proton can see the domains you request. NetShield checks the requested domain against blocklists of known ad networks, tracking services and malware hosts, and where there is a match the lookup fails. The resource never loads because your device never learns where to find it. That technique is DNS sinkholing, the same one security teams use to strangle malware domains inside a corporate network.

Because the filtering happens on the server rather than your machine, it costs you no processing power and applies to everything on the connection: browsers, mobile apps, background telemetry, smart TV software, anything sitting behind a router configured with Proton VPN. The apps show a running count of blocked adverts, trackers and malicious domains along with an estimate of bandwidth saved, though treat that estimate as indicative rather than precise.

Does it actually block ads?

Partly, and the honest answer depends entirely on where the advert comes from. Anything served by a separate ad network, which is still most display advertising on the open web, resolves to a domain NetShield recognises and dies at the lookup. Third-party analytics, tag managers and tracking pixels go the same way. On a typical news site the difference is immediately obvious.

The failures are structural rather than fixable, and no DNS-based blocker of any kind handles them.

• YouTube pre-roll and mid-roll adverts, served from the same Google infrastructure as the video itself
• In-feed advertising on Facebook, Instagram, TikTok and similar, delivered from the same hosts as the posts
• First-party sponsored content and native advertising written into the page
• Cosmetic leftovers: blocking the request leaves blank boxes and collapsed layout where the advert was
• Anti-adblock nag screens, which DNS filtering has no way to argue with
• Anything resolved before the VPN connects, in the first seconds after boot

What are the blocking modes?

There are three settings. Off disables filtering and uses Proton’s plain DNS. Block malware only filters just the malicious domain lists, which is the safest option when a site you need keeps breaking. Block ads, trackers and malware is the full setting and the default on paid plans. The Windows app adds a further option that includes adult content in the block list.

Changes take effect on reconnection rather than instantly, so if you switch mode whilst troubleshooting, drop the connection and re-establish it before deciding whether it helped. The setting is per-device rather than per-account, which catches people out when they fix something on the laptop and then wonder why the phone still misbehaves.

When does NetShield break things or quietly fail?

False positives are the common complaint. Plenty of legitimate sites load images, payment widgets or login flows through domains that also appear on tracker lists, and when those requests fail the page half-loads or the checkout button does nothing at all. The symptom rarely announces itself as a blocking problem, which is why the first diagnostic step for odd site behaviour whilst connected should be dropping NetShield to malware only.

There are also situations where it does not run. It is incompatible with Tor over VPN connections. On Android the system’s own Private DNS setting takes precedence and silently overrides it, so check that first if your block counter never moves. On macOS and iOS with IKEv2 selected, the statistics do not display even when filtering is working normally. Any device using a DNS setting that bypasses the tunnel, which includes some televisions with hard-coded resolvers, escapes it entirely.

Should you use it instead of a browser content blocker?

No. The two work at different layers and cover each other’s gaps. A browser extension can read the page, apply cosmetic filtering to hide the empty space, block same-domain adverts by URL pattern and deal with scripts that DNS filtering never sees. NetShield can do none of that, because by design it only ever sees a domain name and answers yes or no.

What NetShield does that an extension cannot is cover everything outside the browser: mobile apps phoning home, television telemetry, connected devices with no extension support. Running Proton VPN Plus with NetShield alongside a decent browser blocker gives you both halves, and there is no meaningful conflict between them. Subscriptions taken through BAIZAAR include NetShield on every paid tier.

Which plans and platforms include NetShield?

NetShield is included on VPN Plus and every other paid Proton VPN plan, Proton Unlimited and the business tiers amongst them. It is not available on Proton VPN Free at all, which is one of the more noticeable differences between the tiers, alongside Secure Core multi-hop routing, and a reasonable reason to pay in its own right.

Platform coverage is broad: Windows, macOS, Linux in both graphical and command line versions, Android, Android TV, iOS and iPadOS. Router setups are the fiddly case, since whether filtering applies depends on the DNS configuration in the file you downloaded rather than a switch you can flip, so verify it is actually working before assuming your whole network is covered.

---