# Will a VPN check block your students? 65% of campuses run a VPN

On 65% of education networks, some addresses answer is_vpn, and 99.55% of those are the institutions' own VPNs. A rule that lets students through.

GitHub's student verification turns some applicants away with a message that ends "You may not use a VPN." A [Georgia Tech guide for its online students](https://sites.gatech.edu/omsfreeanddiscounted/getting-github-student-dev-pack-3-ways-aka-how-to-prove-youre-a-student/) quotes it, and then adds: "As of September, 2025, I understand you now need to be on the GA Tech VPN to verify your location during this process." The same student is told to stay off VPNs and to connect through one.

A university's VPN puts a student's traffic on the campus network, and a site that trusts campus addresses, as GitHub does by that guide's account, lets them in. So when a VPN check fires on a university address, which VPN did it find? On October 23, 2026, we checked every address on every education network against each flag [our API](https://vpndetection.io/api) returns. On 65% of those networks at least one address answers `is_vpn`, and 99.55% of those addresses are the institutions' own VPNs.

## What a VPN check sees on an education network

A keyed answer says what kind of network announces the address, in `asn.type`. 4,641 networks of type `education` announce IPv4 addresses: universities, colleges, schools and the research networks that connect them. They hold 203,780,084 addresses, and this is how many answer each flag:

| Flag | Addresses | Share of the education address space | Education networks with at least one |
|---|---|---|---|
| `is_vpn` | 233,285 | 0.11% | 3,002 (64.7%) |
| `is_resproxy`, last 90 days | 136,740 | 0.07% | 2,942 (63.4%) |
| `is_hosting` | 326,788 | 0.16% | 390 (8.4%) |
| `is_tor` | 436 | 0.0002% | 118 (2.5%) |
| `is_mobproxy` | 165 | 0.0001% | 103 (2.2%) |
| `is_pubproxy` | 385 | 0.0002% | 55 (1.2%) |
| `is_relay` | 0 | 0% | 0 |

VPN addresses are a ninth of a percent of the space, spread thin: 1,549 of the 3,002 networks have three or fewer, and 826 have one.

## Nearly all of them are the institutions' own

Of the 233,285 VPN addresses:

* **190,206 (81.5%) are VPN servers with no brand attached**, each a single address, on 2,967 networks. The networks' own DNS often names them: on 816 of those networks, at least one has "vpn" in its name. Georgia Tech's `vpn.gatech.edu`, [its GlobalProtect VPN](https://it.gatech.edu/node/203), is one of these servers.
* **42,032 (18.0%) belong to VPN services run for organizations**: nine in ten of them [eduVPN](https://www.eduvpn.org/)'s, which more than 230 universities and research institutions use, and the rest mostly the VPN gateways of business firewalls.
* **1,047 (0.45%) are VPNs anyone can use**, on 96 networks: 598 addresses of consumer VPN services, the commercial brands people pick servers on, on 22 networks, and 449 of peer-to-peer VPNs, such as [VPN Gate](https://www.vpngate.net/)'s volunteer-run servers, on 80.

A student arrives from one of these addresses when their traffic leaves through it: on the campus VPN, if it sends traffic out from its own servers, and even on campus Wi-Fi, if one firewall runs the VPN and sends everyone else's traffic out from the same address. Either way, a plain VPN check refuses someone the university itself put there.

## Send campus VPNs to a second step

Every keyed answer, the Free plan's included, carries `asn.type`. So the fix is one line more than a plain VPN check: a VPN on an education network gets a second step, such as a code sent to the student's university email, and every other VPN is refused. With the [Node.js package](https://docs.vpndetection.io/integrations/nodejs):

```js
// check.mjs
import { VPNDetection } from 'vpndetection';

const client = new VPNDetection({ apiKey: process.env.VPNDETECTION_API_KEY });

// A VPN address on an education network is nearly always the
// institution's own VPN: ask for a second step instead of refusing.
function decide(result) {
  if (!result.isVpn) return 'allow';
  if (result.asn?.type === 'education') return 'challenge';
  return 'block';
}

for (const ip of process.argv.slice(2)) {
  const result = await client.lookup(ip);
  console.log(decide(result), ip, result.asn?.name, result.asn?.type);
}
```

```bash
$ node check.mjs 143.215.254.43 45.134.140.130
challenge 143.215.254.43 Georgia Institute of Technology education
block 45.134.140.130 Datacamp Limited hosting
```

`143.215.254.43` is what `vpn.gatech.edu` resolved to, and `45.134.140.130` is a Mullvad server in Atlanta, from [Mullvad's own server list](https://mullvad.net/en/servers). A home broadband line in Georgia answered `allow`. We ran it against the live API on October 23, 2026, with `vpndetection` 5.10.0 and a key on the Max plan.

Without a key, the API answers `ip` and `is_vpn` alone, so `asn` is missing and the rule blocks both. A free key is enough ([pricing](https://vpndetection.io/pricing)). The rule's cost is the 1,047 addresses of consumer and peer-to-peer VPNs on education networks, which get the second step too. In a web app, check the address the request came from, as the [Express tutorial](https://vpndetection.io/blog/detect-vpn-users-express-js) does.

## Residential proxies are on campus too

2,942 education networks, 63.4%, had at least one address in a residential proxy pool in the last 90 days, 136,740 addresses in all. Such an address has carried strangers' traffic out through a device on that network, and the same network carries the students you want. Challenge there too, rather than block: `is_resproxy` comes with every paid plan, and [How long do residential proxy IPs last?](https://vpndetection.io/blog/how-long-do-residential-proxy-ips-last) covers how fast they turn over.

The other way a student gets flagged is a privacy feature in their browser or phone, which [Should you block iCloud Private Relay?](https://vpndetection.io/blog/block-icloud-private-relay) covers.

## How we measured

We took every IPv4 range announced by a network of type `education` on October 22, 2026, and every IPv4 address each flag answered for on October 23 (Tor's from October 22), counting the residential, mobile and public proxy flags only for addresses seen in their last 90 days. Each address counts once per flag. The kinds of VPN are those in [Does blocking datacenter ASNs stop VPN users?](https://vpndetection.io/blog/block-datacenter-asn-vpn): consumer VPN services are the commercial brands people pick servers on, services run for organizations are business VPN gateways and research-network services like eduVPN, peer-to-peer VPNs run on their users' own connections, and servers with no brand attached are VPN servers we haven't tied to a provider. An address of more than one kind counts once, under the first of consumer, peer-to-peer, organization and no brand.