I have seen cases where people install a VPN app on their phones to circumvent governments which bar access to certain websites (I have heard China is an example of this).
I am curious how these apps work without requiring the user to do any serious configurations. If we have two segments of the communication as follows:
(1) SENDER (having VPN app) --> (2) SERVER (whose address is by default configured in VPN app) -->(3) RECEIVER (the server which the government is censuring).
Question #1: Is it correct to say that only the segment (1)-->(2) is encrypted? If this is correct, then this would mean the app protects against censorship by the government, but does not guarantee total confidentiality since the data goes encrypted in the last part of the transaction (i.e., (2)-->(3)).
Question #2: At what layer of the network stack is encryption done? Is it at IP? If yes, this would mean some changes to the O/S configurations. Ideas on what these are?