Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I try to understand what happens when I use an HTTP(S) proxy in my OpenVPN client configuration.
What's the advantage of an HTTPS proxy over plain HTTP? In any case the encryption takes place on the client and the encrypted package is then routed through the proxy to the VPN server, right?
Which IP does the VPN server see? The client's one, the proxy's or both?
Related to (1.), but for clarification: What can the proxy see in terms of packet content?
The security differences between an HTTP and HTTPS proxies varies depending on what you are routing through them:
Clear text (ftp, telnet, HTTP): If the proxy is HTTP, the traffic is transmitted in clear text between your computer and the proxy, and clear text between the proxy and the final destination. If the proxy is HTTPS, the traffic is encrypted between your computer and the proxy, the proxy decrypts it and send it in clear text
Encrypted data (HTTPS, VPN): If the proxy is HTTP, the traffic is encrypted only once: at your computer. The proxy sends the traffic as it is to the destination. If the proxy is HTTPS, it depends on the proxy configuration. In some cases, the traffic is encrypted at your computer using the certificate of the proxy, decrypted by it, reencrypted with the certificate of the destionation, and sent. In other cases, the traffic is encrypted on your computer using the destination certificate, encrypted again with the proxy certificate and sent to the proxy. In turn, the proxy decrypts the traffic using its key, and send the traffic already encrypted with the remote destination certificate to the remote site.
In case of a VPN server, the IP it will see is the proxy's IP. Even if the transaction is started by your computer, this transaction is a sum of two TCP connections: one from your computer to the proxy and the other from the proxy to the VPN server. Each one is independent of the other, so the VPN server have no idea on who is behind the proxy, or even that there's a proxy at all.
A proxy have the same visibility of your packets as does your default gateway. If the proxy is an HTTPS proxy, and you have to install the proxy certificate on your system, it will decrypt all the packets before sending them, so it can see plain text even on HTTPS connections.
You can test if the proxy is reencrypting your data by running a packet sniffer locally and remotely on the same transaction, then comparing the traffic. Create an HTTPS server somewhere (e.g. a free tier server on Amazon), access it using your browser, and check the certificate data on both ends. If they differ, your proxy can see even HTTPS connections.
