3

More specifically, I would like to host VPN server on my own hardware, without relying on third party providers. There are plenty of guides how to realize it on internet, but they all assume that this solution focus on security, not anonymity, because at the end of the day all traffic goes unencrypted to ISP, which makes whole idea pointless for my needs (security without privacy sounds pretty dumb, doesn't it?)

Is there any possibility to encrypt own server it so ISP would only see IP and metadata related with?

Please correct me if I am wrong.

  • 1
    "...all traffic goes unencrypted to ISP..." - That's wrong. If you have a VPN server on the internet and your VPN client software running at your local machine than the ISP can only see the encrypted traffic from your system to the VPN server. Only the traffic leaving the VPN tunnel at the VPN server is no longer encrypted. – Steffen Ullrich Jul 29 '16 at 20:18
  • 1
    I'd suggest you either use the default "VPN to your server" solution, buy VPN credentials from a VPN provider or use Tor. Security and anonymity increase from left to right in the things I mentioned. – Dodekeract Jul 29 '16 at 20:27
  • 1
    @ThatCuriousGuy: If you have the VPN server at home, that would mean that all traffic between the VPN server and the Internet would go through your ISP unencrypted. That is as efficient as locking your trash can but leaving the front door open. – Julie Pelletier Jul 29 '16 at 21:27
  • 1
    @ThatCuriousGuy: the lifehacker article talks about a setup where you are in an external network (not at home) and want to protect your traffic, but you trust your ISP at home. If you are interested in such a setup you should have added this information to your question. In any case: a VPN protects the connection between the VPN client and the VPN server and not the connection between VPN server and target of the connection. Thus if you don't trust your ISP your VPN server can not be at home because your ISP is between your VPN server at home and the target server. – Steffen Ullrich Jul 29 '16 at 22:00
  • 1
    @ThatCuriousGuy: it is not clear what you consider "..relying on third party providers.". But you could rent a VPS or even dedicated hardware outside and setup your own VPN endpoint there. But this might cost more money than paying a commercial VPN provider though. – Steffen Ullrich Jul 29 '16 at 22:04
7

TL;DR: The answer to your question is no, but you're asking the wrong question.

I think you might be a little confused about how Internet servers (including VPN servers) operate. Your ISP can read any traffic leaving your local network, and it can understand that traffic if the traffic is not encrypted. Whether the traffic is encrypted primarily depends on who you're communicating with. If you're communicating with a TLS server (such as an HTTPS web site), it's encrypted. If you're communicating with an SSH server, it's encrypted. If you're communicating with a VPN server, it's encrypted.

However, if the server then makes a further request (i.e. now acts as a client, or proxy) out to the Internet (for example, a VPN server going to fetch a page that you requested via the VPN connection), that server's ISP will see the connection (and be able to understand it, if it isn't encrypted). If your VPN server's ISP and your ISP are the same thing, then that doesn't achieve much. If they're on the same local network (i.e. they access that same ISP through the same connection) then it doesn't achieve anything at all!

If you want your communications to be private, you need to only communicate with third-parties (usually servers, since you're usually acting as a client and initiating the requests) that support encryption. You can also use end-to-end encryption between two clients (for example, secure messaging apps like Signal or email encrypted with PGP or S/MIME). If you want to communicate with a third party that doesn't support encryption, then your communication will need to be un-encrypted at least part of the way!

Now, if you're only concerned about your ISP, and not about anything else, then you only need the connection to be encrypted between your local network (realistically, it'll start at your PC) and some other computer. This is where @Dodekeract's suggestion to use a third-party VPN provider, or to use TOR, comes in. With a VPN provider, your communications between your PC and the VPN provider are encrypted - your ISP can't read them, even to know where the traffic is supposed to eventually end up - though the communications between the VPN provider and the end target may still not be encrypted (depends whether the end target supports encryption). With TOR, your communications basically get bounced around a lot, all encrypted, so your ISP not only can't tell what you're saying, they can't even tell where the message will be routed from after it leaves the encrypted channel.

Hope that clears things up.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.