Architecture Note: Opera Browser Built-in Free VPN Design and Trust Boundaries

Requirements

Opera's free VPN aims to give users a one-click privacy proxy that needs no manual configuration, enforces per-user bandwidth caps, offers a limited set of virtual locations, integrates cleanly with Chromium's network stack, and leaves end-to-end TLS untouched for HTTPS while allowing the Opera UI to decide which traffic is routed.

Smallest Suitable Design

The design consists of three parts:

1. Client UI toggle - a setting in Opera's preferences that, when turned on, asks the browser's network service to route selected traffic through a TLS tunnel to an Opera-operated proxy node.
2. Proxy tunnel - from the Opera client to a chosen proxy node selected by region using a mutually authenticated TLS connection; the tunnel carries the original HTTP/HTTPS request.
3. Proxy forwarding - the proxy node decrypts the TLS tunnel, sees the clear-text HTTP host and headers, then forwards the request to the destination server. For HTTPS, the proxy forwards the encrypted TLS payload unchanged, so the destination sees only the proxy's egress IP.

Location choice is made client-side, user picks a region; the server side then selects an available node within that region.

Trust/Data Boundaries

Boundary	What is visible
User device	Full trust boundary - credentials, cookies, local storage remain under user control.
Opera proxy node	Sees the client's source IP, the destination host, timestamps, and any unencrypted HTTP payload. HTTPS content stays encrypted to the destination.
Destination server	Observes only the Opera egress IP of the proxy node, not the user's original IP.

Opera asserts a no-logs policy, but the client cannot cryptographically verify that claim.

Operational Checks

• Proxy nodes are periodically probed for latency and availability; unhealthy nodes are removed from rotation.
• When the VPN toggle is flipped, the client performs a quick connectivity test, TLS handshake to the selected node.
• Bandwidth quota is enforced per user account; exceeding the limit triggers throttling or temporary disable.
• Abuse detection monitors for patterns typical of automated traffic and may trigger CAPTCHAs or temporary blocks.
• Telemetry collects error rates and fallback events to drive scaling decisions.

Failure Modes

• Proxy outage - traffic falls back to a direct connection or shows an error if fallback is disabled.
• DNS leak - if the system resolver is used instead of Opera's internal resolver, DNS queries may bypass the proxy.
• Egress IP blocking - services that maintain blocklists of known Opera VPN IPs may deny access.
• Performance degradation - under heavy load, proxy nodes can add latency or reduce throughput.
• Regulatory blocking - some jurisdictions may block the IP ranges Opera uses for exit nodes.

Conditions That Would Change the Design

• Demand for verifiable zero-knowledge logging would require a redesign of the proxy-to-client trust model.
• A paid tier with higher limits and dedicated IPs would introduce separate proxy pools and different authentication flows.
• Legal mandates forcing traffic logging would shift the trust boundary to include persistent storage at the proxy.
• Need for per-site split tunneling would require the client to maintain a rule-based routing table rather than a simple on/off toggle.
• A move to decentralized exit nodes would replace Opera-operated proxies with a federated overlay, altering trust and operational checks.

Verification Steps

These steps show how a user can observe the behavior described above. They do not guarantee any particular outcome.

1. Disable Opera's VPN. Visit an IP checking site and note the reported IP address.
2. Enable Opera's VPN, select a virtual location, and reload the same IP checking site. The displayed IP should correspond to an Opera egress address in the chosen region.
3. To check for a possible DNS leak, use a DNS leak test site with VPN on and off and compare the list of resolvers seen.
4. Monitor latency by loading a static file with VPN toggled on and off, noting any change in download time.
5. If the VPN appears unavailable, check Opera's console for messages such as VPN connection failed or Fallback to direct connection enabled.

Risks: Running external IP or DNS checks reveals your network activity to those third-party sites. Ensure you trust the sites you use for testing.