I read wikipedia page ;but it says that we can extend over private resources publically. and user can send - receive data using public network to remote resources in perspective that it is connected to it privately.

Then, We can use ssh to transfer the data, how is different from ssh? basically, I am not getting core idea behind VPN.

  • This is too broad a question to answer here. But SSH tunneling can be used as a "poor man's" VPN. There are many more resources to read besides Wikipedia.
    – Ron Trunk
    Commented Jun 4, 2016 at 10:52
  • OK, Give me basic understanding of VPN. To understand materials. Commented Jun 4, 2016 at 10:57
  • 1
    If you search on youtube, you will get several good answers.
    – Ron Trunk
    Commented Jun 4, 2016 at 10:58

2 Answers 2


traditionally ssh is used to connect from one host onto another host securely.

a vpn connects a host to another network securely. This lets your native host access resources that might be restricted to the other network via firewall, etc. Things like printers, private databases, etc. A typical use would be to put your work laptop on the office network even when you aren't in the office.

There are lots of protocols that are used to do this tunneling - SOCKS is one of them and indeed most ssh implementations can establish a SOCKS tunnel for you, but that's not generally what people are thinking of when they ask about VPN.

  • Thanks, I seen the various things related to it. I like the concept ; but could implement the similar behavior of VPN using SSH? Commented Jun 4, 2016 at 14:04
  • Search for "SSH tunnel" to see some examples.
    – Ron Trunk
    Commented Jun 4, 2016 at 14:32
  • I wouldn't have considered socks to be a VPN protocol. socks is an application-layer thing. Commented Jun 5, 2016 at 23:51

Part 1: background

Lets say you have a head office. You build a network in your office, and connect it to the Internet via a firewall, most likely the firewall is also doing NAT. Within your network you deploy some servers. You also subscribe to various Internet services which identify your network through an IP whitelist.

But not all your users are at head office. Some are working from home, some are working from small branch offices, some are working on the road. They still need to access your companies services, how do they do it?

You could just have them access the services directly over the Internet but this has several problems.

  • The traffic may be vulnerable to sniffing or tampering as it passes through the public Internet.
  • To firewall effectively you need to know the addresses of legitimate clients. This is a big problem for clients on the move (and a problem to a lesser extent for clients working from home).
  • For IP-based subscription services you either have to whitelist a load of seperate IPs with the provider or provide some alternative means of authentication.
  • It likely means that the services will all need a dedicated IPv4 address which are kinda in short supply (it would be nice if the whole world moved to IPv6 but we aren't there yet)

You could buy private circuits from a telco but again this has problems.

  • It's expensive, for small bandwidth requirements private circuits cost considerbally more than internet connections.
  • It's not practical for those on the move.

Part 2: VPNs

A VPN solves this dilemma by creating a private network on top of a public one.

The VPN endpoint usually presents itself to the operating system as a virtual network interface. When packets are sent to this interface they are passed to the VPN software. Typically the VPN software will encrypt the packet, add it's own headers and then pass the packet back to the network stack as a payload to be sent to the other endpoint of the VPN.

The packet then passes over a network (usually the public internet) to the other end of the VPN.

When the packet reaches the other endpoint of the VPN the process is reversed. The OS receives the packet and passes it to the VPN software as a payload. The VPN software will typically validate that the packet is legitimate, decrypt it and remove the extra headers. It will then pass it back to the network stack via the virtual network interface.

Thus we effectively have a private network between the two endpoints of the VPN but the data is physically carried between the endpoints by a public network.

In addition to the simple encapsulation and deencapsulation VPN software will frequently provide other features. It will usually provide a mechanism for clients to authenticate to a server and establish a VPN session. It may provide some level of bridge or router functionality to allow a single virtual network interface on the server to serve multiple clients. It will most likely have functionality for pushing IP adresses and routing configuration to clients.

Routing on the clients may be configured to send virtually all the client's traffic down the VPN or it may be configured to only send particular traffic down the VPN. There are pros and cons to both approaches.

VPNs can operate at various network layers on both the "inside" and the "outside". On the inside a VPN may carry IP packets or it may carry Ethernet frames. On the outside a VPN may operate over a transport protocol like TCP or UDP or it may operate directly over IP,

Put all of this together we have a method of brining our remote sites and users onto our private network without needing to buy private network connections between them.

Part 3: ssh and socks

socks is a protocol for talking to proxies. It can achive some of the same goals as a VPN but operates at a higher level. Your client application makes a TCP connection to the socks proxy and then asks it to make an onward connection to the server. Once established the socks proxy passes data back and forth between the two TCP connections. If the socks proxy has access to network resources that the client can't acess directly then the client can use the proxy to access those resources.

Unlike with a VPN the client application needs to be aware of socks (though there are hacks for this). Socks does provide optional authentication but as far as I can tell unlike most VPN tools it does not provide encryption.

the fact that the client has to be aware of socks can be a pro and a con, on the one hand it limits the applicability. On the other hand it means that you can point only certain application at the socks proxy. In some cases you can even configure an application to use the socks proxy for only some connections (look up the firefox extension "foxyproxy").

ssh is primerally a tool for remote shell access to servers. It provides encryption and authentication and is generally considered to be sufficiently secure for use directly over the public internet.

While primerally intended for remote console access ssh can carry other things. It can carry application data directly between a program running on the client and a program running on the server.

One feature of ssh is port forwarding, there are three different modes, all forward connections at a TCP level. By default only connections from localhost are forwarded.

  • "local" the ssh client listens for TCP connections on a predetermined port. When it receives one it asks the server to connect to a predetermiend IP/port. Data is then forwarded between the two TCP connections over the ssh connection.

  • "remote" the ssh server listens for connections on a predetermined port. When it receives one it askes the client to connect to a predetermined IP/port. Data is then forwarded between the two TCP connections over the ssh connection.

  • "dynamic" the ssh client acts as a socks proxy server. When the socks client requests a connection to a particular IP/port the ssh client requests the ssh server to make a connection to that IP/port. Again data is forwarded over the ssh connection. This essentially gives you the features of socks with the encryption and authentication of ssh.

You can also use ssh to carry ppp (or possiblly slip) and make an actual VPN.

Not the answer you're looking for? Browse other questions tagged or ask your own question.