1

I am trying to understand how VPNs work. Most of the posts/blogs on the internet say that all your traffic is routed through a VPN server. This sounds like proxy to me?? Another point that is commonly said is that it is a great to prevent your ISP from snooping in your data etc etc. But that can be prevented using HTTPS right??

What benefit does VPN exactly give over HTTPS and Proxy? And how?

  • Welcome to network engineering! We hope you will learn from us and become a contributing member of our community. Unfortunately your question is too broad for this site. There are many, many sites and videos just a quick Google search away that can explain VPN operation better than we can do here. – Ron Trunk Jun 25 '19 at 1:42
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 15 '19 at 4:17
4

Unfortunately, protocols above OSI layer-4, e.g. HTTPS, are off-topic here, as are host/server configurations, and proxies are an application thing that are also generally off-topic here.

From the perspective of what is on-topic here, a VPN is really just a tunnel, most often with the payload encrypted. The idea of a tunnel is simple, you wrap the packets inside other packet headers, and the outer packet headers are what gets routed to the other end of the tunnel, where they are stripped off the inner packets. The tunnel is a virtual link, and to the inner packets the tunnel looks like a single hop. This also reduces the MTU for the inner packet, possibly requiring fragmentation to fit in the tunnel.

VPNs are often created between routers or firewalls in order to privately connect networks. On a network device, you create a virtual interface for the tunnel that uses a real interface to send the wrapped packets to the destination network device, where the packet is unwrapped and possibly decrypted. You can route packets to the virtual interface the same way that you can a real interface, and the VPN handles getting the packets to the tunnel destination.

To the networks involved, the tunnel looks like a direct link between the two networks, and that can bypass the whole problem of NAT for the inner packets, making the networks look like they are directly connected.

|improve this answer|||||
1

Key thing: Business VPN is somehow different than normal-users VPN

In the past, companies wanted to connected their branches were paying loads of money to lease a line from ISP. That is, a dedicated line just connecting both ends of the branch. Nobody else is using that fibre cable, it has two ends which connects the branches. It was PRIVATE network. literally.

Now someone thought, wouldn't be great if we offer a virtual private line.? That is, no physical line exist. Company is using the same infrastructure (ISP cables and networks) as anyone else. But it is still PRIVATE by means of encryption and authentication technologies. You see, if you encrypt your traffic and authenticated it so no one but the intended people can access it. You basically created a leased line.

This is great, now companies don't have to pay for a leased line. But they get a "simulated" leased line, that is, a VPN. Much cheaper, same functionality.

As you can see, no server here. What you are talking about is something called proxy VPN. So you want to visit this blocked site in your country. What if a server outside your country visited it for you. Then create a VPN tunnel toward your PC to deliver it to you. (remember VPN works as a leased line, so hypothetically that server will have a dedicated line for you. But it is a VPN). You will be able to successful visit that site because your server provider will see you taking traffic from that server but cannot see what is inside that traffic.

Now HTTPS uses SSL which is a mean of encryption. Your ISP cannot see what exact information are sent. But it can see you are visiting youtube or some blocked website and block your access.

Please note that ISPs use means of LI (lawful inspection) in which they can inspect your traffic.

|improve this answer|||||
0

Basically, VPN uses a network tunnel in combination with encryption.

Tunneling "wraps" an actual (inner) packet into a transport (outer) packet. The outer packet takes care of transporting the inner packet - as untouched payload - from one tunnel end to the the other. On exit, the outer packet is removed and the original packet is recovered and continued normally.

That way you can connect two networks across an incompatible network, no matter if it uses another numbering scheme (private vs. public) or a completely different protocol. A few years back, we used to tunnel Novell IPX across the IPv4 Internet.

Encryption ensures that your virtual network connection stays private - no listening in, no tampering.

A network tunnel is implemented on the network layer. It is transparent to all protocol layers above and even to the network layer itself mostly.

In contrast, a proxy is implemented on the application layer (or sometimes the transport layer). It needs to be able to handle the application protocol and it's usually only transparent to one side of a communication.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.