I have been reading books on OpenVPN, and there is one thing I don't understand yet.
What happens when a person connects to OpenVPN, and their web browser is set to a Socks5 or HTTP/HTTPS proxy and the person browses the internet?
Specifically I am wondering if in the above scenario, the OpenVPN server only sees encrypted traffic with no way to decrypt?
I am thinking that in the case that the OpenVPN server only sees encrypted traffic with no way to decrypt then it goes something like this? For example, if the person in the above scenerio goes on stackexchange.com. First the data is encrypted on the computer by OpenVPN then sent out to the OpenVPN server. Then, assuming that the OpenVPN server only sees encrypted traffic with no way to decrypt, then that means that the server passes on the encrypted data to the Socks5 server (for example), then assuming that the Socks5 server is NOT an encrypted one like SSH Dynamic Forwarding, but instead a plain text one, the Socks5 server receives the encrypted traffic from the OpenVPN, somehow knows how to decrypt it (this is the part that confuses me if it is indeed the case that the OpenVPN server only sees encrypted traffic with no way to decrypt), and sends to stackexchange.
Now if is an encrypting proxy like a SSH Dynamic Forwarding, then does that mean the traffic is encrypted on your computer by OpenVPN, send to the OpenVPN server encrypted, then the encrypted traffic comes back to your computer, then while still encrypted, is encrypted by the SSH client on your computer and then send to SSH server, which then somehow decrypts it all to plaintext before sending to stackexchange.
Thanks in advance for any help.
Edit: In response to Lucas Kauffman, here is my attempt to make my question even more clear.
- Bob connects to OpenVPN
- Bob has set web browser to use Socks5 or HTTP/HTTPS proxy
- Bob goes to stackexchange.com
In Scenario 1 does only encrypted traffic pass through the OpenVPN server (in other words, no plaintext traffic whatsoever)?
If so, would it be possible for the operator of the OpenVPN server to decrypt the traffic? Or someone that is watching the traffic to decrypt it?
In other words, does the encrypted traffic that which is passed through the OpenVPN server and on to the Socks or HTTP/HTTPS proxy contain any method or instructions on how to decrypt it?
If the answer is no, then my questions is:
Scenario 2 in which the person uses a Squid HTTP server, in other words, no encryption
My computer -> encrypted traffic to OpenVPN server -> encrypted traffic to Squid Server? -> plaintext to stackexchange.com
My question is Scenario 2, does the traffic pass through the OpenVPN server 100% encrypted with no method or instructions on how to decrypt?
If this is the case, then how does the Squid Server know how to decrypt the traffic to send plaintext to stackexchange.com?
My other question is:
Scenario 3 In which a SSH dynamic forwarding is used:
My computer -> encrypted traffic to OpenVPN server -> OpenVPN server sends it back to my computer? - SSH Client (for example, putty) send to SSH Server -> SSH server send plaintext to stackexchange.com
My question is again,does the traffic pass through the OpenVPN server 100% encrypted with no method or instructions on how to decrypt?
If that is the case, then when it does come back to my computer, does Putty somehow decrypt it to plaintext on my computer, then encrypt it again before sending to SSH server?
OR does putty do not decrypt the encrypted traffic that it gets from the OpenVPN server, it just encrypts it again before sending to SSH server, who then somehow decrypt it all to plaintext and then send to stackexchange.com?
Let me know if you want more clarification?
Edit2: Ok I read your answer, Lucas, thanks. I guess I am an idiot. I understand it now. So I guess in the case of a plaintext non encrypting proxy the traffic will go through the OpenVPN server to the proxy non encrypted? The OpenVPN server will see the content of the traffic?
Like: Client -> OpenVPN Encrypts -> Sends to OpenVPN server -> OpenVPN decrypts -> Send to Proxy -> Proxy send to Webpage