6

I'm curious as to how VPN works once you are connected to the server. Is all traffic(requests I've made) from the office side of the VPN (Server) routed trough the VPN back to me, once I've connected to the office VPN network; or am I just another machine on our network?

Ex: After logging in to the VPN Server I connect to one of our mac workstations and copy some work to my local machine (at home). Does that traffic move from the macWorkstation->vpnServer->InternetTunnel->me or is macWorkstation->InternetTunnel->me?

10

In your example, Yes, All traffic passes through the VPN server -- the traffic is encrypted when in transit, and the VPN server encrypt/decrypt it so that your end-point doesn't have to.

So in your own words, it is: macWorkstation<->vpnServer<->InternetTunnel<->me

The traffic is directed by your computer's routing table, so depending on how it is setup by your VPN software it will take either all traffic, or all traffic directed to the internet and route it over the VPN Server.

If the routing table takes ALL the traffic, then you will not be able to see any machine on your local home-wifi, which is why most VPN software only configure the internet destine traffic to be sent over the VPN.

  • 1
    This is true, even if you establish a SSH or HTTPS connection over the VPN.. I.e. the VPN does not care that traffic is already encrypted, it will apply yet-another layer of encryption on the traffic. – Soren Jul 20 '11 at 0:47
8

(What Soren said is not completely true.) What traffic (or packet to be exact) goes through the VPN is decided by the routing table of the client computer for VPN services that tunnels the 2/3 layer (commonly Ethernet or IP). On both Windows and Mac OS X, you get the option in your VPN connect to send all traffic through the tunnel or just the traffic that belongs to same subnet assigned to you by the VPN server.

For example, assume you currently have IP 1.2.3.4 and connects to your company network which uses the subnet 192.168.1.0/24. When you connect, your OS will automatically install a route to send all traffic to that subnet (192.168.1.0/24) through your VPN connection. So far, traffic to an IP outside that subnet, e.g. 3.4.5.6, will be sent directly without going through the VPN.

If you choose to send all traffic through the VPN link, the default gateway on the client side will be changed. And traffic to 3.4.5.6 will go through the VPN

Also, like Soren said, a VPN tunnel does not "physically" connect you to the remote network, so all traffic has to go through the VPN server. Logically, the VPN server is a network bridge or router which filters network traffic and only sends the ones that are "interesting" to you.

  • this also applies to linux. 'use connection only for resources on its network'. Ticking that will prevent the process of all traffic being sent over the vpn regardless of routing entries. – Sirex Oct 11 '16 at 3:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.