It's the one thing when I'm configuring things that makes me wince because I know it will give me the business, and I know it shouldn't, but it does, every time. I have no real idea what I'm doing, what it is, how it works, so of course I'm blindly following instructions like a monkey at a typewriter.
Please guide me into enlightenment.
Let's say you want to talk to your friend. You have several protocols, Phone, Mail, Email, SMS, or maybe something stranger, like smoke signals or memes. Each protocol needs a different port.
Your friend doesn't answer phone calls or check VMs. The 'port' for phone calls is blocked. Nothing gets in through here.
Your friend only accepts email from certain addresses, like protonmail. This port is filtered. Only known things get in through here.
Your friend accepts any texts if they begin with the secret pass phrase. This port is open and filtered. Few unknown things get in through here.
Your friend accepts all postage. This port is open. Anything can get in through here. HTTP or HTTPS, your browser.
The VPN is sort of like an opaque tunnel you run from your house alongside public roads to some place you feel safe exiting, And then the usual steps in communicating. All of the communication has to go through the exit point back to the house.
If this kind of thing interests you, have a basic book for free. https://open.umn.edu/opentextbooks/textbooks/353
The short answer is, when your computer sends a message over the network, the IP address specifies which computer should receive the message, and the port specifies which program should receive the message.
The port is used by the destination computer to decide what program should process the request.
Any program on your computer that needs to be open to being contacted by another computer over the network needs to be assigned to a port. When the remote computer wants to contact that program, the IP address is used by intermediate networking computers to forward the message, and the port is used by your computer to pass the message to the right program. Blocking a port will prevent the program assigned to it from being contacted by other computers.
Some ports are traditionally assigned to some common programs. When you go to a website via http in a browser, it uses port 80 if you don’t specify. If you use https, it uses port 443. SSH uses port 22 by default. You can host an ssh server or http website on a different port, those are just the common conventions. If an http website is hosted on a port other than 80, the user will need to specify the port number in the browser as part of the url.
VPNs are usually not so much about ports, more about IP addresses. When your computer wants to contact another computer, it normally sends the request to the router, and that router forwards that request either to another computer on LAN or to the ISP, and that ISP forwards the request and so on… based on the IP address. If you are using a VPN, that VPN will override certain IP addresses. When a message would be sent to one of those IP addresses, instead it gets packaged and sent to the IP address specified in the VPN config, and the computer on the other side of the VPN decides where to send the message from there. The router sends the packages message to the VPN computer, but doesn’t get to know what the IP of the packaged message is (by packaged I mean encrypted, and with some metadata).
Where VPNs and Ports end up being relevant is probably in relation to port forwarding. Normally your computer can make requests to the internet, but can’t be contacted by the internet. This is because your entire LAN shares a public (WAN) IP address, and the router is the device that receives all messages to that IP address. Normally the router discards such incoming messages, but if you set up port forwarding, the router will forward messages for a certain port to a certain computer on the LAN.
A VPN can allow your computer to receive incoming requests without opening a port on the router. When a request meeting requirements specified in the VPN config is received by the computer on one side of the VPN, it will be forwarded to the computer on the other side of the VPN. For a public VPN (the kind you would pay for that are typically advertised as a privacy tool or a way to get around Netflix geofencing), you can sometimes configure port forwarding, meaning any request sent to that port on the VPN’s server will get forwarded to your computer connecting to the VPN (typically to the same port, so what happens to that request is up to you to configure a program to be assigned to that port).
The other way a VPN can be used for that kind of contact is when it maps all requests to any port on a set of IP addresses. This is typically how office VPNs are configured, as it lets a remote user access things on the office network as if that user was in the office.
Note that a VPN is itself a pair of programs communicating with each other like any other program, so typically setting up a VPN requires one of the computers to be exposed to the internet (or at least have ports set up for that). For a public paid VPN the VPN’s servers will be exposed to the internet, and for a corporate VPN the corporate servers will be closed, such that the client doesn’t have to.
Some common VPN software (e.g. WireGuard) is free and open source and can be configured in a lot of different ways! These two common use cases are just the most common ways to configure VPNs, but if you have some creative use case, there’s a lot you could do with it.
- Show
The top cat uses ports to sort messages based on application.
Show
Think pigeon holes, applications usually use protocols which are assigned a number by convention. The application gets it's message out of it's assigned ports instead of having to sort through all the messages.
Think of the Internet as being able to send opened letters with a destination address and return address. Anyone that handles the letter to help deliver it can see what it says, who's sending it, and where it's going.
A VPN is like asking a company to help you transmit the letter with more privacy. The VPN creates a secret code between you and the VPN, so that only you two understand what is in the letter. Then, the VPN communicates with whomever while not sharing your identity so that no one knows who you are unless you specifically tell them in the letter.
Say you want to know what the symptoms you're experiencing after a sexual encounter are, but you're embarrassed and don't want anyone to suspect anything in case it's nothing. You tell your VPN you want to send a letter to the medical info center. The VPN tells you to use a code that was created automatically so that no one knows what it means besides you and their code machine, and was sent to you earlier when you signed up for their service or at a regular update. "Use code 5 we sent you last week." You write the letter and address in code 5, then address it in normal language to the VPN, sending it via the mail system. The VPN machine translates the code to normal language but changes the return address to its own address. The medical info center receives a letter saying that the VPN wants to know the info you requested, so they respond. The VPN receives the info, translates it back to code 5, and sends the info to you.
As far as everyone in the mail system is concerned, you sent and received info from the VPN, but only you know what it was because the mail system couldn't understand it, and the VPN handled it through an automated machine. The medical mail system and medical info center then knows what the letter said, but thinks the VPN requested that info, so they don't know it was you. Since the VPN handles tons of mail, no one knows who is requesting what specific info through the VPN.
Note: This assumes the VPN doesn't keep logs. Some VPNs might actually track what you send, so they could keep track of your messages. That's why people that value privacy recommend to use VPNs that don't keep logs.
VPN: you give your mail to a dude who puts it in a plain suitcase and goes with it to the VPN company's HQ. Nobody knows whose mail he's got or where it's headed. When that dude gets to the VPN company's office he gives that envelope to another dude who carries it to the destination. If someone's peeping they can only see the dude going from your place to the VPN place or from the VPN place to the destination, not from your place to the destination.
"porte" in French means a door.
Imagine each port is a door, all neatly aligned... some of them can be opened and lead to something... (a service)
