0

The innermost IP header is my publicly routable IP address that has been encapsulated. The outermost IP header is what is used for routing purposes.

When using a public VPN over the internet, the outermost IP header would be that off the VPN provider. The innermost IP header remains intact till it hits the destination, the server. This means that the actual identity of the source is never concealed from the end device. Is that right?

  • What happens when you Google "my IP" while on a public VPN vs. without? – multithr3at3d May 19 '18 at 6:54
  • Right, I see what you are getting to. When you do a "my ip" after connecting to the VPN provider, you will see the IP address allocated by them. To conclude: The VPN providers strip off the original IP header and add their own IP header? – Juergen May 19 '18 at 7:24
  • All that is happening in this case is NAT, specifically source NAT. The header is not stripped off but parts are rewritten. – multithr3at3d May 19 '18 at 13:46
  • Ok, you're extremely vague with your rhetorical questions or a two line explanation. I'm going to wait for someone else to elaborate and help me understand. Thanks for participating. – Juergen May 20 '18 at 5:32
1

My comments may have been terse and vague because the reasoning behind this subject depends on an understanding of networking concepts as well as how VPNs behave. So here's the long version.

The innermost IP header is my publicly routable IP address that has been encapsulated. The outermost IP header is what is used for routing purposes.

False (you can confirm this with Wireshark). This simply won't work, and we'll see why later.

When you start up a VPN client or server, a special interface is added to your system. On a *nix system, this will typically be called tun0 (assuming a TUN VPN, and where additional TUN devices follow the scheme tunN). This special interface is used for communicating over the VPN, and by default (for OpenVPN) is assigned addresses in the 10.8.0.0/8 range. For public, "privacy-providing" VPNs, they will also typically set your computer's default route to use the OpenVPN server on this interface, which is also in 10.8.0.0/8. If this is the case, all of your outbound traffic will have a source address in 10.8.0.0/8 and will be sent to the tun0 interface. The VPN client will then send the encapsulated traffic over your regular network interface to the VPN server.

This is what both IP headers would look like for a theoretical packet:

Outer Header: SRC=<YOUR_PUBLIC_IP> DST=<VPN_SERVER_IP>
Inner Header: SRC=<YOUR_VPN_CLIENT_IP> DST=<WHATEVER_YOU_ARE_ACCESSING>

The VPN server acts as a router. Once it receives your packet, it will route it depending on its destination address and the server's routing table. If this VPN serves a corporate network and static routes already exist on other routers back to the VPN range, the work is done here.

However, in the case of a public "privacy-providing" VPN, an RFC 1918 source address such as 10.8.0.0/8 cannot be routed back to across the internet, and thus can not be preserved all the way to the destination server. Instead, the VPN server or another router in their network must perform source NAT to rewrite the source address with the VPN provider's public IP address, so that the return traffic will come back to them. A connection tracking table records the original source address and port so that it will make it back to your client machine through the VPN.


While that was long and convoluted, it means that the answer to the following is "no".

This means that the actual identity of the source is never concealed from the end device. Is that right?

When in doubt with these sorts of things, I highly suggest opening up a tool (e.g. Wireshark) to see how things are actually working.

  • It was an assumption on your part that I lack knowledge of networking concepts. I might not know it all, but I'm learning, and that's one of the reasons I posted the question here. To learn more. Anyways, thank you for the answer. It makes total sense now. The part I wasn't aware of was that a tunnel interface would be created and would be assigned a private IP address along with a default route pointing out the VPN server. NAT is simply performed on the VPN server to their public IP. Thank you once again. – Juergen May 21 '18 at 5:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.