Hiding client IP from a VPN server

Question

VPNs can often be useful for obscuring personably identifying information (IP, geolocation, etc.) from remote destination servers.

Traffic is routed through a VPN server and forwarded to the destination. As far as the remote destination servers are concerned, the traffic appears to have originated from the VPN server's IP address.

In this sense, the VPN tunnel/server essentially behaves as a proxy, intermediary, or go-between (not unlike a broker); probably not one of the original design goals for this technology, regardless it can often be desirable to exploit (i.e. take advantage of) it's inherent properties to facilitate such a purpose.

---

However, the IP address from whence the traffic truly originates, will obviously be visible to the VPN server. What solutions exist for hiding (e.g. disguising, obscuring) this information from an untrusted VPN server?

A few ideas immediately come to mind, but suitability, effectiveness, and implementation details are unclear:

• Encapsulate the untrusted VPN tunnel within a (secondary) trusted VPN tunnel (or vice versa?) (but how?).
• VPN router firmware (Tomato, DD-WRT, OpenWRT, etc.) with paid subscription service (e.g. ExpressVPN, Nord, PIA) in conjunction with untrusted VPN client on end-user device.
• Two VPN connections, untrusted VPN in virtual machine, trusted VPN on physical host.
• Full-tunnel / split-tunnel manipulation.
• IPv4 forwarding / iptables type magic.
• SOCKS Proxy and / or TOR chaining (proxychains or similar) (before and / or after vpn connection? encapsulated? serial? both? unsure).
• Encapsulating with ssh tunnel or vice versa.
• Something involving torify, torsocks, tsocks, shadowsocks, etc. (more reading required).
• Something involving self-hosted proxy or VPN solution (privoxy, squid, nginx, openvpn).
• Something involving a VPS SaaS.

Answer 1

You can't.

Someone has to know your address, because someone needs to be able to reach you. You're essentially just putting ever more proxies between you and the server you effectively want to communicate.

 Direct                 Using a                Using multiple
 Connection             VPN Gateway            VPN Gateways

+---------------+      +---------------+      +---------------+
|               |      |               |      |               |
| Your Computer |      | Your Computer |      | Your Computer |
|               |      |               |      |               |
+-+-------------+      +-+-------------+      +-+-------------+
  |  203.0.113.17        |  203.0.113.17        |  203.0.113.17
  |                      |                      |
  |                      |                      |
  v  151.101.1.69        v  198.51.100.6        v  198.51.100.6
+-+-------------+      +-+-------------+      +-+-------------+
|               |      |               |      |               |
| StackExchange |      | VPN Gateway   |      | VPN Gateway 1 |
|               |      |               |      |               |
+---------------+      +-+-------------+      +-+-------------+
                         |   198.51.100.99      v   198.51.100.99
                         |                     ...
                         |                      |
                         v   151.101.1.69       v   169.254.0.19
                       +-+-------------+      +-+-------------+
                       |               |      |               |
                       | StackExchange |      | VPN Gateway N |
                       |               |      |               |
                       +---------------+      +-+-------------+
                                                |   169.254.0.142
                                                |
                                                |
                                                v   151.101.1.69
                                              +-+--------v----+
                                              |               |
                                              | StackExchange |
                                              |               |
                                              +---------------+

As you can see in the above-mentioned graphic, there is always at least one host which has to know your IP address.

Answer 2

What solutions exist for hiding (e.g. disguising, obscuring) this information from an untrusted VPN server?

Yes, don't use an untrusted VPN server.

If your VPN server is untrusted, no cleartext protocol is safe when you route traffic to it. Plain HTTP traffic can be sniffed, altered, and injected with ads or malware. DNS requests can point to another server. Clear telnet traffic to your SunOS sitting on a basement somewhere can be stolen.

If you really need to access that untrusted VPN server, send your traffic to a trusted VPN server before (to hide your IP), and after (to protect cleartext traffic).

But it's easier to use only one trusted VPN service.