# What is VPN, anyway? **URL:** \ **Category:** Factual Questions\ **Created:** [February 6, 2018, 11:22am UTC](https://boards.straightdope.com/t/what-is-vpn-anyway/808295 "2018-02-06T11:22:07Z")\ **Posts on this page:** 8\ **Page:** 2
**Author:** ![Francis\_Vaughan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/francis_vaughan/32/3093_2.png) [@Francis\_Vaughan](https://boards.straightdope.com/u/Francis_Vaughan)\ **Post date:** [February 7, 2018, 12:43am UTC](https://boards.straightdope.com/t/what-is-vpn-anyway/808295/21 "2018-02-07T00:43:10Z")
A neat solution for remote workers and road warriors can be a separate managed VPN appliance. For instance CISCO’s Meraki system includes a little box that you can carry with you that provides a set of network ports, and even a WiFi connection. Workers can connect back to the office with this box, have a computer, printer, VOIP phone, all managed by the box. It all fits inside the Meraki security appliance framework, so is quite a neat idea all round. ---
**Author:** ![spinky](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@spinky](https://boards.straightdope.com/u/spinky)\ **Post date:** [February 7, 2018, 9:02am UTC](https://boards.straightdope.com/t/what-is-vpn-anyway/808295/22 "2018-02-07T09:02:30Z")
> [@EdelweissPirate](#): > > Oh; I apologize. Frankly, it hadn’t occurred to me that this subject might be off-limits. It’s also best not to have any technical discussions about xerox machines or audio cassette high-speed dubbing. ---
**Author:** ![Northern\_Piper](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/northern_piper/32/5304_2.png) [@Northern\_Piper](https://boards.straightdope.com/u/Northern_Piper)\ **Post date:** [February 8, 2018, 1:30am UTC](https://boards.straightdope.com/t/what-is-vpn-anyway/808295/23 "2018-02-08T01:30:40Z")
Thanks for all the replies. Very helpful. ---
**Author:** ![mrmilom1990](https://avatars.discourse-cdn.com/v4/letter/m/65b543/32.png) [@mrmilom1990](https://boards.straightdope.com/u/mrmilom1990)\ **Post date:** [November 26, 2018, 1:49am UTC](https://boards.straightdope.com/t/what-is-vpn-anyway/808295/24 "2018-11-26T01:49:29Z")
> [@EdelweissPirate](#): > > First of all: I’m pretty technical (I used to work in network security) and Nava’s explanation looks fine to me; no gnashing of teeth for me. Minor7flat5’s supplemental response is great as well…VPN software _is_ a lot like a really long ethernet cable. > > Secondly, DCnDC’s description, while valid, highlights something confusing about the term “VPN”: VPN software is used to provide two very different services. > > The “classic” virtual private network is a way to connect to a network remotely and in a secure manner; this is what the OP asked about and what Nava described. NorthernPiper’s VPN software allows his/her work laptop to act as though it were on the office network by passing all traffic for the work network through an encrypted tunnel. That way, NorthernPiper’s machine can “see” internal servers via the encrypted tunnel, but no one else can decrypt the traffic between NP’s laptop and the office. You can also connect two offices this way; that’s called a “site-to-site VPN.” > > The second use of the term “VPN” is part of what people are calling a “VPN service.” (One popular VPN service company, for example, is NordVPN). Despite the name, a VPN service doesn’t connect a remote computer to a particular network like an office network. Rather, a VPN service uses the same software to encrypt all the internet traffic between a user’s computer and the VPN service. The user’s traffic then appears to come from the VPN service’s data center and not the user’s public IP address (which is provided by their ISP). > > People use VPN services to hide traffic from their ISPs and to get access to location-restricted content. Some people don’t want their ISPs to see that they’re downloading copyrighted content via BitTorrent, for example. Or a British expat may want to stream the BBC even though she’s living in the US. The BBC won’t stream some content to IP addresses outside the UK, so she could use a VPN service in the UK to make the BBC think her request for streaming is coming from within Great Britain. Other people worry that their ISPs are sending information about their internet browsing habits to advertisers, government agencies and things like that, and a VPN service makes all of one’s internet traffic look like a stream of gibberish between the user’s modem and their VPN service provider. Political activists in oppressive countries have good reason to use a VPN service. > > Although VPN services and “classic” VPNs use the same software to set up encrypted tunnels, their goals are very different. The “classic” version–which the OP is asking about–lets a remote computer act as though it’s on an internal network. The VPN service concept would better be described as an encrypted proxy. But it’s easy to use the same VPN client software one would use to connect to a corporate network to create the encrypted proxy tunnel that VPN services offer, so the VPN acronym gets applied to both. > > I get the impression that some people think it’s more secure to use, say, their bank’s web site when connected to a VPN service. This isn’t really true. The bank’s web site uses an encrypted HTTPS connection (ably described by Nava) and it’s very difficult for a third party to break that encryption and get access to your bank account. A VPN service runs the bank’s encrypted connection through an encrypted tunnel, so some people assume that a third party would have to decrypt both the VPN and the HTTPS encryption. That’s true for traffic between your public IP and your VPN service provider, but once the traffic leaves your VPN service provider, it’s singly encrypted and running over the regular internet to your bank. So a third party hell-bent on seeing traffic between you and your bank would find a way to sniff traffic between your VPN service provider and your bank. If you’re really worried about security for things like online banking and looking at your health records, you’d be better served by paying close attention to HTTPS/TLS certificate validity and not installing sketchy software than by paying for a VPN service. This is a pretty badass definition of what a VPN is and how it works. I work in IT security and I often have to explain how it works, one of the easiest ways to understand a VPN is think of it like a protected little tunnel from one end to the other where none can see what you’re doing. If you’re interested here are a couple of resources that may help: How Tunnel Encryption Works - [https://computer.howstuffworks.com/vpn7.htm](https://computer.howstuffworks.com/vpn7.htm) A great breakdown of Encryption - [https://privacyaustralia.net/complete-guide-encryption/](https://privacyaustralia.net/complete-guide-encryption/) ---
**Author:** ![filmstar-en](https://avatars.discourse-cdn.com/v4/letter/f/50afbb/32.png) [@filmstar-en](https://boards.straightdope.com/u/filmstar-en)\ **Post date:** [November 26, 2018, 2:59pm UTC](https://boards.straightdope.com/t/what-is-vpn-anyway/808295/25 "2018-11-26T14:59:15Z")
Also VPN tunnels don’t have to be encrypted if they are implemented across a trusted private network. They are a useful technique for separating traffic and are often used in private company networks. Many of the VPN services advertised on the Internet are SOCKS proxies. You need an account with a service provider. The range of services they provide are useful for avoiding Internet hazards and annoyances. A secure VPN will encrypt ALL traffic between two points on an insecure network are a different thing. Someone has to control both ends and configure equipment at both ends. The simple case is to connect two offices together over the internet. You would do that by configuring the routers at each end to agree a permanent VPN tunnel. The public internet is a convenient insecure public network. Before the Internet became ubiquitous, the offices would be connected through a dedicated private circuit, bought at some expense from a Telco. This is still the way in which many offices are connected together, where the public Internet is unreliable. A secure VPN for road warriors connecting to their private company network is more complicated case than just connecting two offices because it involves a laptop the separation of local traffic and VPN traffic. Care must be exercised to ensure the laptop does not become a backdoor into the private network. It is difficult to control what goes on many remote laptops. They can be stolen, so there is usually some elaborate software and ID hardware solution in place that requires a lot of support when it goes wrong. VPN is a much re-used term. It was used to refer to private voice networks and various other kinds of data network before the public Internet came along and confused matters. ---
**Author:** ![rat\_avatar](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rat_avatar/32/255_2.png) [@rat\_avatar](https://boards.straightdope.com/u/rat_avatar)\ **Post date:** [November 26, 2018, 5:29pm UTC](https://boards.straightdope.com/t/what-is-vpn-anyway/808295/26 "2018-11-26T17:29:38Z")
As long as any client has the ability to do promiscuous listening an un-encrypted stream on a corporate network provides little security. Some form of end-to-end encryption is the only way to ensure communication is likely private. ---
**Author:** ![md2000](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@md2000](https://boards.straightdope.com/u/md2000)\ **Post date:** [November 26, 2018, 7:10pm UTC](https://boards.straightdope.com/t/what-is-vpn-anyway/808295/27 "2018-11-26T19:10:44Z")
Some pretty good explanations. Basically, each end of the VPN is a program that ties into the guts of the network transmission, and intercepts the packets headed in and out of the computer. These programs talk to each other - your VPN logon allows the VPN program to find and handshake with the other end, a similar program. Typically, all the traffic between the two is encrypted; the bonus is that nobody can read what’s going by, given today’s fairly good encryption. “Split tunneling” refers to a configuration option for your VPN program - does it intercept and redirect all traffic, or just he traffic it detects that is intended for the other end (say, only the data to and form your office network)? If some of your home computer traffic can go to the plain internet, and at the same time some packets go to the office network, then if the home computer has become another entry way into the office network, if it is running the wrong sort of software (i.e. infected with malware). Hence the dislike of split tunnels - send all traffic through the VPN, or none. (Then, if you browse the internet while on office VPN, all your traffic goes to the office network and out the office’s firewall, where the company’s fancy firewall can ensure you are less likely to be accessing problem content) Another risk to roaming computers is that the first hop is usually Wi-Fi, meaning you are yelling out your conversation packets to anyone in range to listen. If you haven’t been clever, you may also have your disk shared from when you needed it so at home. Besides the ability to use a public VPN’s entry port address onto the internet instead of your own, for reasons some of which we can’t discuss here - if you are, say, in Starbucks or the airport lounge and use a VPN, all anyone will see is your VPN traffic - that you are sending encrypted packets to an address that belongs to the VPN provider. They can’t see what it is, an as long as “split tunnel” is not allowed, any attempts to connect to your PC’s disk shares from nearby PC’s on local Wi-Fi will be rejected because the VPN program on your PC is only allowing communication from the VPN provider. (This is one of the benefits NordVPN among others are touting for their product). (There is also a few tricks where a PC can become “monkey in the middle” for Wifi and pretend it is the wifi spot, relay and thus intercept all your traffic, fake certain websites, etc. VPN’s help avoid this.) (“But, but, but… I go to HTTPS sites which are encrypted.” Yes, but the destination is not. Anyone reading your traffic will be able to tell you are sending and receiving a lot of traffic from, say, [facebook.com](http://facebook.com) or pornhub,com, even if they can’t see what the payload is - they can read the destination. With a VPN, all traffic is just encrypted globs of data, the only visible detail is the VPN destination.) ---
**Author:** ![filmstar-en](https://avatars.discourse-cdn.com/v4/letter/f/50afbb/32.png) [@filmstar-en](https://boards.straightdope.com/u/filmstar-en)\ **Post date:** [November 28, 2018, 1:41pm UTC](https://boards.straightdope.com/t/what-is-vpn-anyway/808295/28 "2018-11-28T13:41:18Z")
The much advertised VPN services provide a prophylactic technique using encryption and proxy servers to avoid some of the hazards of using the public internet. They have pros and cons. Point to point VPNs provided by the IT departments to connect their roving employees or small offices to the organisations internal network using encrypted tunnels across the public Internet are quite a different technique with their own set of features and issues. Some corporations with extensive private networks also use VPNs internally for extra security. Any private network of any size supporting many thousands of employees will be pretty near impossible to make secure. People are people and some will accidentally connect a laptop full of malware to their office network. Network managers have a very hard job dealing with infections that can bring down large private networks. A major incident on a large corporate network can seriously degrade all the computing services and cause an emergency rather like a building catching fire. Restive office workers gather idely around water coolers and printers unable to work. Managers gather brandishing pitchforks and torches looking for the guy who runs the network. There are clearly one or two of these harried individuals hereabouts who have been on the pointed end of the blame culture that pervades many organisations. Only certain kinds of corporate network are centrally administered and tightly secured by uniform rules to stop this from happening. Consequently VPNs are also used within many corporate networks because it is regarded as untrusted. Not as bad as the Wild West that prevails on the public Internet, but still not secure enough to ensure business confidentiality. So most network equipment suppliers tout VPN based security solutions for high paying business customers. Point to point VPN technology is, however, not exclusively the preserve of big business. There is a lot that can be done with Open Source hardware such as the Raspberry Pi or something similar combined with free software, if your have the inclination and the patience. It is, however, a bit involved for non-technical people. I hope that little ‘plug and play’ VPN gadgets to connect to a laptop to give access to a well appointed home network (such as those solutions sold at premium by Cisco, et al) will eventually become available to those with more modest budgets. The reason why we have VPN technologies is because the IP protocol on which the public Internet is based was never designed to have any form of security built it because it was originally for academics to share their work. Consequently security features have to be retro-fitted using additional hardware and software that comes with a price tag and subscription. A VPN proxy service is a good first step for a general Internet user to avoid the nosy parkers. [Previous page](https://boards.straightdope.com/t/what-is-vpn-anyway/808295.md?page=1)