How exactly do VPNs bypass monitoring of the requests and traffic? I get that the traffic is encrypted, but how do VPNs manage to hide the DNS requests before establishing an encrypted transfer?

If a VPN is also using an ISP, how exactly does it tunnel underneath everything?

Is there not an endpoint that breaks out of the tunnel to make the visible DNS requests?


After a secure VPN tunnel has been established, any traffic sent through the tunnel will be encrypted between the client and the VPN endpoint (or between the two VPN endpoints in a site-to-site configuration). This will usually include DNS requests and any other Internet-bound traffic.

(N.b. I'm assuming, for the purposes of this question, that we are talking about VPN tunnels that capture all Internet-bound traffic from a machine. Most VPNs used for privacy reasons meet this criteria I think.)

However, connections are only protected by the VPN until they reach the endpoint. At this point they are decrypted back to whatever protocol they use (possibly also encrypted), and sent to the actual destination server.

         /------ VPN -------\
 CLIENT <------ HTTPS -------> VPN ENDPOINT <----- HTTPS -----> SERVER

In this example, the connection itself is HTTPS and is therefore encrypted even after it has passed through the VPN endpoint. However, any cleartext protocols like HTTP and DNS will not be secure beyond this point.

Using a VPN for privacy reasons is therefore best when trying to evade monitoring from local network sniffing, your corporate IT department, insecure wireless networks, or from your OWN ISP. They may also be leveraged for anonymity from the destination server, although TOR might be more robust for these purposes.

The VPN endpoint's ISP can technically monitor all of these connections, and this is why using encrypted protocols (HTTPS, FTPS, SSH, etc) is still important on a VPN. But they're much more difficult (not always impossible) to trace back to you.

If this secondary ISP monitoring is a particular concern, again, you might find TOR to be more suitable for maintaining privacy.

Before the VPN tunnel has been established, nothing is inherently encrypted (although you might, of course, be talking to TLS-wrapped services anyway). Therefore, if you configure your VPN client to connect to myvpn.example.com, this DNS request will go out in the clear. Furthermore, regardless of DNS, a monitoring 3rd party can always identify the IP address of the VPN endpoint that you are connected to, and may therefore be able to deduce that you are using a VPN. However, they can only see which address the messages are going to (the VPN endpoint) - they can't see the contents of the messages, or their ultimate destination.

  • Thanks. What I mean is that a VPN is also using an ISP, so how exactly does it tunnel underneath everything? Is there not an endpoint that breaks out of the tunnel to make the visible DNS requests? – system Oct 10 '15 at 13:53
  • @Helium3 Thanks for clarifying and adding to your question. I've expanded my answer. – itscooper Oct 10 '15 at 18:06
  • 2
    @Helium3 The VPN endpoint will of course make DNS requests. But these DNS requests will appear to originate from the VPN endpoint itself. That means when many users use the same VPN endpoint, an eavesdropper can not detect which DNS request was made on behalf or which user. – Philipp Oct 10 '15 at 18:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.