What Is a VPN? How Virtual Private Networks Work

A VPN, or virtual private network, creates an encrypted tunnel between your device and a remote server, routing your traffic through that tunnel so anyone observing the network in between — your ISP, a coffee shop’s Wi-Fi, an untrusted network operator — sees only encrypted bytes headed to the VPN server, not the actual sites or services you’re reaching.

How the tunnel works

Without a VPN, your traffic travels in whatever form the application layer provides — HTTPS encrypts the payload of a web request, but the destination (the domain you’re connecting to) and the fact that a connection exists at all are still visible to anyone on the network path. A VPN adds another layer: your device establishes an encrypted tunnel to a VPN server first, and every packet — regardless of which application generated it — travels through that tunnel before reaching its real destination.

From the perspective of the network you’re physically connected to, all it sees is an encrypted stream going to one IP address, the VPN server. From the perspective of the destination server you’re actually talking to, the traffic appears to originate from the VPN server’s IP address, not your own.

The tunnel itself is built using one of several protocols — OpenVPN, WireGuard, and IPsec are the most common — which handle the handshake, key exchange, and ongoing encryption of the tunnel, conceptually similar in purpose to the TLS handshake that secures an individual HTTPS connection, but applied to all traffic rather than one connection at a time.

What a VPN actually hides — and what it doesn’t

A VPN hides your traffic’s contents and destination from anyone on the local network segment between you and the VPN server, and it hides your real IP address from the destination servers you connect to, since they only see the VPN server’s IP. That’s genuinely useful on untrusted networks, or when you don’t want your ISP building a browsing profile from unencrypted DNS lookups and connection metadata.

It does not make you anonymous to the VPN provider itself — the provider can see everything your ISP would have seen, since the tunnel terminates at their server before continuing to the open internet. It also doesn’t protect you from anything happening above the network layer: if a site sets a tracking cookie, logs you in with an account, or you provide identifying information yourself, a VPN doesn’t erase that. And it does nothing to stop phishing, malware, or a compromised endpoint — the tunnel only protects data in transit, not the security of the device sending it.

Corporate VPNs vs consumer VPNs

The term “VPN” covers two fairly different use cases. A corporate or remote-access VPN lets employees reach internal resources — file servers, internal tools, databases — that aren’t exposed to the public internet, by tunneling into the company’s private network as if the employee’s laptop were physically on-site. This is largely being displaced by zero-trust architectures, which authenticate and authorize each request to each resource individually instead of granting broad network access once a VPN tunnel is up — a compromised laptop on a traditional VPN can often reach far more of the internal network than a zero-trust policy would ever allow.

A consumer VPN routes a device’s general internet traffic through a commercial provider’s server, primarily to hide browsing from local networks and ISPs, or to appear to be connecting from a different region. The two use cases share the same underlying tunneling technology but solve different problems — one is about network access control, the other is about traffic privacy and the appearance of a different origin location.

VPN vs other privacy and security layers

	VPN	HTTPS	Zero-trust network access
Protects	All device traffic in transit	One connection’s payload	Access to specific resources
Hides destination from local network	Yes	No (SNI/DNS often visible)	N/A
Hides traffic from the provider	No	Yes, end-to-end	Depends on architecture
Grants broad network access	Yes, to the VPN’s network	No	No, per-resource authorization

Where VPNs fit alongside other network tools

A VPN operates at the network layer, tunneling whole-device traffic, which is a different job from a WAF filtering malicious requests at an application’s edge, or mTLS authenticating individual service-to-service connections inside a data center. If you’re planning IP address ranges for a VPN’s internal network — deciding how many devices a subnet needs to support — a subnet calculator is a quick way to check the math without doing binary arithmetic by hand. And a VPN doesn’t replace DNS security either — depending on configuration, DNS lookups may or may not be routed through the tunnel, which is a common source of accidental leaks.

The takeaway

A VPN encrypts and tunnels your device’s traffic to a remote server, hiding the traffic’s contents and destination from your local network and masking your IP address from the sites you visit. It doesn’t make you anonymous to the VPN provider, doesn’t protect against threats above the network layer like phishing or malware, and for corporate remote access is increasingly being supplemented or replaced by zero-trust models that authorize each resource individually instead of granting broad network access through a single tunnel.