I assume this “VPN Server” that they can see is the “entry node”, and not the “exit node” (i.e. my IP as seen by the world) - but never got a clear answer to that

Traditionally, the entry node and the exit node have been the same VPN server/ip. In that sense, your ISP does know the IP of your exit server, since they are the ones connecting you to it.

For example, your X ISP’s logs could show “At 15:00, user #123 connects to IP 1.2.3.4, which lookup shows is assigned to “CheapVPNs Ltd”. At 15:01 our email server received 1,000,000 emails from IP 1.2.3.4 all angrily complaining about how “X ISP sucks”. Correlation implies user #123 is responsible for the mail bomb attack against our servers.”

At the moment, Mullvad specifically does use different entry and exit IPs, but they are all still located in the same datacenter and subnet. That is, you could be connecting to a Mullvad VPN server 1.2.3.4, 1.2.3.5, or 1.2.3.6 in London, and they all exit out through 1.2.3.1 in London. This is just something Mullvad does. Other VPN services may not do it and Mullvad hasn’t done it in the past. Someone analyzing ISP logs could correlate these IPs if they really wanted to.

Mullvad also offers “multihop”, but the way they have it implemented currently (changing the destination port number), an ISP could still deduce your exit IP if they bother looking up records of Mullvad network structure (which are publicly available), since they know the IP number and the port number of your entrance node.

The only way to hide your VPN exit IP from your ISP currently is to use multiple VPN services and nest them inside each other (or use one service and nest it inside itself using the “multiple devices” perk). Then only a state-level actor could hope to correlate your traffic by monitoring the ingress/outflow of multiple IPs simultaneously.

You’re mostly right, if not completely right. VPN is encrypted with SSL so the ISPs only see that you exchanged information with a VPN, but not what is being exchanged.

You may consider that maybe the ISPs can also figure out who else connects to the VPN and maybe deduce some information that way, but they can’t know everyone who uses the VPN, only those on their ISP that use it. So you can exchange information with somebody in Antarctica and the ISP has no way of knowing if it’s somebody outside or inside their ISP.

Also, on the point of services that are not HTTPS, don’t confuse encrypted protocols with the SSL of the VPN. Your ISP will not see your unencrypted packets either if you tunnel it through your VPN. They can’t see your DNS or ping requests (assuming you are using an IP based proxy, not using a SOCKS proxy). But your VPN provider can see those unencrypted requests. So you’re choosing to trust the VPN provider with those opaque requests over your ISP.

And last, about DNS-over-HTTP, a reverse DNS is enough for your ISP to know what domain you’re connecting to in a lot of the cases, regardless if you hide the domain name resolution. Of course, sites using shared CDNs mitigate this, but not all do.

Using Mullvad is probably good enough.

One other thing your ISP can see, even with HTTPS traffic, is the domain name you’re connecting to. That’s part of the handshake of HTTPS, which is mitigated by encrypted hello but that’s just barely starting to get rolled out.

The only issue with a single point VPN, which most of them are, is if somebody is monitoring all the traffic of that VPN provider, they could do data stream analysis to determine which client has which stream. So if you’re watching a YouTube video through the VPN, and observer of the VPN could go I see a YouTube video going to the VPN provider at this bit rate, I see this new bitrate immediately correlated with this encrypted VPN user, therefore this encrypted VPN user is watching this video. Basically an observation and timing attack.

Even if you use multi-hop, somebody who can observe the entire network, like state actors, could perform the same attack and determine which data stream is going to which VPN user.

The good news is, other than state actors, no individual organization has the The entire Network observed that thoroughly. Your local ISP is not going to have that data.

This observation deanimonization attack can also be mitigated by not moving large data streams through the VPN, and using VPNs that are popular with many different users, hiding your traffic in the overall hustle and bustle of the VPN

Your ISP can tell which machine you’re connecting to, so unless you configure multi hop, yes. It still helps, in two ways: first, other people may be using your exit node, and even if your ISP can monitor the outbound exit node traffic, they can’t know which is yours. Second, and more importantly, the packet-level tracking data that your ISP puts on your traffic is rendered useless, because it’s lost at the exit node. That alone gives you more privacy than any other action. You can DNS over HTTPS all you want, but that packet tracking tells the ISP exactly where you went.

Many VPNs will support multi-hop, where the concentrator you connect to is not the same as the exit/egress point.

You might be looking for this:
https://safing.io/spn/
https://protonvpn.com/features/hide-ip (Secure Core VPN: Route your connection through Secure Core servers located in countries with strong privacy laws for an extra layer of security.)