I've been reading how VPN service and Tor network works, and I can't understand the difference between the VPN server and Tor node.
I know that in the Tor network there are several nodes, but what would be the difference between the Tor network and network made from several VPN servers if they communicate (the first node encrypts/hides request user identity and last node decrypts traffic) same as in Tor network?
In a way you are comparing apples with trees. VPN is not a specific technology but a general concept with multiple often significantly different implementations. Tor instead is a concrete protocol.
But VPN is essentially an encrypted tunnel between two communication peers. If the clients is putting multiple encrypted tunnels inside each other (not after each other but inside) you essentially get something like Tor: you have multiple layers of encryption done by the client, the client defines which path through the VPN the data take and only the final exit node of the VPNs can see the original traffic - all others see only traffic encrypted from another VPN.
There are some significant differences though: when manually putting multiple layers of VPN inside each other one defines usually only a single path through the network. Tor instead will take care that different connections take different routes involving different exit nodes and also different intermediate nodes. This increases the level anonymity since creating an association between different flows is way harder even for an advanced attacker if all flows go a different way than if they would use all the same way through some multi-layered VPN setup. Additionally the protocol used by Tor is specifically designed to bypass deep inspection, i.e. it can mimic other protocols so it does not get blocked and it also has some protections against analysis of traffic patterns. These are all things one does not find typically in common VPN implementations.
Apart from that VPN usually work at the network layer and thus covers any IP traffic while Tor only covers TCP traffic and only for applications which are specifically designed to send the TCP traffic through something like Tor (for example by using Tor as a SOCKS proxy). Insofar Tor is from the configuration more comparable to a proxy instead of a real VPN. This kind of setup has the additional advantage that OS fingerprinting at the IP or TCP level is not possible, i.e. all what gets fingerprinted this way is the OS of the exit node.
