Basically what the title says - Can my ISP see the exit node of my VPN ? I hope not, because that would be weird, and would defeat the whole purpose of a VPN.

A bit of backstory about why I had this question ( it is slightly long, so is totally okay for the reader to skip this part )

My partner subscribed to a McAfee security suite, that we share (because they had some promotions available or something for multiple devices). It’s not the worst thing around - the antivirus part, but it also came with their “McAfee Safe Connect VPN” service, which is infamous for having a super-invasive data logging policy. So I said fuck’em and set out for a better option.

I am more or less tech-literate, but I researched somewhat deeply‌ this time, basically to choose between “Privacy” (like Bruce Wayne - everybody knows who he is and lives in the Wayne Manor, but nobody knows what he does there, or that he has a BatCave underground), and “Anonymity” (Like Batman - everybody knows what he does - kicks ass of bad guys - but nobody really knows who he is, ok except for may be a couple of people) - basically trying to figure out if I needed a VPN at all or not.

I already have DNS-over-HTTPS enabled in all my devices - so that kinda took care of my “privacy” concerns (i.e. a nosy ISP) - although I believe my ISP can see which IP/Domain I am finally connecting to, which kinda sucks.

Apart from my ISP, the other concern was Public Wi-fi. I do work with my device(s) on-the-go a lot, which is why I have reason to ensure safety while connected to Public Wi-fi at Cafes/Restaurants/Airports. The fact that Internet is not just HTTPS - there’s telnet/FTP/SMTP/IMAP/POP3/Gopher and other protocols which have their own encryption methods (or not) also led me to the realization that DOH is not a total replacement for VPN. And the ISP can know my destination Domain even if DOH stops them from sniffing or blocking the DNS lookup itself.

In the end, I decided to go with VPN. Not any free ones (because as we all know they suck), and neither any over-promoted ones as well, like Nord or IPVanish (because they suck as well, in a different way). I chose Mullvad, but white labeled as Mozilla VPN. This is because I do use email-forwarding services to a large extent, and Mozilla is providing this combined deal of their email masking service Firefox Relay along with phone masking and VPN for 5 devices, all for a reasonable subscription (I won’t say how much because this post is not a promotion for them) - and being a long-time Firefox user (and also being anti-Google for a while), I decided to go with that (and so far all I heard about Mullvad are good things).

So far I am alright with it. Let’s see how it goes.

And that concludes my VPN journey story. While I was researching about how much my ISP can see when I connect to a VPN - I found that they can see encrypted traffic to and from my real IP, and that I connected to a “VPN server”, and nothing else.

I assume this “VPN Server” that they can see is the “entry node”, and not the “exit node” (i.e. my IP as seen by the world) - but never got a clear answer to that - which led me to my original question above.

And thanks for reading this far ! Feel free to share insights.