Double/Chained VPN - Which IP will be vissible to the VPN providers?

Question

I am currently using a company VPN and use Juniper Network Connect on OS X to connect to this network.

I'm interested in using another VPN and set this up at my internet router at home, so all traffic from all my devices goes though this VPN.

------------         ----------         -------
| Internet |  <--->  | Router |  <--->  | Mac |
------------         ----------         -------

So the Router now will first build up VPN connection A and then the Mac will build up another VPN connection B.

Which VPN provider (A or B) will see my real IP?

I guess that VPN B which is initiated from my Mac client would see the IP of the exit node of VPN A. And VPN A would see my real IP, assigned from my ISP. Is that correct?

Answer 1

Yes, that's correct.

VPN B will see VPN A IP

VPN A will see your external IP.

Because the router will establish a connection to VPN , all packets forwarded by the router (so packets coming from his computer MAC) will be forwarded through VPN A. In order to be routable on the internet, the VPN provider will masquerade (NAT) all outgoing packets with his exit node IP. When MAC will try to reach VPN B, VPN B will see VPN A ip.

For the question :

what happens if the VPN A was down and the VPN B sends a packet to the router?

It depends but if the 2 connections are established (VPN A & VPN B), and VPN A goes down, there is a high risk that your router external IP will be disclosed to VPN B. MAC will continue to send packets to VPN B and it will not be masqueraded by A as VPN A is down.

Your connection to VPN B will also have a chance to go down as for VPN B, your IP has changed. It's now receiving packets from your router IP and not from VPN A. If you want to be sure that you will never disclose your router IP, you will need to add firewall rules on your router.