If I'm the owner of VPN network, what can my ISP see?

Question

I'm planning to build small VPN network, so that me and my customers can connect and use it. But from my understanding, if I use my own VPN network, still my ISP can see the traffic, am I right?

Here is a simple diagram, what I have in my mind:

To protect myself (against MITM) while I'm connected to public WiFi, this is more reasonable.

But my concern here is ISP, if they are able to see all of my traffic, then I have to search for another solution. (for example using VPN from another provider will solve that problem).

Answer 1

Yes, this ISP can see your traffic, asssuming other protocols (HTTPS, etc) do not prevent them from doing so.

You've got two aspects to the connection.

1. Client <---> VPN Endpoint
2. VPN Endpoint <---> Internet

For (1), assuming it has been setup correctly, no one will be able to see anything outside of encrypted traffic. This is true whether you're using public wifi, a home lan, whatever.

For (2), the VPN endpoint must request information for it's clients in the clear. This means whatever ISP the VPN endpoint is on can monitor the connection (again, to the extent permissible by the underlying protocols).

If you have your VPN endpoint on your own infrastructure at home, as it seems like you're asking, you'll be requesting information on the clients behalf. The VPN offers no protection, unless your away from home, in which case it will protect your information as it's sent home, but not as your home forwards the request.

Using an external VPN provider pushes the problem further down the line. If you have some reason to particularly distrust your ISP it may be handy, but don't forget the third party providers ISP can monitor requests, just like your own ISP can.

Answer 2

The ISP sees everything as it is, the connection is only safe between you and the VPN. As you mentioned, this VPN allows you to browse on insecure networks, public wifi hotspots with safety, defends against eavesdropping and MITM, so still good to have.

There are no other solutions. If you try to communicate with a website with or without VPN that only supports HTTP, the transferred data will still be unencrypted. It's the matter of between who.

Answer 3

Forgive me trying to boil down your question. You seem to be asking the following. If I ask a friend to pass a message to another friend for me, will the first friend see that I am passing a message?

The answer is yes, of course, you asked them to deliver it for you. In this case the friend that is delivering your message is your ISP as a business associate. If you ask the ISP to deliver a message, you must also give them permission to know that there is a message to deliver.

Can the friend that passes the message see the contents of the message? No, if the message is encrypted carefully, the friend that acts as a deliverer will not read the message contents. The same is true for your ISP, as your business associate, if they deliver an encrypted message for you.

Can I find another ISP that will be ignorant of my traffic? No. If you pay your ISP to deliver messages for you, then they have to know when there is a message to deliver. It is impossible to make the situation more secure.

If you wish, you can run your own ISP so that you are delivering your own messages without someone else seeing them. However, Internet routing works such that you will still ask some other server to deliver the message for you to its destination.