The Basics of VPNs

By Rob Fischer

What is a VPN?

It is virtually certain that you’ve heard of a VPN, or ‘virtual private network,’ recently. In fact it is very likely that you’ve seen dozens if not hundreds of advertisements trying to sell you VPN services for your mobile device or your PC, promising to stop hackers, protect your privacy, and even shield you from scammers. But what actually is a VPN, and what does it do? Can a VPN live up to all of the hype? And, given that some of the services offered can cost hundreds of dollars per year or more, is it worth shelling out your hard-earned money to subscribe to one?

Fundamentally, a VPN can best be understood by thinking of it using a term that some of us old network guys used for them ‘back in the day’ before they became a popular must-have for everyday tech enthusiasts: tunnels. VPNs were first designed to allow devices in two different areas to communicate with each other as if they were on the same local network, even though they were separated by a public network… quite literally, they were talking over a virtual private network! Their communications were ‘tunneled’ through the public network to simplify their networking. Without getting into too many of the technical details, today’s VPNs essentially work in the same way. We will talk a bit more about how they work ‘under the hood’ below, but in essence a VPN is just a ‘tunnel’ from your device to some other endpoint on the network; in most cases, on the Internet. Everything that a VPN does to enhance your online privacy, they do by tunneling your data from one point to another.

How does a VPN work?

A VPN creates its ‘tunnel’ by using encryption to make it so that the data coming to and from your device to the other end of the tunnel can only be read by your device, and the device at the other end of the tunnel. The details of how this encryption is set up varies depending upon the type of VPN and the level of security that is desired, but the encryption means that anyone who might be ‘listening’ to the communication in-transit won’t be able to determine what is being said. Since a common point of attack for many cyber criminals is to listen in on unsecured networks such as public Wi-Fi hotspots in crowded areas, you can see how powerful the ability to prevent that listening in could be!

You can visualize how a VPN works by visualizing real-life tunnel: you can see in each end, but you can’t see through the sides. You also can’t enter or exit the tunnel from anywhere other than the ends of the tunnel. It literally is a point-to-point connection. What this means is that when you establish a VPN connection, you are sending all of the network communications from your device to the other end of the tunnel, and only then on to any other destination. In the case of a VPN, that means that all Internet traffic from your device is first sent through the tunnel to the VPN server, and then to the final destination; any return traffic, in turn, is sent first to the VPN server and then through the tunnel back to your device.

This feature of VPNs is why they are increasingly common as more and more people work remotely – they are able to establish a point-to-point connection with their workplace, and communicate with their office network securely almost exactly as if they were plugged in right at their desk! As far as your device is concerned, it might as well be – all of its network traffic goes along the VPN tunnel to the office network, just like it would if it were plugged into the port in the wall at your desk. Very convenient, and pretty secure, as well!

But of course, you can use your own personal VPN for your own personal uses as well. Just as a VPN can tunnel you through the wild and wooly world of the Internet to the calmer waters of your company’s Intranet, a VPN can also tunnel you through the insecure chaos of your coffee shop’s public Wi-Fi to the safe harbor of some trusted server quite literally anywhere in the world, from which you can then browse the web knowing that the hacker in the corner can’t intercept your usernames and passwords as you enter them into the websites that you visit.

What does a VPN do to protect my privacy?

Since all Internet-bound traffic coming from your device first travels through the tunnel and then out to the Internet, you can (to an extent) choose where you would like your entry point to the Internet to be. Since a VPN server can be located nearly anywhere, and connected to from nearly anywhere, it is possible for a user in one geographical location to use the tunnel-like nature of a VPN to access the Internet as if they were in another geographical location altogether. Suppose, for instance, that you are traveling abroad and attempting to access content online that is geofenced (limited to certain geographical areas) to your home country. By using a VPN with a server in your home country, you could continue to access that content from around the globe, because to that service your traffic would appear to originate from the VPN’s server in your home country rather than from your device, wherever you happen to be. This feature of VPNs can also be used to circumvent censorship and intrusive monitoring in a similar way.

The fact that the tunnel itself is encrypted (remember, you can’t “see through the sides” of a tunnel) also has the effect of masking to anybody who might be monitoring your communications (such as your cellular or internet service provider) which websites you visit or which services you are using. For various reasons, innocent or nefarious, ISPs or cellular carriers might elect block or restrict certain sites or services, or may throttle certain protocols (such as video streaming or torrent downloads). Some privately owned networks might also impose filtering or other traffic monitoring to block certain websites or kinds of network traffic. By using a VPN, anyone monitoring the network will be unable to see what kind of data is being transmitted, since they will only be able to see encrypted packets establishing the ‘tunnel.’ They will, of course, be able to see that encrypted traffic is being sent, and perhaps even that a VPN is in use, but they will not be able to determine anything further than that (unless, of course, they have managed to gain access to a device at the ‘ends’ of the tunnel, which is a concern for another article!).

Combined, these features mean that consistent use of a VPN can enhance your digital privacy when communicating over a network. It can prevent anybody ‘listening in’ on the network from being able to listen in on your communication or monitor who you are communicating with, and it can provide a degree of anonymity online (though, of course, as soon as you log in to anything you’re proving exactly who you are and all anonymity is lost, at least on that website!). This is especially important when using public networks, such as the WiFi down at your favorite cafe or gym. As with all security measures, it is generally a good practice to set VPNs to turn themselves ON by default if you choose to use one; you can always turn VPNs off when they are not needed, but setting them up as ‘on by default, off by exception’ means that you won’t accidentally forget to turn them on when you need them!

How can I choose a VPN?

There are many companies now offering VPN services, but not all of them are created equal. There are a few things that I personally look for when evaluating a potential provider of VPN services:

• Reputation: how long has this provider been around? Can you find reviews from other customers or trusted third parties (BBB, consumer advocacy agencies, etc.) that objectively evaluate their performance?

• Service level: sometimes a written guarantee, sometimes just a vague promise of performance. Is the VPN provider willing to put in writing a given level of throughput, speed, up-time, or other metric? If so, be prepared to pay a little more, but if reliability is critical, it may be worth it for you!

• What country or countries is the provider based in: depending upon your place of residence, there may be practical, ethical, political, or legal reasons for choosing or not choosing a VPN provider based upon where they are headquartered and where they have servers located

• Options for customization: how much fine-tuning with the VPN provider allow you to do? This may or may not be important for your use-case, but for some users it might matter more than others.

• Cost: sometimes, the bottom line is the bottom line. While you shouldn’t choose a VPN provider based on cost alone, sometimes it truly can be factor. Just remember that many times you do get what you pay for, so be careful and critically evaluate any lower-cost providers and make sure you are willing to accept whatever trade-offs they make to provide that lower cost of service (typically, service level or options).

Whatever VPN service provider you choose, make sure that it is one that you can trust. The VPN provider is the other end of the tunnel, and if they are compromised, have poor encryption or security, or are malicious bad-actors themselves, then the whole point of the VPN might go right out the window!

What are the limitations of VPNs?

There is no such thing in cyber security as a magic pill, and VPNs are no exception. While VPNs can do a great deal to help keep you protected when connected over a public network, they are not a substitute for good common sense and what we in the cyber security profession call ‘cyber hygiene.’ While VPNs are certainly a part of a good cyber security posture, they are not the only part.

The reasons that VPNs cannot protect you from every type of security threat is a topic that is outside the scope of this brief introductory article, but suffice it to say that the purpose of a VPN is to make your communication more private by tunneling it from one point to another, as we have described. They cannot prevent you from accidentally downloading a virus, spyware, or other malware. They cannot prevent you from accessing malicious websites that trick you into sharing your private information by pretending to be websites that they are not. They cannot prevent you from falling victim to a phishing scam sent to you by email. Of course, there are other security tools that you can use to help you prevent or mitigate those cyber risks, and we will talk about them in other articles!

Another drawback to the use of a VPN is that it will always result in slower data speeds – it is inevitable. You can do quite a lot to reduce the impact of a VPN on data speed, but there will always be some slow down caused by the encryption and decryption that must take place at each end of the tunnel, as well as the extra ‘hops’ that your data must take on the Internet as it routes from your device to its final destination (after all, it must pass along the tunnel first, rather than directly going from your device). Personally, I think that a slight reduction in data speeds is well worth the significant gain to my data privacy, but it is still worth considering!

VPN Best-Practices

There are a few things that you can do to maximize the benefit that you get from the use of a VPN:

First, you should set up your VPN account with a strong and unique passphrase (you should use unique passwords for all of your accounts, but that is also a topic for another article!). You want your VPN account to be as secure as possible so that nobody else can get ahold of the encryption keys used to protect your VPN tunnel. You should also set up your account to require MFA (multi-factor authentication) – that is where you get a text after entering your password, or enter in the code from a dedicated app on your mobile device. Yes, I know it is can be a hassle sometimes and it takes a little longer to sign in, but it really does make your account much, much safer!

Next, you should turn on your VPN’s ‘kill switch’ if it has one (and all good VPNs should!). A ‘kill switch’ is a setting inside your VPN that will pause all internet traffic if the VPN connection is unexpectedly interrupted. What that does is to prevent any accidental or unintended data leaks. Think of it like a fail-safe. On a related note, you should also always use your VPN over any public network – and I personally consider any wireless network (including cellular networks) to be at least semi-public since they broadcast their radio signal for anybody in range to receive! If that is a little too hardcore for you, at least keep it on whenever using any Wi-Fi that you don’t personally own the router for.

You should always keep your VPN client applications on your PCs and mobile devices up to date. The developers are hard at work identifying any bugs or security holes and releasing patches to fix them, so applying updates as they become available is an important step to makings sure that your VPN is as secure as possible!

This last bit is a bit technical and nerdy, but is just as important. To make sure that your VPN’s tunnel can stand up the the kinds of sophisticated brute-force attacks that cyber criminals are capable of these days, you should make sure that your VPN uses strong (a minimum of 256 bit AES) encryption keys for both IPsec and OpenVPN tunnels, and if you are using TLS in your OpenVPN tunnel, you should make sure that the TLS key should be of at least 2048 bits in length. If all of that gobbledygook went whizzing past you, don’t worry; most reputable VPN providers will already have their settings at or better than what I have just recommended, and will be transparent enough that you can easily check and verify if you want to. Just make sure that your VPN provider isn’t using obsolete and insecure protocols such as PPTP, L2TP, or IKEv1 (IKEv2 is okay). If the VPN provider you’re considering isn’t up front about what protocols they are using and what type and strength of encryption they are using, that should be a red flag!

Conclusion

VPNs are an important and useful component of enhancing your overall cyber security posture. Using a VPN to secure your data in transit is a good step toward protecting your digital privacy and keeping yourself safe on the Internet. Keep reading Breach Be-Gone for more ways to keep yourself safe on the Internet and enhance your digital privacy!