I just use a wireguard config with Proton. But I imagine Proton writes their own client because many people can’t handle their own config.

Also some "VPN"s are just fronts for zionist terrorism (eg. cyberghost, expressvpn, etc.), etc.

• https://www.mintpressnews.com/exposed-how-israeli-spies-control-your-vpn/288259/
• https://medium.com/illumination/vpns-the-privacy-trap-4aef67f39634

Do you trust mossad with your VPN?

Some of these clients have extra features (eg obfuscation to get around VPN bans) but yeah, I wouldn’t use any VPN provider that didn’t at least provide wireguard configs I can use without their own custom client.

The client is packaged and sold with the VPN subscription to “add value”. People like you and I understand that VPN clients are pretty simple places of software, but most VPN customers, well… you know

You’re not missing anything. Mullvad and probably some of the others lets you download a client config and use it in whatever app you want.

The ones that don’t allow that are probably shady or just don’t care about your freedoms, behind a guise of “our app is more convenient/safe/etc”.

There are business, technical, and UI/UX reasons for having a client. The business case is that it clearly demarcates the service they’re selling, because it must be installed and isn’t built-in (eg Firefox VPN). The act of having the user do something means that for a brief moment, they have to concentrate on the product. Consumers have this tendency to value things higher if they were involved in its success, such as when building flat-pack furniture.

The technical side is that while a VPN is indeed just a tube that transports packets securely to the VPN servers, the fact is that there are so many ways for this to go wrong. For example, leaking DNS requests is a way to throw the confidentiality guarantee* of a VPN out the window. As can Happy Eyeballs, where the same HTTP request is sent by both Legacy IP and by IPv6; if both aren’t sent through the tunnel, confidentiality is lost.

To deal with this, the client can implement mitigations, such as setting a different DNS nameserver, as well as the (IMO exceedingly inappropriate) measure of disability IPv6 outright. These are not functions which the built-in VPN client in the OS would necessarily do, although some OS network managers genuinely will do a good job. But even more important than applying mitigations is to check for leaks! The client app can run periodic tests to make sure DNS or IP packets are always going down the tunnel, such as by checking destinations that only exist through the tunnel. Failure to pass this test should throw up huge warnings that the user’s confidentiality may be imperiled. This is table stakes for a retail VPN service in 2026.

Finally, UI/UX for a VPN requires that the whole thing be easy: users want to browse the web, download … uh… Linux ISOs, and go about their life with a VPN that Just Works ™. Most people do not want to copy a Wireguard config into the OS using a terminal. A VPN service should have broad appeal, since the fear mongering advertising suggests it’s a product that everyone online should use.

At bottom, we can say that “retail VPNs” really do need a client app. But for technically minded folks, a Wireguard config would be enough, because the endpoints would also be configured to route solely down the tunnel. Or even use an isolated netif, in the case of Linux namespaces, which is IMO quite clever.

A lot of it is convenience. An app lets people pick multiple destinations without worrying about config or hopping connections, whereas doing it totally manually you’ll have to configure and connect/disconnect each endpoint yourself.

A good example is AzireVPN. They let you grab Wireguard config files directly and just connect on your own terms (up to 5 active connections per account, but eh), and they have an app if you prefer.

They did recently get bought out by some fucking shithole company, so I do not know if I even should mention them by name, but it does exemplify the issue you’re asking about.

Just to point out another interesting example that sits on one extreme end of the spectrum.

https://safing.io/ has a whole open source firewall and traffic monitoring gui app and their VPN (SPN) is a small and optional paid feature of that.

I was wondering this! It always used to just be additional settings in the connections panel.

Being in full control of their own app, without conflict of interest from a competitor. Also they might use different programming languages, optimize for different environments they care about. And also to differentiate themselves from the competitor, to have an identity. Similar to how game consoles play the same games, but have their own identity behind it. And they want to sell their own subscription, so they only support and promote their own.

Just to name a few things that come to my mind. I don’t use all those different tools, so I maybe wrong.

a lot of them do offers wireguard/openvpn config files as an alternative to their clients, but those offers more features such as speed tests, quickly switching between profiles (I don’t really want tens of different VPN profiles on my network manager), some extra settings easily reachable such as a network killswitch if you get disconnected etc

With some VPNs (Mullvad and NordVPN to name two) you can use your own clients by downloading lists of VPN relays and whatever authentication credentials the protocol uses. Though if you use the official client, it often has options beyond the protocol, such as selecting multiple hops (i.e. entering at one relay and exiting from another), disguising your traffic as another protocol (useful if you’re somewhere where VPN traffic is blocked) or padding traffic to a constant size to prevent profiling (i.e. by comparing to known video streams).

Open-source VPN clients do not implement the most important feature - a monthly reminder to pay your bill. Well, and dumbing down the technical UI to one big green button, so even dumbest users would not have trouble with it.

You could make the same case for a browser, an email client, a graphics or video editor, etc. The UI is an interface to basic core processes that are usually the same that all have, with some extras on the top for uniqueness and features that might be more appealing than other UIs.

Wouldn’t less variety of clients be less safe. Having one client means a security bottle neck becomes vulnerable because more is ‘known’/certain to attackers.

Besides all text editors are doing the same thing, so why not just have one text editor?

Ultimately if you follow this line of thinking - then why not have a universal code library that just forms programs as the user needs them.

Okay, so you want Star Trek style Holodeck?

i can’t even get nord to work on bazzite so i just use openvpn with it instead, works ok