upvote
All traffic to the VPN is encrypted, including DNS queries.

All your ISP can tell is you are using a VPN.

reply
What about TLS inspection?
reply
Not unless they can break your VPN's encryption. Which, if your ISP can do that, you have bigger problems.
reply
What about it? Unless they've hijacked your local cert store somehow (which corporate machines do), they can't see inside the TLS. They can detect that you're connecting to somewhere and probably infer that it's some VPN, but only the most repressive countries actually block VPNs altogether.
reply