How do VPN providers exactly encrypt traffic from client to their server?

Question

I'm thinking to build a VPN for personal use on a VPS but am unable to understand one thing. How exactly VPN providers encrypt data from client to their server? Suppose if I simply configure IP of my VPS and port in my browser it would be simple proxy it won't encrypt traffic that originates from my machine or browser.

If I use OpenVPN would it solve the purpose?

One more thing which I can't understand is, how do VPN providers exactly restricts usage to a few devices. Do they save device information? If by few devices they mean only X devices can run this VPN in parallel then how do the exactly restrict usage to only X devices because they have limited IPs and tons of users routing their traffic through them and there's no way to know to know who is using how many devices. If this is mapped to user account and they figure this out via his unique account then technically they are maintaining logs right?

Answer 1

How exactly VPN providers encrypt data from client to their server?

There's numerous algorithms, or cipher suites. Which ones that can be used are dependent on the exact protocol used. You want to avoid using broken ones so using the latest versions and good configurations of your software is needed. One you want to avoid for sure is anything DES.

OpenVPN: You can look at any installed instance of OpenVPN's supported cipher suites as well. The server must support the same suites as your client. It's worthwhile to ask these questions and research for any VPN provider. Older VPN mechanisms like Microsoft's PPTP had vulnerabilities and have been deprecated.

how do VPN providers exactly restricts usage to a few devices.

You sign into them with a username and password, or certificate. OpenVPN supports user authentication and certificates.

there's no way to know to know who is using how many devices

There is when you authenticate to the VPN server. If you're already signed in then it knows you signed in twice and can deny the session.

If this is mapped to user account and they figure this out via his unique account then technically they are maintaining logs right?

Not necessarily. The VPN server maintains a list in RAM of who is connected. It doesn't have to be written to disk. Also, if the username/password or certificate is not tied to your identity in any way (e.g. if you paid cash and received the credentials on a computer/IP/device not tied to your identity) then there is no opportunity to track.

Revocation lists can be used to deny access to revoked certificates, and servers can be set to deny access to expired certificates. Through this a mechanism of certificate issuance and delivery that is separate from identity can be implemented, though whether or not it is, only the implementer would know.