VPN inside PlugMate or inside the host?

Two quick questions.

1/ Can a VPN client be installed and used inside the PlugMate, so that the network traffic of whatever apps installed inside the PlugMate can go through the VPN while riding on the network connection of the host (whether it’s an Android phone, iPhone or PC)?

2/ If the host, let’s say a hardened degoogled Android phone, uses a VPN, and I plug a PlugMate into the hardened phone without a VPN in use inside the PlugMate, will the network traffic of the apps installed inside the PlugMate still be encrypted through the VPN of the Android phone host? If not, what solutions exist for encrypting the network traffic of the apps installed inside the PlugMate other than installing a VPN client inside the PlugMate as in 1/ above?

Thanks.

Happy to clarify.

1 / VPN inside PlugMate

Yes. You can install and use a VPN client directly inside PlugMate, just like on a normal Android device. In that case, the apps running inside PlugMate can route their traffic through the VPN tunnel, while still using the host device (phone, iPhone, or PC) simply as the network provider.

From the network perspective, PlugMate uses the host’s connection (Wi-Fi or cellular), but the VPN tunnel is established by the PlugMate system itself. The traffic path typically looks like this: App inside PlugMate → PlugMate network stack → Host network → PlugMate VPN → target internet.

2 / VPN running on the host device

If the host device is running a VPN and PlugMate itself is not running a VPN, PlugMate’s network traffic will normally still go through the host’s VPN tunnel, because the host is providing the underlying network connection. In other words, the traffic path typically looks like this: App inside PlugMate → PlugMate network stack → Host network → Host VPN → Internet.

If both PlugMate and the host device run VPNs, the traffic of PlugMate will go through both tunnels, effectively creating a nested VPN setup (double VPN). This allows users to choose where they want the privacy boundary to be — inside PlugMate, on the host device, or both.

Excellent! Thank you!