Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have been reading books on OpenVPN, and there is one thing I don't understand yet.

What happens when a person connects to OpenVPN, and their web browser is set to a Socks5 or HTTP/HTTPS proxy and the person browses the internet?

Specifically I am wondering if in the above scenario, the OpenVPN server only sees encrypted traffic with no way to decrypt?

I am thinking that in the case that the OpenVPN server only sees encrypted traffic with no way to decrypt then it goes something like this? For example, if the person in the above scenerio goes on stackexchange.com. First the data is encrypted on the computer by OpenVPN then sent out to the OpenVPN server. Then, assuming that the OpenVPN server only sees encrypted traffic with no way to decrypt, then that means that the server passes on the encrypted data to the Socks5 server (for example), then assuming that the Socks5 server is NOT an encrypted one like SSH Dynamic Forwarding, but instead a plain text one, the Socks5 server receives the encrypted traffic from the OpenVPN, somehow knows how to decrypt it (this is the part that confuses me if it is indeed the case that the OpenVPN server only sees encrypted traffic with no way to decrypt), and sends to stackexchange.

Now if is an encrypting proxy like a SSH Dynamic Forwarding, then does that mean the traffic is encrypted on your computer by OpenVPN, send to the OpenVPN server encrypted, then the encrypted traffic comes back to your computer, then while still encrypted, is encrypted by the SSH client on your computer and then send to SSH server, which then somehow decrypts it all to plaintext before sending to stackexchange.

Thanks in advance for any help.

Edit: In response to Lucas Kauffman, here is my attempt to make my question even more clear.

Scenario 1:

  • Bob connects to OpenVPN
  • Bob has set web browser to use Socks5 or HTTP/HTTPS proxy
  • Bob goes to stackexchange.com

In Scenario 1 does only encrypted traffic pass through the OpenVPN server (in other words, no plaintext traffic whatsoever)?

If so, would it be possible for the operator of the OpenVPN server to decrypt the traffic? Or someone that is watching the traffic to decrypt it?

In other words, does the encrypted traffic that which is passed through the OpenVPN server and on to the Socks or HTTP/HTTPS proxy contain any method or instructions on how to decrypt it?

If the answer is no, then my questions is:

Scenario 2 in which the person uses a Squid HTTP server, in other words, no encryption

My computer -> encrypted traffic to OpenVPN server -> encrypted traffic to Squid Server? -> plaintext to stackexchange.com

My question is Scenario 2, does the traffic pass through the OpenVPN server 100% encrypted with no method or instructions on how to decrypt?

If this is the case, then how does the Squid Server know how to decrypt the traffic to send plaintext to stackexchange.com?

My other question is:

Scenario 3 In which a SSH dynamic forwarding is used:

My computer -> encrypted traffic to OpenVPN server -> OpenVPN server sends it back to my computer? - SSH Client (for example, putty) send to SSH Server -> SSH server send plaintext to stackexchange.com

My question is again,does the traffic pass through the OpenVPN server 100% encrypted with no method or instructions on how to decrypt?

If that is the case, then when it does come back to my computer, does Putty somehow decrypt it to plaintext on my computer, then encrypt it again before sending to SSH server?

OR does putty do not decrypt the encrypted traffic that it gets from the OpenVPN server, it just encrypts it again before sending to SSH server, who then somehow decrypt it all to plaintext and then send to stackexchange.com?

Let me know if you want more clarification?

Edit2: Ok I read your answer, Lucas, thanks. I guess I am an idiot. I understand it now. So I guess in the case of a plaintext non encrypting proxy the traffic will go through the OpenVPN server to the proxy non encrypted? The OpenVPN server will see the content of the traffic?

Like: Client -> OpenVPN Encrypts -> Sends to OpenVPN server -> OpenVPN decrypts -> Send to Proxy -> Proxy send to Webpage

share|improve this question

closed as unclear what you're asking by NULLZ, Noordung, Lucas Kauffman, Terry Chia, Adnan Aug 9 '13 at 9:36

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Please can you re-read your question and use bullet points. You have sentences in there which make no sense at all. –  Lucas Kauffman Aug 9 '13 at 1:42

1 Answer 1

up vote 3 down vote accepted
                                                +-----------------+
                                                |                 |
    +-----------+       +----------------+      |                 |
    |           |       |                +      >                 |
    |  CLIENT   |+----->| SSH SOCKS 5    +------>  OPENVPN CLIENT |
    |           |       |                +      >                 |
    +-----------+       +----------------+      |                 |
                        ENCRYPTS TRAFFIC        |                 |
                        BEFORE ENTERING         |                 |
                        OPENVPN                 +--------+--------+
                                                         |
                                                         | SSH Tunnel encrypted in
                                                         | OPENVPN tunnel
   +---------------+    +---------------+       +--------v--------+
   |               |    |               |       |                 |
   |STACKEXCHANGE  |<---+SSH Server     <-------+ OPENVPN SERVER  |
   |               |    |               |       |                 |
   +---------------+    +---------------+       +-----------------+

                        SSH tunnel terminates    Encrypted by OPENVPN until here
                        here

If you force your browser through a SOCKS5 proxy then traffic will first be encrypted by the SOCKS proxy locally on your machine before being sent over OPENVPN. OpenVPN then sends the still encrypted tunnel to the SSH Server which then decrypts it and sends it on to Stackexchange.

share|improve this answer
    
In the case of a plaintext non encrypting proxy the traffic will go through the OpenVPN server to the proxy non encrypted? The OpenVPN server will see the content of the traffic? Like: Client -> OpenVPN Encrypts -> Sends to OpenVPN server -> OpenVPN decrypts -> Send to Proxy -> Proxy send to Webpage –  john Bishop Aug 9 '13 at 2:37
    
that would be correct –  Lucas Kauffman Aug 9 '13 at 2:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.