7

I've been reading about VPNs lately, and I'm struggling to understand what they do and how they're essential components to upholding anonymity online. The basic idea I have is that a VPN allows two entities to exchange information with each other over the internet, but I don't really know what this means. The Wikipedia definition says "A VPN extends a private network across a public network, such as the internet." Any resources or answers about how I can better understand what this means would be great.

Also, why is it a point of VPN providers to say that they do not keep "logs," or something to that effect? What does this mean, and how does it compromise one's security? Are VPNs that you don't create yourself essentially trust-based?

1
  • I hate when people say to just look it up on Wikipedia. A lot of the technical stuff on Wikipedia is written so that only people that already understand the concepts can understand it. Feb 25, 2020 at 19:04

3 Answers 3

12

In the old days, if you were a big company with multiple private local networks in multiple locations, you connected them together by installing private data lines between the various locations to make a Wide-Area Network. Then the Internet came along, and you also had to connect each site to the Internet.

It turns out that Internet feeds are much, much cheaper than private lines are, so inevitably people began asking "why can't I just connect these sites together with the Internet, and save money?"

The answer, of course, is that the Internet is a public network, so you don't want to send confidential company data over it. You could modify all your systems to encrypt their data when they talk to each other but that is likely to be complicated and expensive.

One solution was a technology called VPN. You tell each computer in the New York office that if it has anything for a computer in the London office that it should send it via a VPN gateway. The gateway is a machine connected to both the New York private local network, and to the public Internet. When it receive data for London it encrypts it and sends it over the Internet to another VPN gateway. The second gateway is connected to the public Internet and to the London private network, and when it receives the data from New York it decrypts it and drops it into the London network. The same thing happens to data going from London to New York, and if you open a Tokyo office you just install a third gateway and tell them about each other.

In this way, the machines in New York and London can talk to each other, but while the data is travelling over the public network it is encrypted and safe. You don't have to change anything about the machines that are talking, you just have configure your network routing tables, so everything works as if you had the expensive private WAN link.

This is Site-to-Site VPN. This idea was developed into Remote Access VPN.

An employee at home or travelling can connect their computer to the Internet and run a piece of software called a VPN client. When their computer has data to send to the New York office, the VPN client intercepts it, encrypts it, and sends it to the New York VPN gateway, which decrypts and drops the data into the New York network. In this way, the employee is able to safely access machines on the private New York network from anywhere they can get an Internet connection.

A further development has arisen more recently, called VPN as a Service.

Sometimes a person has data that they are OK to send over the Internet in general, but their local connection to the Internet is one that they specifically don't trust. Maybe they are in a sleazy Internet cafe and don't trust the owner, or they suspect the government has ordered their ISP to spy on them.

They can work around this problem by signing up with a VPN service provider. This works in the same way as the Remote Access VPN, with a local client installed on their machine encrypting data and sending it to a VPN gateway at the service provider. However, instead of accessing a private network, the service provider decrypts your packets and sends them out to the Internet over their connection, which you trust.

(This is why VPN service providers make a big deal of not logging traffic; if you suspect the Government has a warrant for your ISP, then they might also get a warrant for your VPN provider, so you want them to keep as little information about you as possible.)

There is another use for VPN as a Service. When you use it, the server you connect to sees a connection coming from the VPN provider, not from you. So, if the server you connect to only allows connections from a particular country (like many streaming video services do) you can bypass this restriction by using a VPN service that is in that country.

4

In basic language we can say VPN provides access to private network (corporate / office ) from outside, using secure network connection over the public network (Internet/ISP).

Types of VPN:

  1. Site-to-site VPNs connect entire networks to each other -- for example, connecting a branch office network to a company headquarters network. In a site-to-site VPN, hosts do not have VPN client software; they send and receive normal TCP/IP traffic through a VPN gateway. The VPN gateway is responsible for encapsulating and encrypting outbound traffic, sending it through a VPN tunnel over the Internet, to a peer VPN gateway at the target site. Upon receipt, the peer VPN gateway strips the headers, decrypts the content, and relays the packet towards the target host inside its private network.

  2. Remote access VPNs connect individual hosts to private networks -- for example, travelers and teleworkers who need to access their company's network securely over the Internet. In a remote access VPN, every host must have VPN client software (more on this in a minute). Whenever the host tries to send any traffic, the VPN client software encapsulates and encrypts that traffic before sending it over the Internet to the VPN gateway at the edge of the target network. Upon receipt, that VPN gateway behaves as described above for site-to-site VPNs. If the target host inside the private network returns a response, the VPN gateway performs the reverse process to send an encrypted response back to the VPN client over the Internet.

VPN is trust-based than internet as it use encryption policy to pass the data over the secure tunnel.

1
  • 1
    these 'types' are only to differentiate between "how" the connection is made (is it on the machine or on an external 'box', and is it allowing everybody connected or just specific traffic). it is not a differentiation in technology used, as the technology itself is agnostic to what is on the other end. I know Cisco (among others) sell products specific for 1\ use or another. but that is just there way of selling things. not something inherently from the technology.
    – LvB
    Mar 20, 2015 at 15:06
0

You are mixing several different concepts here:

  • VPN (Virtual Private Network) A set of techniques to make connections between 2 networks through a unsecured network. like a laptop that connects to the private corporate data-server through the internet, utilizing a VPN connection.
  • A (Web-)Proxy, A Machine that sits in the middle between you and a server and that does some "magic" for you, like hide your IP (only showing the IP of the proxy, useful for pseudo-anonymity and bypassing region-restrictions), and caching/forwarding so you get faster page loads. (especially in a corporate environment you see this). or simply for auditing / testing purposes. (the proxy can allow / deny you access to certain resources. and record that it is YOU that accessed them.)

The "we keep no logs" is to 'convince' you that there really not storing anything to retrieve your real IP. but many countries now a days have laws that require ISP's and other companies to log this type of meta data anyway. (so for law-enforcement its still possible to get your IP)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .