So, I am trying to understand my VPN connection observing the traffic in Little Snitch. My VPN is connected and I can see its connection to the server and the amount of data that is transfered. Shouldn't go all my data through this connection? Why is there, for example Firefox, connecting to a huge amount of IP-Adresses and sending/receiving a huge amount of data? When observing the map it looks like the connections start at my 'real location'. I looked up my IP on the browser and everything seems to be working fine.

Just wanted to understand the causal chain of data flow for Example googling something in Firefox.

Thanks for your answers!

  • VPNs are used for different purposes. The original purpose is to create a safe tunnel, for example to communicate with your employers internal network. An alternative purpose is to hide your traffic from your provider or to make your traffic appear to be coming from elsewhere as seen by the server you connect to. Note that there is also something called split-tunneling which means that only part of your traffic is sent through the VPN tunnel while the rest travels over your standard connection. You should improve your question by letting us know what kind of VPN you are speaking of. – not2savvy Mar 31 at 7:24

A VPN is nothing more than a different connection to the internet. Without the VPN it looks like this:

Mac -> Local Network -> your Router -> your ISP -> the internet

This is vastly simplified, if course, but will work for what we are doing here.

The VPN is a TUNNEL that starts at your Mac and ends not at the network and servers of your ISP (AT&T, Spectrum, Verizon, etc.) but at the servers and networks of the VPN provider.

Mac -> VPN Tunnel -> (your Router) -> (your ISP) -> (Your VPN provider) ->the internet

That pathway above stays the same but it is like running a tube between your Mac and the internet in that your router, ISP and VPN provider, cant see what is in the VPN tunnel, as it is hidden by the VPN.

And instead of your traffic exiting your ISP for the internet in your town, it exits the VPN provider's network anywhere you want it to. Prague, Milan, Mexico City, Vancouver, Miami, wherever they have "exit points."

The key point here is that the VPN provides a secure tunnel between you and the end of the VPN. No one can spy on any traffic between those two points.

But everything on your Mac (or PC) still talks to everything that you point it to.

So if you browse the web using Firefox, it will still connect to every website you point it at. Not to mention all the cookies and tracking code that the website collects on you.

You are not being protected from what the website (and Firefox allows it to) does. You are being protected from being spied on between your Mac and the VPN exit point. And you can CHOOSE that end point. And Little Snitch still sees all of that activity, it is just going through the VPN. But it is still going.

The most common reason for a VPN is still my ability to connect back to my work network securely. The VPN creates a (virtual) tunnel (a private network) between my Mac or PC at home to my work network. This allows me onto that network as if I were sitting at my desk. And if I then google something the traffic exits from my work network and goes and connects to google.

A personal VPN, like you have allows you to appear as if you are surfing the web from the next town, state, country or continent and no one can tell where you are actually from. So your ISP may be in in Dallas Texas but with the VPN it looks like you are in Vancouver, BC, Canada.


No answer to your question, but a few safety tips on Little Snitch before you use it.

Little Snitch installs a kernel extension (kext) to read network traffic. This gives Little Snitch root privileges. Little Snitch looks at all network traffic and is therefore vulnerable to any network traffic. The root rights promise big booty if successful: Full control over Little Snitch and the computer.

If you want to secure your system, you should not increase its attack surface, but reduce it. The less software that runs with root rights, the better. This is a very unique Unix principle. If you mess up your system with 3rd party kexts, you can put an invitation label on the outside right away, because there are errors in every software. The only way to minimize the risk is to run as little as possible under root.

Can Little Snitch really control all traffic that goes out or comes in from the computer? Due to the principle: No! Why? All software on the computer can be compromised. Little Snitch isn't the only piece of code that runs under root on the Mac. A malware that also comes onto the computer as a Trojan or through a bug or in some other way, and also has root rights or gains these through another bug, can simply bypass Little Snitch, blind them at the necessary places, or deceive network traffic in front of Little Hide Snitch, make Litte Snitch completely useless.

But maybe some other software can't ...? No! The only way to reliably control what the computer is doing with the network is to examine the traffic on the next router to the Internet. No firewall, no software on the computer itself can tell you which traffic is really going in or out of your computer.

What is Little Snitch good for then? To review good-natured software that doesn't want to hide anything. An approach that runs on the victim's computer is completely unsuitable for checking malicious software.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .