I've looked at a lot of VPNs, and "what's my ip address" sites confirm that outsiders can't tell where I really am when I'm using them, but I haven't been able to get my own WiFi yet, so I don't know what privileges they have. Can they tell that a proxy server is being used by their network, even if the person using it is obscured?
Yes, and you may not be as obscured as you think. They can't tell what you're saying to a VPN server (because it's encrypted), including what sites you're accessing via the VPN, but they can tell that you are connecting to that VPN server. In networks where you have to register your device to your name somehow (e.g. many university networks), they can also tell that it's you (or someone impersonating you) who is connecting to the VPN.
For an example: I have laptop A, an account on VPN server B. I want to say "hello" to site C.
- If I talk directly to site C, a network administrator can see "A said 'hello' to C".
- If I talk directly to site C over an encrypted connection (e.g. over SSL), a network admin sees "A said 'oewqhfch' to C" (where 'oewqhfch' is 'hello', but encrypted; the network admin can't decrypt it)
- If I use B as a simple unencrypted proxy to talk to C (i.e. I'm not encrypting what I say to B), the admin sees "A said 'Tell C "hello" and send me C's response' to B"
- If I use B as an unencrypted proxy but encrypted my communication to C, the admin would see "A said 'Tell C "oqewqer" and send me the response' to B" (this is uncommon)
- If I use B as a VPN (encrypted connection to B), the admin sees "A said 'ewqrvqfqjpocn' to B". B then decrypts that to see that A asked it to "Tell C 'hello' and send me the response", but the administrator of A's network doesn't know that A said that.
So, a VPN gives the benefit that everything you're doing on the VPN is hidden from the administrator of your network; the idea is to make it as though you were directly connected to the VPN provider's network. But your network administrator still sees that you're talking to the VPN server, because they have to route your packets to and from that server.