How a VPN Works: Tunnels, Encryption and Limits
A VPN wraps your traffic in an encrypted tunnel to another network. Here is how that works, which protocols are used and what a VPN cannot hide from others.
In this article
A virtual private network, or VPN, stretches a private network across a public one such as the internet. It does this by placing your data inside encrypted packets and sending them to a VPN server, which forwards them on. The main point to remember is that a VPN moves trust rather than removing it: the people between you and the VPN server can no longer read your traffic, but the VPN operator and the websites you visit still can see things. This article explains the tunnel, the common protocols, the main types of VPN and the limits.
The tunnel: wrapping one packet inside another
Data on the internet travels in small units called packets. A tunnelling protocol carries one network's messages from one computer to another by putting them inside packets that the public network knows how to deliver. The outer packet is addressed to the VPN server. The original packet, with its real destination, rides inside it.
On its own, tunnelling does not hide anything. The privacy comes from encryption. According to Wikipedia's article on VPNs, encryption protects data in transit and lowers the chance that someone listening on the network can read it. Some VPNs also add a message authentication code, a short value that lets the receiver detect and reject messages that were altered on the way.
What happens when you connect
- Your device and the VPN server agree on keys, usually by exchanging public keys or certificates.
- Your device encrypts each outgoing packet and wraps it in an outer packet addressed to the VPN server.
- The server unwraps and decrypts the packet, then sends it to its real destination.
- The reply comes back to the server, which encrypts it and sends it down the tunnel to you.
To the website at the other end, the request appears to come from the VPN server's internet address, not from yours. To your internet provider or the operator of a public Wi-Fi network, you appear to be talking only to the VPN server, and the contents are unreadable.
Types of VPN
Wikipedia describes three broad kinds. A remote-access VPN connects a single device, such as a laptop belonging to someone working from home, to an office or private network. Each device sets up its own tunnel. A site-to-site VPN joins whole networks: gateway devices at two locations link them together. When the sites belong to one organisation this is called an intranet VPN, and when they belong to several it is an extranet VPN. A third kind, a provider-provisioned VPN, is run inside a carrier's own network, with MPLS VPNs as one example.
The consumer VPN apps most people know are a form of remote access: your phone or computer connects to a server run by a company, and your traffic exits to the internet from there.
Common protocols
A protocol is an agreed set of rules for setting up and running the tunnel. Wikipedia lists these widely used ones, with dates as given there:
- IPsec (1996): a standards-based suite from the IETF, the body that writes internet standards. A part called IKE sets up the tunnels. Its IKEv2 version, developed by Microsoft and Cisco, copes well when a device's address changes, for example when a phone moves from Wi-Fi to mobile data.
- OpenVPN (2001): free, open-source software built on TLS, the same technology that secures websites. It supports modern ciphers such as AES.
- WireGuard (2015): designed to be lighter than OpenVPN. Wikipedia says Linux and Android kernels gained support for it in 2020.
- SSTP (2007): a Microsoft protocol that runs over SSL/TLS.
The WireGuard project's own website describes its goals as being faster, simpler and leaner than IPsec, and easy to set up, like SSH. It lists its cryptographic building blocks, including the Noise protocol framework, Curve25519 for key exchange, ChaCha20 and Poly1305 for encryption and authentication, and BLAKE2 for hashing. The project states that it keeps the code small so that individuals can audit it. Its design ties each peer's public key to a list of allowed tunnel addresses, and it sends replies to the most recent address from which it successfully decrypted data, which is how it handles a device changing networks.
What a VPN does not do
Wikipedia is direct about the limits. A VPN does not make you anonymous to your internet provider: the provider can see that you are connected to a VPN server, but not what is inside the tunnel. The VPN provider, however, can see your activity, and so can the websites you visit. If you log in to an account, the site knows who you are whatever address you appear to have.
Another limit is split tunnelling, a setting that lets some traffic go through the VPN and the rest go straight to the internet, which saves bandwidth. Wikipedia notes that it can cause DNS leaks, where address lookups escape the tunnel, and can bypass an employer's security controls.
Why organisations use them
Businesses use remote-access and site-to-site VPNs so that staff and branch offices can reach internal systems as though they were on the same local network. Individuals use VPN services on public Wi-Fi or to appear to browse from another place. Wikipedia estimates about 1.75 billion VPN users worldwide as of 2025, though it flags that some of the statements in its article lack citations, so figures like this are best treated as rough.
This is general information, not advice on which service or setting to use. Laws on VPN use differ between countries, and the rules of an employer or a streaming service may also apply.
Sources
Share
Keep reading
Related articles
How End-to-End Encryption Keeps Messages Private
End-to-end encryption means only the sender and receiver can read a message, not even the service carrying it. Here is how keys, ratchets and safety numbers fit together, and what it cannot protect.
How DNS Turns a Web Address Into an IP Address
DNS is the internet's phone book. See the steps a lookup takes, from your resolver to the root, TLD and authoritative servers, and why caching matters.
Wi-Fi 7 vs Wi-Fi 6: What Actually Changes
Wi-Fi 7 doubles channel width, packs more bits into each signal and lets a device use several links at once. Here is what that means and where the limits are.