I am trying to understand how VPNs work. Most of the posts/blogs on the internet say that all your traffic is routed through a VPN server. This sounds like proxy to me?? Another point that is commonly said is that it is a great to prevent your ISP from snooping in your data etc etc. But that can be prevented using HTTPS right??

What benefit does VPN exactly give over HTTPS and Proxy? And how?

  • Welcome to network engineering! We hope you will learn from us and become a contributing member of our community. Unfortunately your question is too broad for this site. There are many, many sites and videos just a quick Google search away that can explain VPN operation better than we can do here.
    – Ron Trunk
    Jun 25, 2019 at 1:42
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 15, 2019 at 4:17

3 Answers 3


Unfortunately, protocols above OSI layer-4, e.g. HTTPS, are off-topic here, as are host/server configurations, and proxies are an application thing that are also generally off-topic here.

From the perspective of what is on-topic here, a VPN is really just a tunnel, most often with the payload encrypted. The idea of a tunnel is simple, you wrap the packets inside other packet headers, and the outer packet headers are what gets routed to the other end of the tunnel, where they are stripped off the inner packets. The tunnel is a virtual link, and to the inner packets the tunnel looks like a single hop. This also reduces the MTU for the inner packet, possibly requiring fragmentation to fit in the tunnel.

VPNs are often created between routers or firewalls in order to privately connect networks. On a network device, you create a virtual interface for the tunnel that uses a real interface to send the wrapped packets to the destination network device, where the packet is unwrapped and possibly decrypted. You can route packets to the virtual interface the same way that you can a real interface, and the VPN handles getting the packets to the tunnel destination.

To the networks involved, the tunnel looks like a direct link between the two networks, and that can bypass the whole problem of NAT for the inner packets, making the networks look like they are directly connected.

  • So you mean RIP, BGP, SSH, Telnet, are off-topic here?
    – Noob_Guy
    Aug 31, 2021 at 5:20
  • Those in an on-topic network device are on topic,. For Example, BGP on a Cisco router is on-topic, but a BGP implementation in your server is not.
    – Ron Maupin
    Aug 31, 2021 at 20:24

Basically, VPN uses a network tunnel in combination with encryption.

Tunneling "wraps" an actual (inner) packet into a transport (outer) packet. The outer packet takes care of transporting the inner packet - as untouched payload - from one tunnel end to the other. On exit, the outer packet is removed, the original packet is recovered and continued normally.

That way you can connect two networks across an incompatible network, no matter if it uses another numbering scheme (private vs. public) or a completely different protocol. A few years back, we used to tunnel Novell IPX across the IPv4 Internet. Also, IPX requires an additional PPTP tunnel when used with IPsec.

Encryption ensures that your virtual network connection stays private - no listening in, no tampering.

A network tunnel is implemented on the network layer. It is transparent to all protocol layers above and even to the network layer itself mostly.

In contrast, a proxy is implemented on the application layer (or sometimes the transport layer). It needs to be able to handle the application protocol and it's usually only transparent to one side of a communication.


Key thing: Business VPN is somehow different than normal-users VPN

In the past, companies wanted to connected their branches were paying loads of money to lease a line from ISP. That is, a dedicated line just connecting both ends of the branch. Nobody else is using that fibre cable, it has two ends which connects the branches. It was PRIVATE network. literally.

Now someone thought, wouldn't be great if we offer a virtual private line.? That is, no physical line exist. Company is using the same infrastructure (ISP cables and networks) as anyone else. But it is still PRIVATE by means of encryption and authentication technologies. You see, if you encrypt your traffic and authenticated it so no one but the intended people can access it. You basically created a leased line.

This is great, now companies don't have to pay for a leased line. But they get a "simulated" leased line, that is, a VPN. Much cheaper, same functionality.

As you can see, no server here. What you are talking about is something called proxy VPN. So you want to visit this blocked site in your country. What if a server outside your country visited it for you. Then create a VPN tunnel toward your PC to deliver it to you. (remember VPN works as a leased line, so hypothetically that server will have a dedicated line for you. But it is a VPN). You will be able to successful visit that site because your server provider will see you taking traffic from that server but cannot see what is inside that traffic.

Now HTTPS uses SSL which is a mean of encryption. Your ISP cannot see what exact information are sent. But it can see you are visiting youtube or some blocked website and block your access.

Please note that ISPs use means of LI (lawful inspection) in which they can inspect your traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.