How do a VPNs route SSL traffic and do they compromise security?

Question

If my understanding of how VPNs operate is correct, all traffic between me and the Internet at-large is routed through the VPN's servers. So an attacker would only be able to see encrypted traffic between the VPN and me and wouldn't be privy of its content nor its true destination. The destination wouldn't be able to see where the request originally came from (ie: me) either. Am I right so far?

So when SSL comes in play here, how does it all work? Suppose I am going to Gmail via the VPN. Since the VPN connects to Gmail on my behalf (and vice versa), wouldn't they need to decrypt communications between Gmail and my computer, and re-encrypt them again to send to both ends? If that's the case:

• obviously, wouldn't this mean the VPN can see all plaintext communications?
• and if the above is true, wouldn't it be a MITM attack?
• and if the above is true, and I haven't installed any new trusted root certificates, why doesn't my browser alert me?

The question is about VPNs in general, but I am using OpenVPN.

Answer 1

Network communication is done using multiple independent layers. VPN is one layer and a channel for communication, and SSL is a different one. They do not interfere.

On a very different topic, someone said (and was ridiculed for it) that the internet is a series of tubes. But I can use the tube analogy to explain the concept of SSL inside VPN.

Imagine SSL is like a tube running from your browser to Gmail's server. You send data inside that tube and no one outside can see it. VPN is a different and larger tube from you to the VPN server. You now pass the SSL tube through the VPN tube. Your data is inside those two tubes when it leaves your computer but the VPN tube will end at the VPN server where the SSL tube still continues uninterrupted to Gmail.

VPN is the black tube and the colored tubes are the SSL tunnels to all your important sites (Gmail, Paypal, etc.) The copper wire is your data.

So there is no compromise to the security of your data.

Hope the visualization helps.

Answer 2

The VPN forwards data packets indiscriminately. When you do SSL with Gmail's server, then the SSL connection actually consists of data "records" (described in the SSL/TLS standard) which are sent over a TCP connection between your machine and Gmail's server. That TCP connection, in turn, is embodied as a lot of individual IP packets.

With a VPN, all the IP packets that you emit go to the VPN server; and all IP packets which are sent back by Gmail's server go to the VPN server. The VPN server forwards these IP packets by encoding them into the tunnel that it maintains with your machine. So the IP packets (that encode a TCP connection that contains the SSL connection with Gmail's server) are encoded into the tunnel and thus encrypted again. There are two nested layers of encryption, the SSL connection between your machine and Gmail's server, and above that the connection (which may be some SSL, too) between your machine and the VPN server. The VPN server removes and adds the external layer, but the internal layer remains opaque to that server.

The VPN server is, generally speaking, in an ideal position to run a MitM attack on you, since it controls all the data which enters and exits your machine; but the SSL layer (the one between your machine and Gmail's server) protects you against all attackers on the path between your machine and Gmail's server, and that includes the VPN server.

Answer 3

While it is true that the end point that Google would send information to would be the VPN gateway, what you are missing is the contents of the SSL. Your computer still generates the private key for the SSL session and sends it such that only the server you want to talk to (GMail) can open it. Then one you and GMail are talking on that secure connection, you send your password in a way that only GMail can read. Thus, the VPN end point knows nothing about your communication with GMail and GMail only knows that they are sending to the VPN's entry point.