VPS vs VPN: They Work in Opposite Directions
A VPS and a VPN do opposite jobs. You rent a VPS so that others can connect to it. They can be visitors to your site, your clients or services that send data to your bot. A VPN protects the connections that your device makes. Your device encrypts the traffic and sends it to a VPN server. Websites then receive your requests from that server, not from your device. With the wrong choice, you pay for a server instead of a protected connection, or the reverse.
The difference is the direction of connections
Others connect to a VPS, and you connect through a VPN. This direction is the short answer to “VPS vs VPN”. Who maintains the server and which address websites see also depend on it.
A VPS: others connect to it
A VPS (virtual private server) is a virtual machine on the hardware of a hosting provider. A hypervisor usually divides one physical server into several isolated machines. Each machine runs a separate operating system, and its data stays apart from the others. For you, a VPS is a server on the internet with a public address. It stays online when your laptop is closed.
A VPS is therefore the place for services that others must reach at any hour:
- a bot whose new messages Telegram delivers directly to the VPS through a webhook;
- a personal cloud that your phone uploads photos to overnight;
- a booking page that your clients open;
- a task tracker for your team.
The hosting provider gives you the machine, the network and administrator access. You install the software, update it and protect the VPS.
A VPN: you connect through it
With a VPN, your device starts the connections, and the VPN protects them on the way. The app builds an encrypted tunnel to a VPN server, which forwards your requests to websites. The network you are on sees only a connection to that server. Websites see its address instead of yours. See how a VPN works for each step of the connection.
The VPN service runs and updates the VPN server. Your part is to connect the VPN where you need protection. Open Wi-Fi at a coworking space or a conference is one example. Another example is a trip where a site you need does not open on the local network. A separate article compares a VPN with a proxy.
A self-hosted VPN: one address, one city, one server
For a self-hosted VPN, you rent a VPS and run a VPN server on it. The VPS then accepts connections from your own devices. It sends their traffic to the internet from its own address. The setup works, and you should know 3 of its properties before you start.
- One address, used only by you. It usually stays the same while you rent the VPS. This helps when a work system accepts only one approved IP address. For privacy, it is a drawback, because websites can link all your visits by that one address.
- One city. The VPS stays in its data center when you travel. For example, your VPS is in Frankfurt, and you fly to Bangkok. The distance is almost 9,000 km (about 5,600 miles). Each kilometer of optical fiber adds about 5 microseconds of delay. The round trip to the VPS alone then adds roughly 90 milliseconds to every request. Real routes are longer than a straight line. For another country, you need another VPS.
- One server. A route through an intermediate country needs a second server and a link between the servers. You configure that link yourself as well.
A plain VPS, a self-hosted VPN and Ben's VPN
The table compares the 3 setups on 7 points.
| What we compare | Plain VPS | Self-hosted VPN | Ben's VPN |
|---|---|---|---|
| Who connects | Visitors, clients and services connect to your VPS | Your own devices connect to your VPS | Your devices connect to the location you choose |
| Where your traffic reaches the internet | As usual, because the VPS does not carry your traffic | In the city of the data center | In the location you chose in the app |
| If you are far from the server | No effect. Your traffic goes directly to websites | Each request goes through the city of the VPS | Choose a closer location. With “Fastest”, the app picks a location near you |
| Static IP | Usually, for as long as you pay | Usually, and only you use it | Not guaranteed. Addresses can change, for example when you use “Replace Servers” in “Account” → “Settings” |
| Route through an intermediate server | — | A second VPS and a link that you configure | In automatic mode, the app enables “Multihop” when the connection is unstable |
| Traffic that bypasses the VPN | — | You write the routing rules yourself | Your own list of addresses in “Manual” mode |
| Help when something fails | The hosting provider fixes hardware and network problems. You fix the rest | The hosting provider fixes hardware and network problems. You fix the VPN server and your devices | Support 24/7 by chat in the app |
4 cases: a VPS, a VPN or both
- A service that accepts connections 24/7. Such a service runs on a VPS. Ben's VPN cannot help with it, because we do not offer servers for rent.
- Internet access at a coworking space, a conference or on a trip. Here you need a VPN, with no server to rent or maintain. Your device starts the connections, and the app sends them through an encrypted tunnel.
- An address that stays the same. You need one, for example, when a work server accepts connections only from your IP address. Choose your own VPS or a static IP from your internet provider. Addresses at Ben's VPN can change.
- A bot on a VPS and a VPN on your laptop. In this case, you need both a VPS and a VPN. The one point to check is SSH access to the VPS, which the next section describes.
Split tunneling keeps SSH access to your VPS
A VPN on your laptop works with a VPS that you already run. SSH has its own encryption for the session, so the VPN is not needed for that. The problem is the access rules on the VPS. Your VPS may accept SSH only from your home IP address. With the VPN connected, it sees the address of the VPN server and refuses the connection. Split tunneling solves this, because traffic to your VPS then bypasses the VPN.
Open “Tunnel”
The tile is on the main screen, under the server card.
Choose “Manual”
Enter the IP address or domain of your VPS in the field, one entry per line.
Reconnect the VPN
The list applies after you disconnect the VPN and connect again. Connections to your VPS then bypass the VPN, and all other traffic stays in the tunnel.
On Android, you can exclude the SSH app from the tunnel instead of an address. Under “Apps that bypass the VPN”, tap “Select apps” and check your SSH app.
Ben's VPN is a VPN service, not a hosting provider
You cannot run a site or a bot with us. We protect the connections that your devices make.
One subscription covers our apps for phones, computers, TVs and routers (see apps for every device). The app picks the protocol automatically from VLESS + REALITY, XHTTP, Hysteria2 and Shadowsocks. Our overview of VPN protocols explains why there are 4 and what each one is good for.
The “Location” tile on the main screen opens the “Change Location” window with the list of locations. The option “Automatically connect when changing location” is checked by default. With this option, choosing a location connects you immediately.
If the connection is unstable, the app can route traffic through an intermediate server in a third country. This is how “Multihop” works in automatic mode.
Questions and answers
Does a VPN on my laptop protect the VPS itself?
No. The VPN protects the connections of your device. Your VPS in the data center is reachable from the internet regardless of your VPN. Protect it separately with system updates, SSH keys instead of passwords and a firewall.
Are the servers of a VPN service also VPSes?
They can be virtual machines or whole physical servers, depending on the service. In both cases, the service maintains them, not you.
Can the VPN service see what I do on my VPS over SSH?
No. SSH encrypts the session all the way from your device to the VPS. The VPN server sees only an encrypted connection to the address of your VPS. If you add that address in “Manual” mode, the connection bypasses the VPN.
How do I connect every device at home to a VPN without my own VPS?
Connect the router itself to the VPN. The Ben's VPN app runs on Keenetic, Netcraze, OpenWrt and MikroTik routers. For other models, your account page has PPTP and OpenVPN settings.
Do I need a VPS to use Ben's VPN?
No, and registration is not needed either. On a phone or a computer, the app creates a guest account at first launch. Without a subscription, “Connect” opens the “Buy Ben's VPN” window, where you choose a plan and pay. To use the subscription on other devices, open “Account” and choose “Link e-mail”.
