2

It seems to be common knowledge that a VPN has the potential to protect data that is being transferred through an insecure network. Does a VPN also protect a secure network/router from malicious website data being sent to a device using that network with a VPN? I am new to this site so please forgive any mistakes or issues and just let me know. Thanks

Improve this question

2 Answers 2

Reset to default
3

No.

A VPN provides an encrypted tunnel between an initial device A and a server B where the data is decrypted and processed, for example by forwarding onto a requested server C. Responses from C are sent back to B, encrypted, and sent to A. This means a man in the middle, M, can't determine what A is sending to C in a scenario where all of A's traffic goes through M.

HTTPS does something similar - A could talk to C directly, and M would only see encrypted traffic. If C only serves data via an unencrypted connection however, such as HTTP, M would see all the raw data. This latter scenario is what VPNs are useful for.

In any scenario though, B does not (ordinarily) do anything to the content sent back to A. In this sense it's 'dumb'. If the connection between A and C is ordinarily not encrypted, then B could potentially perform packet inspection and check for known exploit code etc., but in practice this is impractical most of the time.

Improve this answer
1

what you are talking about is called "reverse tunnelling". It does work (sort of) and used to be used to transfer traffic between low security networks across a higher security bearer. The basic concept being that the payload traffic is encapsulated (by a device to the same security standard as the higher security bearer) and then broken out at the other boundary. As the traffic is 'random junk' while it is transiting the high security network, it cannot impact any device that processes it. This is still used by some military networks.

However, there are detailed attacks against reverse tunnelling which are different to the attacks against VPNs - the crypto boxes used by the couple of military networks that I am aware took a long time to get right. Coupled with the wide availability of low trust networks nowadays (ie the internet) the investment in these techniques has been limited to specialist applications.

Improve this answer
7
  • Not sure how a reverse tunnel (and I can't imagine trying to set up a VPN to do it, although it's reasonably common with regards SSH) would help protect a user from a malicious payload from somewhere else like a website
    – LTPCGO
    Commented Sep 17, 2019 at 10:58
  • I can't see how it would - but it would protect the network being tunnelled through from being exposed to the malware.
    – mwapemble
    Commented Sep 17, 2019 at 14:30
  • Just to clarify, a VPN cannot protect an intermediary wifi router?
    – user217807
    Commented Sep 17, 2019 at 15:07
  • @seth from what? An intermediate router would just see encrypted traffic. See my answer.
    – LTPCGO
    Commented Sep 17, 2019 at 17:30
  • 1
    @Seth in a scenario where a specially crafted TCP packet could attack a router, then yes a VPN would protect it, as the packet would not be seen in its original form by the router.
    – LTPCGO
    Commented Sep 17, 2019 at 19:31

You must log in to answer this question.