What is a VPN? How Virtual Private Networks Actually Work

What is a VPN?

A Virtual Private Network (VPN) is a technology that creates an encrypted tunnel between your device and a VPN server operated by the VPN provider. All of your internet traffic is routed through this tunnel and exits onto the internet from the VPN server's IP address rather than your own.

The "virtual" refers to the fact that this private network exists in software, not in dedicated physical infrastructure. The "private" refers to the encrypted, isolated nature of the tunnel — other network participants cannot inspect its contents.

Originally, VPNs were developed for corporate use: allowing employees to securely access internal company networks from remote locations over the public internet. Consumer VPNs, marketed primarily for privacy and bypassing geo-restrictions, are a later application of the same technology.

How VPN Tunnelling Works

When you connect to a VPN, your device and the VPN server establish an encrypted tunnel through the following process:

1. Authentication: Your VPN client authenticates to the VPN server, typically via a username/password or certificate. This confirms you are an authorised user.
2. Key negotiation: The client and server perform a cryptographic key exchange to establish session encryption keys. These keys are unique to this session.
3. Encapsulation: Every network packet your device sends is wrapped (encapsulated) inside an encrypted outer packet. The outer packet has the destination address of the VPN server; the inner packet has your original destination (e.g., a website's IP).
4. Transit: The encrypted packets travel to the VPN server over the public internet. Your ISP can see you are sending data to the VPN server's IP address, but cannot read the contents.
5. Decapsulation and forwarding: The VPN server decrypts the outer packet, extracts the inner packet, and forwards it to the actual destination (the website you wanted to visit). The website sees the VPN server's IP address as the origin, not yours.
6. Return traffic: The response from the website is sent back to the VPN server, which encrypts it and sends it back through the tunnel to your device.

VPN Encryption

Most modern VPNs use AES-256-GCM symmetric encryption for the data tunnel — the same encryption used by governments and militaries worldwide. 256-bit AES provides 2²⁵⁶ possible keys, making brute-force attacks computationally impossible.

The key exchange — establishing the shared secret — typically uses ECDH (Elliptic Curve Diffie-Hellman) or similar algorithms. These allow two parties to establish a shared secret over a public channel without ever transmitting the secret itself. WireGuard uses Curve25519 for this purpose.

Authentication uses either certificates (X.509) or pre-shared keys, depending on the protocol and deployment.

VPN Protocols Compared

Protocol	Speed	Security	Use Case
WireGuard	Very Fast	Excellent	Modern default
OpenVPN (UDP)	Fast	Excellent	Cross-platform, trusted
OpenVPN (TCP)	Moderate	Excellent	Firewall traversal
IKEv2/IPsec	Fast	Excellent	Mobile (fast reconnect)
L2TP/IPsec	Moderate	Good	Legacy systems
PPTP	Fast	Poor	Avoid — deprecated

WireGuard is the modern recommendation. It was designed from the ground up for simplicity and performance, with a codebase of only about 4,000 lines (compared to hundreds of thousands for OpenVPN). Fewer lines of code means fewer potential vulnerabilities and easier security auditing. Its cryptography uses only modern, well-analysed algorithms.

What a VPN Actually Protects

A VPN provides genuine protection in specific scenarios:

• On public Wi-Fi: Coffee shops, airports, and hotels have untrusted networks where other users could potentially monitor your traffic. A VPN encrypts your traffic before it leaves your device, protecting it from local eavesdroppers.
• From your ISP: Without a VPN, your ISP can see every domain you visit (via DNS queries and connection metadata, even for HTTPS sites). A VPN hides this from your ISP — though the VPN provider itself can see it instead.
• IP address masking: Websites you visit see the VPN server's IP address, not yours. This makes it harder to correlate your browsing across different sites based on IP alone.
• Geo-restriction bypass: If a service is restricted to certain countries, connecting through a VPN server in an allowed country makes the service believe you are located there.

What a VPN Does NOT Do

Real Use Cases for VPNs

Given the above, VPNs are genuinely useful in these scenarios:

1. Protecting traffic on untrusted networks — the clearest and most legitimate use case.
2. Bypassing ISP throttling — some ISPs throttle certain types of traffic; a VPN hides the traffic type.
3. Accessing geo-restricted content — streaming services, news sites with country restrictions.
4. Remote access to company networks — the original corporate use case.
5. Hiding browsing from ISPs — useful in jurisdictions with mandatory data retention laws.

Corporate VPNs vs Consumer VPNs

Corporate VPNs connect employees' devices to a private company network. The traffic exits the tunnel into the corporate network (not the public internet), enabling access to internal resources like file servers, intranets, and databases. Security is managed by the IT team.

Consumer VPNs route all your traffic through a commercial provider's servers that connect to the public internet. The provider substitutes for your ISP in terms of seeing your traffic. You are trusting the VPN provider instead of your ISP — make sure you understand the difference in logging policies and jurisdiction.

For maximum privacy, look for a VPN provider that has undergone an independent third-party security audit and has a verified no-logs policy confirmed by having their infrastructure seized without resulting in user data disclosure.