0

I know the basics of how a vpn works, but what I cannot get it is why if my computer is connected to a company via VPN, why my computer experience like if it was physically there in the company. I know that in reality this is not like that, but I cannot connect all of these pieces together. I would appreciate a well explained answer without copy/paste from other pages, I would really understand it. Thanks you in advance.

  • 1
    Please explain in more detail your understanding of a VPN and what experiences don't fit into that. Because either you don't really understand the basics of VPN or you mean something with "like if it was physically there in the company" which does not fit into the description of a VPN. A real VPN is like a network cable, i.e. it connects you to the systems in the "other" network. Only it is not a real cable but a virtual one. Note that some products are called VPN even though they miss the [N]etwork part and work only for selected protocols like web surfing. – Steffen Ullrich May 24 '18 at 17:42
  • I know that if you have a vpn client in your laptop, the traffic you send is going to be encrypted by your VPN client.Once this arrives at the gateway vpn in the company, it decrypts it and send it to the destination host inside the network, and when this computer of the company response, the vpn gateway does the reverse process, encrypt it and send it. So what I want to know is why is like there was a network cable between me and the company, because it is a tunnel and nobody in the public internet can see what I am sending or what – victor26567 May 24 '18 at 17:53
  • 1
    I'm surprised none of the answers have pointed this out. Just look into NAT and that will explain it. – forest May 25 '18 at 2:22
  • what do you mean by NAT? Network Address Translation? I dont get it – victor26567 May 25 '18 at 8:52
1

It all depends on encapsulation and your point of reference. Your understanding of a VPN is correct, but you are missing one technical aspect. Once a VPN tunnel is created, you can send connections through that one and it acts like you're right there. In most corporate VPN setups, the software used actually creates a virtual network adapter, that the operating system can use to communicate (much like "Ethernet" or "Wireless LAN", but instead would be called "VPN Adapter"). When your OS attempts to communicate over the network, it'll route your traffic through the VPN adapter which, because it's a "tunnel", shoots straight into your company's network and then goes from that point of reference.

The way this all works is through encapsulation. The layers of protocols for networking allow for encapsulating data at different levels. Ethernet protocol encapsulates IP, IP encapsulates TCP, TCP encapsulates your VPN data, which in turn encapsulates whatever other data it needs to send. When a network communication is sent through the VPN virtual adapter, the traffic is the normal Ethernet[IP[TCP[HTTP]]] encapsulation scheme, but then gets additional encapsulation as it is sent over the VPN, resulting in Ethernet[IP[TCP[VPN[Ethernet[IP[TCP[HTTP]]]]]]].

  • thanks for your answer too, but Im more focused now that I understand more thanks to you, the part of the abstraction that the OS does to the computer, acting like if I were on the same network. I would appreciate if you know some website that explains specifically this exactly I would appreciate it a lot. Not websites that explains vpn, those I read it many times – victor26567 May 24 '18 at 23:11
1

It actually isn't like there being a network cable at all, but you might get that illusion because you're conflating the physical connection with a logical one.

You might be surprised, but when the internet first came out, its purpose was to route everyone to everyone, just like they were all on one big network. Nodes called "gateways" connected groups of computers onto the larger network backbones, and eventually all the way to the internet. This let everyone talk to everyone.

Of course, this is now known to be undesirable, for privacy and security reasons. To combat this, we added firewalls. Firewalls were gateways which were designed to filter traffic, forbidding the traffic to pass.

Modern corporate networks are designed around the assumption that there is one main firewall between the corporate network and the internet. Computers "behind" the firewall are assumed to be more trustworthy. This includes computers which have a physical network wire connecting it into the network, which is why you mentally associate the network cable with unfettered access to the logical network of your corporation.

VPNs bring back some of the freedom of the old days before firewalls. At your corporate office, your IT staff have a computer that is authorized to act as a gateway, behind the firewall. Computers can use it to route their traffic onto the network with the same level of freedom as computers that were physically tied into it. This computer then has VPN software that accepts connections from the internet (the firewall is configured to let these through).

When you connect to the VPN computer using your laptop, you get authenticated by the VPN. Once it's confident that you are a trusted user (theoretically with trusted hardware), it offers to "tunnel" data for you. You are given an address on the corporate intranet, and when your computer tries to send data from that address to another computer on the network, your VPN adapter packages it up and sends it (over the internet) to the VPN host computer (behind the firewall). That computer then unpackages the data you wanted to send, and broadcasts it to the network as-if it were a gateway and your computer was physically hooked up to it. When data is returned from the corporate netowrk to your address, it gets sent through the gateway, which repackages it, sends it over the internet, and your VPN adapter unpackages it and presents it to the rest of the computer as-if it came directly from the network.

The only remaining piece of the puzzle is that that tunneled data is encrypted. That way nobody looking at the traffic over the internet can determine what you're sending. They can generally see how many bytes you are sending. Usually that's not a big deal, but every now and then it matters. If you are known to download several large videos before making a surprise announcement that affects stock prices, your bandwidth usage may leak the fact that you're about to make a surprise announcement (though they wouldn't get to know what the announcement was)

1

Routes.

Your computer has a route table.

When you are on a network, that network uses non-internet-ips like 10.1.2.3. When you are on the internet, you cannot route to internal network IPs like 10.1.2.3.

The VPN creates an encrypted connection between your computer and the remote network. It can be as simple as an HTTPS connection.

Your VPN client sets routes on your computer that tells your computer "Hey, if you want to send info to 10.1.2.4, you can pass that info to me, and I'll get it there."

So now say you open a web page, http://10.1.2.4/. Your Operating System sees a web request for 10.1.2.4, looks at the route table, and passes the request to the VPN client. The VPN client wraps the request up in security voodoo dust, sends it over the TLS link, and on the other end the VPN server erases all the security voodoo dust and drops the web request on the internal network. Then the internal network gets the request to the internal server, and the response flows back to the VPN server, dust on, dust off, back to the OS, and back to the browser.

Obviously a lot of details missing, but your Operating System (and all the applications) don't know they aren't on the same network as 10.1.2.4 because the VPN makes it seem like they are on the same network. It's virtual.

  • wow, your answer clear me a lot, but I still dont get it the fact that OS does not know that they aren't on the same network. I understand all the process that you explained before, but that not. Your pc looks in the route table ok, and decides that the packet is has to be sent viia vpn adapter, because route table say so, but I am missing something, why OS does not know they are not on the same network? I mean, if we consider that, your computer even when you don't have an vpn, doesn't know if the traffic you send to some destination, it doesn't know if you are on the same net that destinatio – victor26567 May 24 '18 at 23:09
  • It’s the routes. The os only knows about tcp/ip and what to do with an ip packet. Once the vpn client grabs the request it shoved it to another ip, the public ip, and that ip has a different route to use the default route. So the vpn client grabs the packet, encapsulates and encrypts it, sends it back to the os with the new destination - the public address. – Jonathan May 24 '18 at 23:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.