0

I have 3 questions about a VPN and especially a VPN Router:

1) I know exactly what a VPN is and what wifi encryption (wpa/wpa2 etc.) is, but what I can't seem to understand is if a VPN Router will add more encryption on the wifi via a secured & encrypted private tunnel etc. If indeed that's the case so how does the mobile device "knows" to "talk VPN and AES-256 encryption"? It would have to have a VPN also installed on itself, right? From the router to the outside world it's obvious - it gets encrypted and sent through a secured tunnel to the VPN server(s).

2) When a device (PC, Mac, Mobile phone etc.) sends a request to the Internet through a VPN Server we all know what happens - on both ways - from our device to the destination we asked and back to us. BUT, what happens when you send something that is an account based app or service? Example: You send a WhatsApp message via VPN installed on your phone. Your message will be encrypted by the VPN (upon WhatsApp built-in encryption) and sent through a secured tunnel to the VPN server(s). The data is then decrypted and sent to the actual WhatsApp servers. So far so good. But what happens on the way back? According to my knowledge as an App Developer, WhatsApp servers will send the response through GCM/Push message or even their own Push-Messaging service but they will send it to my actual mobile device IP. Both Android & iPhone keep an open channel with Google/Apple and tell them the location and your IP for fast & power efficient push messaging. Also, when no internet connection available, Google/Apple will store all your messages/data and send it to you when possible, not caring, using and even knowing about your VPN. So all these messages and data from service providers like Google, WhatsApp and Facebook will actually send the data to my fake IP (VPN) and the VPN server will deliver it back to me?

3) I addition to question #2 - Is that possible for the OS itself (Windows, iOS or Android) to get my real IP even if I use a VPN? Cause if it so then a VPN will be useless for services like I mentioned in question #2.

Thank you,

1

what I can't seem to understand is if a VPN Router will add more encryption on the wifi via a secured & encrypted private tunnel etc. If indeed that's the case so how does the mobile device "knows" to "talk VPN and AES-256 encryption"? It would have to have a VPN also installed on itself, right? From the router to the outside world it's obvious - it gets encrypted and sent through a secured tunnel to the VPN server(s).

In order to use an end-to-end VPN (TLS VPN) you need a VPN client on your device and the encrypted tunnel goes from your device to the VPN provider. IPSec VPNs are different, because they are gateway-to-gateway, so it's actually the router which does the encryption, but IPSec VPNs are used for different applications than yours. In SSL/TLS VPNs the router doesn't do any encryption.

So yes, the mobile device must know to "talk VPN and AES-256 encryption". It does so by using some kind of client, which can be built-in in your OS or not.

what happens on the way back? According to my knowledge as an App Developer, WhatsApp servers will send the response through GCM/Push message or even their own Push-Messaging service but they will send it to my actual mobile device IP. Both Android & iPhone keep an open channel with Google/Apple and tell them the location and your IP for fast & power efficient push messaging

To be honest, I've never tried using Whatsapp over VPN. However, any message arriving to a server through a VPN provider contains as source address that of the VPN provider server (this is why when you go on any "what is my ip" website while on a VPN, you get the IP address of the VPN provider). The server (in this case, WhatsApp server) reads that address and replies back to that. VPN tunnels are not negotiated by anybody except by VPN endpoints.

Yes, some applications may not accept VPNs for whatever reason - they can do so because they recognize that an incoming packet has a source address belonging to a known VPN provider - but no application that I know of uses another IP address than the one contained in the "source address" field of the received packet.

While theoretically possible, it would break several fundamental principles of the Internet, besides being nasty by itself. Google can be nasty in some ways, but doing the equivalent of

You're telling me to send you stuff at this address.... but I know where you really are, so I'm going to send everything there! You can't hide from me MUAHAHA

is probably way beyond Google/Apple/... levels.

0

Yeah I just realised today that it actually doesn't matter not Google nor Apple would know my real IP because the entire idea behind the VPN is to take control on your network's infrastructure and mask your IP (combined with encryption). Therefore all the notifications, updates etc. will be sent to the VPN server which in turn will deliver it to me. So questions #2-3 are not relevant anymore.

About question #1 - The VPN secured tunnel and all the encryption happens at the VPN gate/point/device/app, meaning that if I have a VPN installed only on my router then "VPN stuff" will happen only from the router > VPN server(s). All the devices connected to the router will speak to it in a regular wifi encryption such as WPA,WPA2,WES etc. If we want VPN & encryption all the way (almost) from end-point (device) to semi-end-point (VPN server) then we have to install a VPN client on the actual individual devices as well, so it won't be compromise even by a hacker sitting besides you with a wifi antenna trying to pick up packets on the air LOL.

From the final VPN server on the VPN route, it would decrypt the information of course before sending it to the destination, otherwise this data is unreadable and useless.

Thank you anyway for your reply, I enjoyed reading it.

Cheers,

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.