What Is a VPN? How the Tunnel Works and What It Can't Do

In everyday life

When you start a new job, you may be told to connect to the VPN before working outside the office. In a hotel or café, you may see ads for apps that say a VPN keeps you safe. In the news, you may read that attackers got in through a VPN device.

The word is the same, but the purpose is a little different in each case. This article first looks at what a VPN does, step by step. Then it separates what a VPN can do from what it cannot.

What a VPN is: a private lane on a public road

For a long time, companies have linked distant sites, such as a head office and a factory, with dedicated lines. No one else's traffic runs on them, so they are safe, but they are expensive. So people found a way to use the shared internet like a dedicated line, with the help of encryption. Encryption uses a fixed procedure and a "key" to turn data into a form that people without the key cannot read.

This is called a VPN (virtual private network). "Virtual" means no real private line is laid. Instead, clever design makes a shared line work like a private one. The actual traffic travels over the same internet lines as everyone else's.

A VPN changes the path your traffic takes

Normally, when you open a web page on your phone, the traffic goes over Wi-Fi or the mobile network straight to the site. The site sees the IP address of your connection, which is its address number on the internet. "What Is an IP Address?" explains how these addresses work.

With a VPN, your traffic goes to a VPN server first. A VPN server is the computer at the exit of the tunnel. The link between your phone and the VPN server is encrypted. The VPN server then talks to the site for you. The site sees the VPN server's address, not yours.

How it works: wrapping the whole packet

On the internet, data is sent in small chunks. Each chunk is called a packet, and each one carries a destination address. "How Is Data Sent Over the Internet?" explains this in more detail.

In many VPNs, the software encrypts each packet you want to send as a whole, destination included. It then puts the result inside a new packet addressed to the VPN server. Wrapping one packet inside another like this is called "encapsulation."

The VPN server takes the contents out of each packet that arrives and uses the key to restore them. Then it sends the original packet on to its real destination. Devices along the way see only the outer address, which points to the VPN server. The stretch where packets travel wrapped up like this is what VPNs call the "tunnel."

Main types of VPN

There are several methods, which differ in how they wrap packets and agree on keys. Here we only give their names and main features. "What Is Encryption?" explains how encryption and keys work.

• IPsec: A standard method that adds encryption to IP, the internet's basic set of rules. It is often used for VPNs that link offices.
• SSL VPN: A general name for methods that use TLS, the same protocol HTTPS uses. The name keeps "SSL," the older protocol that came before TLS.
• OpenVPN: VPN software whose code is public. It uses TLS.
• WireGuard: A newer method that is kept deliberately small. It has been built into Linux itself since Linux 5.6, released in March 2020. Linux is an OS widely used on servers and other machines.

Use 1: Company VPNs (remote-access VPNs)

Some company file storage and internal systems can only be used from inside the company network. Letting anyone connect from outside would be dangerous. To use them from home or on a business trip, employees connect their laptops to the company's VPN device. This is called a "remote-access VPN."

Once connected, the laptop is treated as if it were inside the office. Company rules often require employees to use the VPN. Turning it off or using another VPN may break those rules. Depending on the company's settings, all web browsing may also pass through the company while you're connected. In that case, the company can keep records of the traffic.

Another type is the site-to-site VPN. It links the networks of a head office and a branch through devices placed where each building connects to the outside. Employees don't notice the VPN, and they can use printers and servers at the other office.

Use 2: Consumer VPN services

Some services let you install an app on your phone or computer and connect to the provider's VPN server. They have two main purposes. One is to make your traffic harder to watch on public Wi-Fi, such as in stations and cafés. The other is to make it look as if you're connecting from where the VPN server is.

However, streaming and other services sometimes ban the second use in their terms of service. Some services also detect VPN server addresses and block those connections.

The key point is that a VPN only changes who can see what. The table below is a rough guide for opening an HTTPS site.

Either way, HTTPS keeps the page contents and what you type unreadable on the path. "What Does HTTPS Mean?" explains what can still be seen with HTTPS, such as the site's name. Turning a site's name into an address takes a lookup called DNS. Most VPN apps send these lookups through the tunnel too. But with some settings, they leak outside the tunnel, and your network provider can see the site's name.

What a VPN can't do

1. It doesn't make you anonymous

As the table shows, the VPN provider can see which sites you connect to, when, and how much. The US Federal Trade Commission (FTC) explains this in its advice to consumers. A VPN only shifts your trust to the VPN provider, and it won't make you completely anonymous. Also, if you log in to a site, the site knows who you are, even with a different address. Some providers advertise that they keep no logs, but users can hardly check this from outside.

2. It doesn't stop fake sites or malware

A VPN only protects the trip between your device and the VPN server. A fake site posing as a real company can trick you into typing your password. This trick, called phishing, reaches you through a VPN just the same. Files with harmful programs inside also arrive, simply encrypted on the way. If your device itself is infected, information is stolen before it ever reaches the VPN.

3. It doesn't make your connection faster

With a VPN, your traffic takes a detour through the VPN server. Wrapping also adds extra header data. So it is usually a little slower.

VPN devices themselves are targets

A company's VPN device is open to the internet so that employees can connect from outside. To an attacker, that makes it a door into the company. If the device has a flaw in its design or code, attackers can get in through it. Such a flaw is called a "vulnerability." In September 2021, CISA, the US government's cybersecurity agency, released guidance with the National Security Agency (NSA). It said VPN servers are entry points into a network and so are attractive targets. It explained how to choose them and how to harden them.

There are real cases. On January 19, 2024, CISA issued an emergency directive to US federal agencies. Vulnerabilities in Ivanti products, including a VPN product for reaching a company network from outside, were being widely exploited. On January 31, CISA added an order to disconnect the affected devices from their networks by February 2.

Japan shows the same pattern. A harmful program that encrypts a company's files and demands money to restore them is called ransomware. According to Japan's National Police Agency (NPA), 226 ransomware cases were reported in Japan in 2025. Victim organizations were asked how the attackers got in. More than 60% of the answers named VPN devices.

The NPA says attackers exploited unpatched vulnerabilities in devices, and passwords that had leaked or were easy to guess. The basic defenses are to apply device updates right away and to delete unused accounts. On top of that, use multi-factor authentication, which checks who you are by another means besides a password.

A new approach: zero trust

Company VPNs also have a weakness in their basic design. Once connected, you can reach much of the internal network. If attackers get in with a stolen password, they too are treated as "insiders."

This is why an approach called zero trust is spreading. It does not base trust on location, inside or outside the company. Each time someone uses a system or data, it checks who they are, whether the device is safe, and whether the use is needed. The US National Institute of Standards and Technology (NIST) published guidelines on this approach (SP 800-207) in August 2020.

Zero trust is not a product name. It is a design approach that organizations move to step by step. "Perimeter Security vs Zero Trust" compares it with the VPN approach in a table.

Common myths

By the numbers

The NPA's infection-route figures come from a survey of victim organizations. They count only cases where the route was known, so they do not cover every incident. Still, VPN devices were the most common route three years in a row. In 2024, remote desktop came next with 31 cases. Remote desktop lets someone control a distant computer as if sitting at its screen.

Learn more

• Compare VPNs and zero trust in a table: Perimeter Security vs Zero Trust
• Other defenses for company networks: Firewall vs IDS vs IPS vs WAF
• Encryption on public Wi-Fi, and what to watch for: "How Does Wi-Fi Work?"
• Name lookups and privacy: "How Does DNS Work?" (including methods that encrypt the lookups themselves)
• Making VPN passwords harder to crack: "How Are Passwords Cracked?"