What does a VPN do to the IP address a service sees?¶
title: "What does a VPN do to the IP address a service sees?" card_id: "IP-059" status: "complete" source_document: "https://docs.google.com/document/d/1tIbKOajh6oCm9HSMEbOXLgZXkZhY0T6wwSRuQ_7mZYc/edit?usp=drivesdk"
What does a VPN do to the IP address a service sees?¶
What does a VPN actually do to the IP address a service sees?
Without a VPN, your device normally connects to an online service through your home, workplace or mobile internet connection.
The service sees the public IP address from which that connection reaches it.
If you use a VPN, the route changes.
Instead of connecting directly to the online service, your device creates an encrypted connection to a VPN server.
This is normally called a VPN tunnel.
The VPN server then connects to the online service on your behalf. The VPN tunnel protects the first part of that journey—from the device to the VPN server.
That creates two sides to the connection.
There is a connection from your device to the VPN.
And there is another connection from the VPN to the online service.
For traffic routed through the VPN, the online service will normally see the public IP address used by the VPN server.
This is often called the exit IP address.
It’s the address from which the traffic leaves the VPN service and reaches its destination.
The service doesn’t normally see the public IP address being used by the person’s home broadband or mobile connection.
That’s the point of the VPN.
It places another network between the user and the online service.
This can also change the apparent location of the connection.
Someone in the United Kingdom might connect through a VPN server in France.
A location check against the exit IP address might then suggest that the activity came from France.
That tells you where the VPN server appears to be.
It doesn't tell you where the person using it was physically located.
A VPN exit address may also be shared by many customers.
Hundreds or thousands of people could appear to use the same public IP address.
So finding repeated activity from the same VPN address doesn't necessarily mean it came from the same person.
A VPN changes the network address seen by the online service.
It doesn't automatically make the user anonymous.
The service may still hold account details, login records, cookies, device information, payment records, messages or other identifiers that connect the activity to a particular user.
The VPN provider may also be able to see the public IP address from which the customer connected to its service.
Whether it records or retains that information is a separate question.
And not every connection from a device will necessarily pass through the VPN.
That depends on how the VPN has been configured and which traffic it has been set to carry.
So, if an online service records a VPN exit address, you haven't necessarily found the user’s normal internet connection.
You’ve found an intermediary through which the connection passed.
That matters because the address may identify the VPN service or the infrastructure it uses, rather than the person behind the activity.
The key point is this:
A VPN changes the IP address seen at the destination.
It can conceal the user’s normal public IP address from that destination.
But it doesn't remove all the other evidence that might identify the account, device or person involved.