VPN Explained: How Virtual Private Networks Actually Work

# Simulating what a network observer sees WITH and WITHOUT a VPN
# This is a conceptual model — not real packet capture code
# but it illustrates the exact difference in visibility

import hashlib

def simulate_packet(destination_url: str, payload: str) -> dict:
    """Creates a simplified representation of an internet packet."""
    return {
        "source_ip": "203.0.113.42",      # Your real public IP address
        "destination_ip": "93.184.216.34", # The web server's IP (e.g., example.com)
        "destination_url": destination_url, # Visible to your ISP even with HTTPS
        "payload": payload                  # Content (HTTPS encrypts this, but not the rest)
    }

def simulate_vpn_packet(destination_url: str, payload: str, vpn_server_ip: str) -> dict:
    """Shows what an observer sees when a VPN is active."""
    # The entire original packet (destination + payload) gets encrypted
    original_packet = f"{destination_url}|{payload}"
    
    # hashlib.sha256 here represents encryption — the real data is unreadable
    encrypted_blob = hashlib.sha256(original_packet.encode()).hexdigest()
    
    return {
        "source_ip": "203.0.113.42",  # Your real IP (only the VPN server sees this)
        "destination_ip": vpn_server_ip, # All traffic goes to the VPN server, not the real site
        "destination_url": "HIDDEN",      # ISP cannot see this anymore
        "payload": encrypted_blob         # Looks like random noise to any observer
    }

# --- What your ISP sees WITHOUT a VPN ---
raw_packet = simulate_packet(
    destination_url="my-bank.com/login",
    payload="username=alice&password=hunter2"
)

print("=== WITHOUT VPN (what your ISP/café Wi-Fi sees) ===")
for key, value in raw_packet.items():
    print(f"  {key}: {value}")

print()

# --- What your ISP sees WITH a VPN ---
vpn_packet = simulate_vpn_packet(
    destination_url="my-bank.com/login",
    payload="username=alice&password=hunter2",
    vpn_server_ip="198.51.100.10"  # The VPN provider's server IP
)

print("=== WITH VPN (what your ISP/café Wi-Fi sees) ===")
for key, value in vpn_packet.items():
    print(f"  {key}: {value}")

print()
print("Key insight: With the VPN, your ISP only knows you connected to the VPN server.")
print("It cannot see the real destination or the content — both are encrypted.")

# Simulating the full VPN tunnel lifecycle
# Encapsulation → Encryption → Transmission → Decryption → Forwarding

from cryptography.fernet import Fernet  # pip install cryptography

# ─────────────────────────────────────────────
# SETUP: VPN client and server share a secret key
# In real VPNs this key exchange uses protocols like TLS or Diffie-Hellman
# ─────────────────────────────────────────────
shared_secret_key = Fernet.generate_key()  # Generates a secure random 256-bit key
cipher = Fernet(shared_secret_key)          # The cipher object handles encrypt/decrypt

print(f"Shared secret key (base64): {shared_secret_key[:20]}...\n")  # Don't print full keys in prod!


def encapsulate_packet(original_payload: str, real_destination: str) -> dict:
    """Step 1 — Wraps the original request in a new packet (tunneling)."""
    inner_packet = f"DEST:{real_destination}|DATA:{original_payload}"
    return {"inner_packet": inner_packet}


def encrypt_packet(encapsulated: dict, cipher_suite: Fernet) -> bytes:
    """Step 2 — Encrypts the inner packet. The output is unreadable without the key."""
    raw_bytes = encapsulated["inner_packet"].encode("utf-8")
    encrypted = cipher_suite.encrypt(raw_bytes)  # AES encryption under the hood
    return encrypted


def transmit_to_vpn_server(encrypted_data: bytes, vpn_server_ip: str) -> dict:
    """Step 3 — Sends encrypted payload to VPN server. Outer packet only shows VPN IP."""
    outer_packet = {
        "visible_destination": vpn_server_ip,  # This is all your ISP sees
        "visible_source": "203.0.113.42",       # Your real IP (VPN server knows this)
        "encrypted_payload": encrypted_data     # Gibberish to any observer
    }
    return outer_packet


def vpn_server_receives(outer_packet: dict, cipher_suite: Fernet) -> tuple:
    """Step 4 — VPN server decrypts the payload and extracts the real destination."""
    decrypted_bytes = cipher_suite.decrypt(outer_packet["encrypted_payload"])
    decrypted_text = decrypted_bytes.decode("utf-8")
    
    # Parse destination and data from decrypted inner packet
    parts = dict(item.split(":", 1) for item in decrypted_text.split("|"))
    real_destination = parts["DEST"]
    original_data = parts["DATA"]
    
    return real_destination, original_data


def forward_request(real_destination: str, data: str, vpn_server_ip: str) -> str:
    """Step 5 — VPN server forwards to real destination. Site only sees VPN server IP."""
    print(f"  VPN server ({vpn_server_ip}) is requesting: {real_destination}")
    print(f"  Original data: {data}")
    print(f"  From destination's perspective — request came from: {vpn_server_ip}")
    return f"Response from {real_destination}: 200 OK, here is your content."


# ─────────────────────────────────────────────
# SIMULATE THE FULL JOURNEY
# ─────────────────────────────────────────────
VPN_SERVER_IP = "198.51.100.10"
USER_REQUEST = "GET /account/balance"
TARGET_SITE = "my-bank.com"

print("--- STEP 1: Encapsulate (wrap original packet) ---")
encapsulated = encapsulate_packet(USER_REQUEST, TARGET_SITE)
print(f"  Inner packet: {encapsulated['inner_packet']}\n")

print("--- STEP 2: Encrypt ---")
encrypted = encrypt_packet(encapsulated, cipher)
print(f"  Encrypted (what ISP sees): {encrypted[:40]}...\n")  # Just a preview

print("--- STEP 3: Transmit to VPN server ---")
outer_packet = transmit_to_vpn_server(encrypted, VPN_SERVER_IP)
print(f"  ISP only sees: {outer_packet['visible_source']} → {outer_packet['visible_destination']}\n")

print("--- STEP 4: VPN server decrypts ---")
destination, payload = vpn_server_receives(outer_packet, cipher)
print(f"  Decrypted destination: {destination}")
print(f"  Decrypted payload: {payload}\n")

print("--- STEP 5: Forward to real destination ---")
response = forward_request(destination, payload, VPN_SERVER_IP)
print(f"\nFinal response received by you: {response}")

# WireGuard VPN Configuration File — Client Side
# This is a REAL WireGuard config format used in production.
# Save this as /etc/wireguard/wg0.conf on Linux systems.
# Run: sudo wg-quick up wg0    (to connect)
# Run: sudo wg-quick down wg0  (to disconnect)

[Interface]
# Your device's private key (generated with: wg genkey)
# NEVER share this. Keep it secret. Keep it safe.
PrivateKey = sKmQzT3vXbL9nYqR2pW8eA1fGcH7dJ0iOuN5mKlV4=

# The IP address your device gets INSIDE the VPN tunnel
# 10.0.0.0/8 is a private address range — only exists within the VPN
Address = 10.0.0.2/24

# Use the VPN server as DNS resolver to prevent DNS leaks
# (Without this, DNS queries bypass the VPN — a common security hole)
DNS = 1.1.1.1

[Peer]
# The VPN server's PUBLIC key (safe to share — this is NOT the private key)
PublicKey = GhT4nM7pQrS2dK1aF9oY6bX3cE5wJ8vU0iL2mN4lP=

# AllowedIPs = 0.0.0.0/0 means ALL traffic goes through the VPN
# (This is 'full tunnel' mode — maximum privacy)
# Alternative: list specific IPs to only route certain traffic through VPN
# (That's called 'split tunneling' — useful for performance)
AllowedIPs = 0.0.0.0/0, ::/0

# The VPN server's real public IP address and port
# Port 51820 is WireGuard's default
Endpoint = 198.51.100.10:51820

# Sends a keepalive packet every 25 seconds
# Required if you're behind NAT (like a home router) to keep the tunnel alive
PersistentKeepalive = 25

# A simple decision tool that outputs VPN recommendations
# based on a user's situation — demonstrates VPN use cases in code

def assess_vpn_benefit(situation: dict) -> str:
    """
    Evaluates whether a VPN meaningfully helps in a given situation.
    situation: dict with boolean flags describing the user's context.
    Returns a recommendation string.
    """
    benefits = []
    warnings = []
    
    # Scenario 1: Public Wi-Fi is the #1 legitimate use case
    if situation.get("on_public_wifi"):
        benefits.append("✅ Strong benefit: Protects you from snooping on untrusted networks.")
    
    # Scenario 2: ISP data selling — real concern in US, UK, Australia
    if situation.get("worried_about_isp_tracking"):
        benefits.append("✅ Real benefit: ISP can no longer see your browsing destinations.")
    
    # Scenario 3: Remote work / corporate access — the original VPN use case
    if situation.get("accessing_corporate_network"):
        benefits.append("✅ Essential: VPN is the standard way to access private company resources remotely.")
    
    # Scenario 4: Geographic restriction bypass
    if situation.get("want_different_geo_location"):
        benefits.append("✅ Works: VPN server's location appears as your location to websites.")
    
    # Scenario 5: Logged into personal accounts — VPN doesn't help here
    if situation.get("logged_into_google_or_facebook"):
        warnings.append("⚠️  Limited benefit: Google/Facebook track by account, not IP. VPN won't hide your activity from them.")
    
    # Scenario 6: Malware concern — VPN is the wrong tool
    if situation.get("worried_about_malware"):
        warnings.append("❌ Wrong tool: VPNs don't block malware. Use antivirus + uBlock Origin instead.")
    
    # Scenario 7: Untrusted VPN provider
    if situation.get("using_free_vpn_with_no_audit"):
        warnings.append("❌ Danger: Free unaudited VPNs often log and sell your data — worse than no VPN. Use Mullvad, ProtonVPN, or a self-hosted solution.")
    
    output = ["\n=== VPN Benefit Assessment ==="]
    
    if benefits:
        output.append("\n📗 Where a VPN helps you:")
        output.extend(benefits)
    
    if warnings:
        output.append("\n📕 Where a VPN won't (or might hurt):")
        output.extend(warnings)
    
    if not benefits and not warnings:
        output.append("Neutral situation — VPN neither particularly helps nor hurts.")
    
    return "\n".join(output)


# --- Example: Developer working remotely from a café ---
developer_at_cafe = {
    "on_public_wifi": True,
    "worried_about_isp_tracking": True,
    "accessing_corporate_network": True,
    "want_different_geo_location": False,
    "logged_into_google_or_facebook": True,   # Still logged in — VPN won't hide this
    "worried_about_malware": False,
    "using_free_vpn_with_no_audit": False
}

result = assess_vpn_benefit(developer_at_cafe)
print(result)