I have seen cases where people install a VPN app on their phones to circumvent governments which bar access to certain websites (I have heard China is an example of this).

I am curious how these apps work without requiring the user to do any serious configurations. If we have two segments of the communication as follows:

(1) SENDER (having VPN app) --> (2) SERVER (whose address is by default configured in VPN app) -->(3) RECEIVER (the server which the government is censuring).

Question #1: Is it correct to say that only the segment (1)-->(2) is encrypted? If this is correct, then this would mean the app protects against censorship by the government, but does not guarantee total confidentiality since the data goes encrypted in the last part of the transaction (i.e., (2)-->(3)).

Question #2: At what layer of the network stack is encryption done? Is it at IP? If yes, this would mean some changes to the O/S configurations. Ideas on what these are?


1) Depends. The VPN itself indeed only encrypts from 1 to 2, however, if 3 (The website you're visiting) supports TLS/HTTPS, 2 -> 3 is also encrypted and secured, only not by the VPN.


1 = user
2 = vpn
3 = web-server

Without TLS:
1 ---[VPNencryption(plain_text)] -----> 2 ---[plain_text] ----> 3
With TLS:
1 ---[VPNencryption(tls((plain_text))] -----> 2 ---[tls(plain_text)] ----> 3

2) VPNs mostly make use of tunneling protocols. One of their features is that they can e.g encrypt data, or use a specific protocol that the underlying or standard network does not necessarily support. So you don't always need to edit network-configurations or anything similar. And it's mostly the Link Layer.

  • Did you say link layer? I thought IPSEC ( a network layer protocol) was most common for VPN.
    – Minaj
    Jul 18 '16 at 1:12
  • That could be used as well IMHO. However, PPP, PPTP,... Are also used a lot and are in the Link Layer.
    – O'Niel
    Jul 18 '16 at 10:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.