How does a backdoor in the RNG enable an attacker to break encryption protocols? I'm wondering how a backdoor in a random-number generator (as rumored the NSA have placed), actually compromises the security of things like VPNs or TSL/SSL.

What I understand is that, if such a backdoor exists, then after observing a certain number of pseudorandom bits, the attacker can then predict the rest of the pseudorandom sequence. 

Can someone walk through the steps of how this allows an attacker to actually read encrypted packets?  For example, how would an attacker get access to the first N random bits of a pseudo-randomly generated key in the first place.  Is the problem that any random key is effectively only N bits long because if an attacker guesses the first N correctly, he can generate the rest of the key using the backdoor?  Or is it something more complicated.
There are three ways a RNG can fail


Insufficient randomness in the input
Losing randomness as a result of the random transformation
Leaking bits through an intentional or unintentional side channel


Each fail weakens things. A backdoor in a random number generator is like actively implementing such a fail, introducing possible ways to lower the security of the random number generator since it becomes less random. 

It it's not as if a backdoor in a random number generator always directly breaks things like SSL, but they can have the ability to. The real problem is that a well constructed backdoor is near to undetectable, while allowing an attacker to take security shortcuts that wouldn't be available normally. And that would happen without the person using the RNG for security purposes noticing the backdoor. 

Imagine using such a backdoor to seed something... it would look perfectly random to you, but the one who implemented the backdoor might be able to recover the whole state of the RNG by just looking at - let's say - 32 bits. That would mean you're in big-big trouble. Now imagine you feel good, safe and secure because you aren't aware of a backdoor lurking behind the screens... get a creepy feeling? Good!

Practically describing it all would be too broad, and giving you a walk-trough would be too long and too technically detailed... but if you want to learn a bit more generally why a backdoor in an RNG might be a real security issue, you could read a bit about it in "The Many Flaws of Dual_EC_DRBG " which talks about a prominent, recent backdoor in an RNG and shows what practical impacts it would have had on cryptographic implementations: 


  If I use the Dual-EC PRG to generate the "Client Random" nonce transmitted in the beginning of an SSL connection, then the NSA will be able to predict the "Pre-Master" secret that I'm going to generate during the RSA handshake. Given this information the connection is now a cleartext read. This is not good.