VPN: How Does It Work? Tunnels, Encryption and Limits Explained

A VPN (virtual private network) works by creating an encrypted “tunnel” between your device and a server run by the VPN provider, then sending all your internet traffic through that tunnel. Your internet provider and anyone on your local Wi-Fi only see scrambled data heading to the VPN server, while the websites you visit see the VPN server’s IP address instead of yours.

That’s the short version. Below is what actually happens under the hood, which protocols do the work, and — just as important — what a VPN does not protect you from.

What happens when you press “Connect”

Every consumer VPN follows roughly the same sequence, whatever the app looks like.

1. Your app contacts a VPN server. You pick a location (or the app picks one), and the client on your device opens a connection to that server over the normal internet.
2. Both sides authenticate and agree on keys. Your device and the server prove who they are, then run a key exchange to agree on secret encryption keys for this session. Nobody watching the network can work out those keys from what they see.
3. A virtual network interface is created. Your operating system gets a new network adapter (the “tunnel” interface), and the routing table is changed so that traffic goes to that adapter instead of straight out through your Wi-Fi or Ethernet.
4. Each packet is encrypted and wrapped. When an app sends data, the VPN client encrypts the original packet — including where it’s going — and wraps it inside a new packet addressed only to the VPN server. This wrapping is called encapsulation.
5. The server unwraps and forwards it. The VPN server decrypts the packet, swaps your address for its own, and sends the request on to the website.
6. Replies come back the same way. The website answers the VPN server, which encrypts the response and sends it back down the tunnel to your device, where the client decrypts it.

From the outside, your device seems to be having one long encrypted conversation with a single server. The real destinations are hidden inside.

Encryption and keys, in plain terms

Two kinds of cryptography work together in a VPN:

• Key exchange (public-key cryptography) lets two machines agree on a shared secret over an open network. It’s slow, so it’s used only to set things up.
• Symmetric encryption then uses that shared secret to encrypt the actual traffic quickly. It is combined with authentication so that tampered packets are detected and dropped.

WireGuard is a good example because its design is published openly. According to the official WireGuard site, it is built on the Noise protocol framework and uses Curve25519 for key agreement, ChaCha20 for encryption, Poly1305 for message authentication, plus BLAKE2, SipHash24 and HKDF for hashing and key derivation.

WireGuard also illustrates a neat idea it calls cryptokey routing: each peer’s public key is tied to the tunnel IP addresses it’s allowed to use. When sending, that list acts like a routing table; when receiving, it works like an access control list, so a packet is only accepted if it was encrypted by the key that is allowed to use that address.

The main VPN protocols compared

The “protocol” is the set of rules a VPN uses for the steps above. Most reputable apps let you choose between a few. Here’s how the common ones differ, based on IVPN’s protocol comparison and the official WireGuard documentation:

Speed claims vary a lot between sources and depend heavily on hardware, server load and distance, so treat any benchmark as specific to that test setup. A practical rule of thumb: start with WireGuard (or your provider’s WireGuard-based protocol), and switch to OpenVPN over TCP if a network blocks you.

What a VPN hides — and from whom

It helps to think about who sits where on the path.

The last row is the one people forget. A VPN doesn’t remove the need for trust; it moves it from your ISP or the café’s Wi-Fi to the VPN company. That’s why logging policies, independent audits and the company’s track record matter more than the number of server locations.

What a VPN does not do

The FTC’s guidance on VPN apps is blunt: VPN apps don’t make you completely anonymous, and some apps studied by researchers didn’t encrypt traffic properly, requested sensitive permissions, or shared data with third parties for marketing and analytics. The FTC advises researching an app and reading its privacy policy before installing it. That guidance dates from 2018, but the underlying advice still applies.

Beyond that, a VPN can’t help with:

• Logins and cookies. If you’re signed into an account, the site knows it’s you no matter what IP you use. Cookies and other browser storage also survive a VPN connection.
• Browser fingerprinting. Sites can recognize your browser from its configuration without relying on your IP address.
• Malware and phishing. A VPN encrypts the path; it doesn’t check whether what you download or the site you log into is safe.
• What you share yourself. Anything you type into a form goes to that site as normal.

Leaks: when traffic slips outside the tunnel

A VPN only protects traffic that actually goes through the tunnel. Two common gaps:

• DNS leaks. If your device still asks your ISP’s DNS servers to look up website names, your ISP can see which domains you visit even though the traffic itself is encrypted. Good VPN apps route DNS through the tunnel.
• Drops in the connection. If the tunnel disconnects, your device may quietly fall back to your normal connection. A kill switch blocks internet access until the tunnel is back.

Kill switches aren’t perfect. When RTINGS tested kill switches across 20 VPNs, it found that they don’t stop every kind of leak, which is worth keeping in mind if you rely on a VPN for anything sensitive.

How to check your VPN is actually working

You don’t need special tools to do a basic sanity check:

1. Note your public IP address on an IP-lookup site with the VPN off.
2. Connect the VPN and reload the page. The IP and approximate location should now match the VPN server.
3. Run a DNS leak test from a reputable site. The DNS servers listed should belong to your VPN provider, not your ISP.
4. In the app settings, confirm the kill switch is turned on and note which protocol you’re using.
5. Repeat after app updates or when you change networks, since behaviour can change.

The bottom line

A VPN is an encrypted tunnel plus a change of address: it shields your traffic from the local network and your ISP, and shows websites the server’s IP instead of yours. It’s genuinely useful on public Wi-Fi and for keeping your browsing away from your ISP. It is not an anonymity tool, and it only works as well as the provider you trust with your traffic. Protocol options and app features change over time, so check your provider’s current documentation — the details above are accurate as of November 2026.