What a VPN Is: The Adapter, the Tunnel and the Server
A VPN is a private network that runs over your regular internet connection. On your device, the VPN app creates a virtual network adapter. Everything that enters this adapter is encrypted and sent to a server in the country you choose. The server then forwards the traffic to sites. The sections below cover the app, the server, what a VPN hides and what it does not change.
The app adds a virtual adapter
A phone or laptop usually sends traffic through one network adapter, for Wi-Fi or mobile data. A VPN app adds a second adapter that exists only in software. The app then asks the system to send traffic into this virtual adapter. On Android, for example, the app creates this adapter itself. The system sends packets to it under the rules that the app sets.
All programs on the device share this adapter. Traffic from the browser, messaging apps and background updates goes into it. The app reads each packet from the adapter and encrypts it. Then the app sends the packet to the server over your real Wi-Fi or mobile data. This encrypted connection between the app and the server is called the tunnel.
The system asks for your permission the first time you connect. On a computer, Ben's VPN may also ask for administrator rights to install the virtual adapter. These requests appear only on the first connection. After that, the VPN turns on with one button.
The server sends requests from its own IP address
The server decrypts each packet and forwards the request from its own IP address. It encrypts the replies from sites and returns them through the tunnel. The app on your device decrypts each reply and passes it to the program that made the request.
Sites estimate where you are from your IP address. Geolocation databases match ranges of IP addresses to countries and cities. With a VPN on, sites see the IP address of the server instead of yours. If you are in Chicago and choose a location in the Netherlands, search engines may switch to Dutch. Ads may also start to show businesses in Amsterdam.
A service may need to know your real country. The section about Ben's VPN below shows how to exclude such a service from the tunnel.
HTTPS encrypts the content, and a VPN hides site names
Most pages in a browser now load over HTTPS. HTTPS encrypts the connection between the browser and the site, with or without a VPN. Neither the Wi-Fi owner nor your internet provider can read page text, passwords or messages.
Site names, however, remain visible to both of them. To find the IP address of a site, your device sends a query to a DNS server. In most cases, this query travels without any encryption. Browsers and operating systems support encrypted DNS, but it is often not turned on. The browser also typically names the site at the start of each HTTPS connection. This name goes in a field called SNI, before encryption begins. The Wi-Fi owner and your provider can therefore see which sites you visit and when. They cannot see what you do on those sites.
With a VPN on, DNS queries and site names go inside the tunnel. Traffic from programs without their own encryption goes there too. To your network, all of it looks like one encrypted connection to a server.
| Data | HTTPS only | HTTPS plus a VPN |
|---|---|---|
| Page text, passwords, messages | Encrypted | Encrypted, with a second layer up to the VPN server |
| Site name | Visible to your network | Hidden from your network, visible to the VPN server |
| Your IP address | The site sees yours | The site sees the server address |
| Traffic from programs without encryption | Readable on the way | Hidden from your network, readable after the VPN server |
HTTPS and a VPN protect different data and work together. HTTPS hides the content from everyone between you and the site, the VPN server included. The VPN hides the names of those sites from your network.
A work VPN connects to an office, a personal VPN to the internet
Companies were the first to use VPNs, in the 1990s. The IPsec and PPTP protocols were specified in that decade. With them, remote staff and branch offices joined the office network over the internet. This use explains the name, virtual private network. It is the private network of an office, built over the public internet. The tunnel ends inside the office network, at work e-mail, shared folders and internal sites. The company decides who can connect to it.
A personal VPN works the same way, but there is no private network behind its server. The server only forwards your traffic to the internet from the country you chose.
A third option is a VPN on your router. Then every device on your home network uses the tunnel, even devices that cannot run the app. The VPN for routers page explains how to connect a router to Ben's VPN.
A VPN helps in 4 situations
- Wi-Fi that you do not control. In a hotel, on a train or in a coworking space, you do not know the Wi-Fi owner. You also do not know what the network records. With a VPN on, the network sees only an encrypted connection that it cannot read.
- Blocked sites and apps. A single network, such as airport Wi-Fi, can block a site or an app. All providers in a country can also block it. With a VPN, your request goes to the internet from another country. The local filter does not see which site the request is for. If Telegram does not connect, see VPN for Telegram.
- Trips abroad. Some services work differently or do not open at all for a foreign IP address. With a location in your home country, these services see a local address.
- Checks from another country. With a location in another country, you see your site or ads the way local visitors see them.
4 things that a VPN does not change
- Your accounts. A service knows who you are once you sign in to e-mail or social media. Choosing a location in another country does not change this.
- Cookies and fingerprints. A VPN does not delete the identifiers that cookies store in your browser. A browser also has a “fingerprint” made of its language, screen size and installed fonts. In a 2010 study, most of the tested browsers had a unique fingerprint. A new IP address does not change it.
- Phishing and malware. A VPN does not stop a “pay a small delivery fee” link from opening a fake page. An infected file also stays infected with or without a VPN.
- Trust. The site names that your provider saw before now pass through the VPN server. Choose a VPN service that you trust with this data.
Ben's VPN chooses the protocol, and you choose 3 settings
The protocol defines how your traffic looks on the way to the server. The 4 protocols of Ben's VPN are VLESS + REALITY, XHTTP, Hysteria2 and Shadowsocks. The app chooses the protocol and the route that work on your network. There is no protocol switch in the settings. When a stable connection requires it, the app turns on multihop. With multihop, your traffic first goes through a server in a third country. The app is based on Outline, developed by the Jigsaw team.
You choose 3 settings in the app yourself.
- The location. Tap “Location” to open “Change Location”, a searchable list of locations. If the country does not matter, tap “Fastest”. The app then selects a location near you.
- Traffic outside the tunnel. Tap “Tunnel” to open the “Split tunneling” settings. In the “Manual” mode, you list the IP addresses, subnets and domains that go directly to the internet. The Android version also has the list “Apps that bypass the VPN”.
- The multihop mode. This setting is under “Account” → “Settings” → “Multihop” in the app. We recommend keeping this setting in the “Automatic” mode.
The first connection in 4 steps
Install Ben's VPN
The app runs on phones, tablets, computers and TVs. The version for each device is on the page Ben's VPN apps for every device.
Open the app
The first launch on a phone, tablet or computer has no sign-in screen. The app runs its first setup and creates a guest account linked to this device.
Turn on the VPN with “Connect”
Without a subscription, the button opens “Buy Ben's VPN”. Choose a plan in this window and pay. If you have a subscription, tap “Sign in to account”, which is at the top of the window.
Choose a location
For a specific country, tap “Location” and find it in the list. If any location near you is fine, tap “Fastest”. The “Automatically connect when changing location” box is checked by default. The VPN therefore connects to the chosen location immediately.
Questions and answers
Can my provider tell that I am using a VPN?
Your provider sees that your device keeps long connections to one address. The list of sites that you visit no longer reaches it. Older protocols can be recognized by features of their packets. In 2022, researchers showed this for OpenVPN traffic. In Ben's VPN, VLESS + REALITY makes the connection look like HTTPS to a real site.
Does a Wi-Fi password protect me the way a VPN does?
A Wi-Fi password stops your neighbors from joining the network. The password hides nothing from your internet provider. DNS queries and site names still pass through its equipment. If this does not concern you, a VPN at home is mostly for services that do not open.
What should I do if the VPN is on but pages do not load?
When the connection through a server is poor, the app shows a “Bad connection” banner. After you tap “Fix the problem” on it, the app offers to change the location. It can also search for a working server for up to 2 minutes. If the problem remains, tap “Support” to open a chat with Support 24/7.
How do I use one subscription on my phone and my laptop?
A guest account works only on the device where it was created. First, open “Account” → “Link e-mail” on that device. On the second device, tap “Connect” and choose “Sign in to account” in the purchase window. Sign in with that e-mail or with a code. The first device shows the code in “Sign in on another device”. The code has 8 digits and expires after 3 minutes. There is no device limit, so a tablet and a TV can use the subscription too.
Why use a VPN if my browser has incognito mode?
Incognito mode deletes your history and cookies when you close the window. Your provider still sees the site names, and sites still see your IP address. A VPN works at the network level and does not conflict with incognito mode.
