What Is a VPN? How Virtual Private Networks Work

04 Oct What Is a VPN? How Virtual Private Networks Work

A VPN, or Virtual Private Network, creates a virtual connection between your device and another network across an existing network such as the Internet. VPNs commonly use tunneling, authentication, and encryption to protect traffic traveling between VPN endpoints.

VPN technology is used by individuals, businesses, cloud providers, and telecommunications operators for many different purposes. A person might use a VPN to securely access a public Wi-Fi network, while a business may use one to connect employees to corporate applications or connect geographically distributed offices.

At its core, a VPN creates a logical private network over infrastructure that may otherwise be shared with other users.

How Does a VPN Work?

Without a VPN, your device normally sends IP packets through your local network and Internet service provider toward their destination.

With a VPN, the process changes.

Your device first establishes a secure VPN tunnel to a VPN server or gateway. Traffic destined for the remote network or Internet is then encapsulated and transported through that tunnel.

A simplified connection looks like this:

Device → Local Network → Internet → VPN Server → Destination

The VPN tunnel protects the traffic between the VPN endpoints. Depending on the VPN architecture, the VPN server may then forward the traffic to an internal corporate resource or to an Internet destination.

The VPN server therefore becomes an important endpoint in the connection.

A VPN Does Not Make You Completely Anonymous

One of the most common misconceptions about VPNs is that they make users anonymous.

A VPN can hide your public IP address from the websites you visit by making the VPN server’s IP address appear as the source of the connection. However, this does not eliminate all forms of identification or tracking.

Websites can still identify users through:

• Account logins
• Cookies
• Browser and device characteristics
• Application identifiers
• Browser fingerprinting
• Information voluntarily provided by the user

The VPN provider can also potentially observe or log information about traffic, depending on how its service is designed and what logging policies it follows.

A more accurate description is that a VPN changes where your Internet traffic appears to originate and can protect traffic between VPN endpoints. It should not be considered a complete anonymity solution.

What Is VPN Tunneling?

VPN tunneling is the process of encapsulating network traffic so that it can be transported through another network.

For example, an IP packet generated by an application on your computer can be encapsulated inside another packet and transported through a VPN tunnel to a remote VPN endpoint.

The receiving VPN endpoint removes the outer encapsulation and forwards the original traffic toward its destination.

Conceptually:

Original IP Packet → Encapsulation → Encrypted VPN Tunnel → Decapsulation → Destination

The tunnel allows a logical private connection to operate across a shared physical network.

VPNs therefore do not require a dedicated physical cable between two locations. Instead, they use existing network infrastructure to create a virtual connection.

What Does a VPN Encrypt?

The encryption provided by a VPN depends on the VPN technology and configuration.

In a properly configured encrypted VPN, traffic traveling between the VPN endpoints is protected against unauthorized inspection while it is crossing the underlying network.

Modern VPN technologies use established cryptographic mechanisms for confidentiality, authentication, and integrity.

For example, IPsec uses the Internet Key Exchange version 2 (IKEv2) together with the Encapsulating Security Payload (ESP) protocol in common configurations. IKEv2 handles key establishment while ESP provides protection for IP packets.

WireGuard uses modern cryptographic primitives including Curve25519, ChaCha20, Poly1305, BLAKE2s, and HKDF. It encapsulates IP packets over UDP.

What Happens When You Connect to a VPN?

Consider a user working from home who wants to access a company’s private network.

1. The VPN Client Starts a Connection

The user’s computer, smartphone, or router runs VPN client software.

The client contacts the VPN gateway over the Internet.

2. The VPN Endpoints Authenticate

The VPN client and server establish their identities using the authentication mechanisms associated with the VPN technology.

For a business VPN, authentication may involve certificates, usernames and passwords, multifactor authentication, or other identity mechanisms.

3. Encryption Keys Are Established

The VPN endpoints establish cryptographic keys that will be used to protect the tunnel.

4. The VPN Tunnel Is Created

The user’s traffic is encapsulated and protected before being transmitted across the underlying network.

5. The VPN Gateway Forwards the Traffic

Once the traffic reaches the VPN gateway, it is processed and forwarded toward the appropriate corporate resource or Internet destination.

The return traffic follows the reverse process.

Types of VPNs

VPNs can be categorized in several ways, but two of the most important are remote-access VPNs and site-to-site VPNs.

Remote-Access VPN

A remote-access VPN connects an individual device to a remote network.

For example:

Employee Laptop → Internet → Corporate VPN Gateway → Corporate Network

This allows an employee working from home, a hotel, or another location to access authorized corporate resources.

Remote-access VPNs are widely used by organizations to provide secure connectivity for remote workers.

Site-to-Site VPN

A site-to-site VPN connects entire networks rather than individual users.

For example:

Corporate Office A → Internet → VPN Tunnel → Corporate Office B

Routers or firewalls at each location establish the VPN connection.

Site-to-site VPNs can be used to connect:

• Corporate offices
• Branch locations
• Data centers
• Cloud environments
• Manufacturing facilities
• Retail locations

This approach allows devices at the connected sites to communicate through the VPN without requiring each device to run separate VPN software.

Internet VPNs Versus Corporate VPNs

The term VPN is used for several different applications.

A consumer VPN service typically creates an encrypted tunnel between the user’s device and a VPN provider’s server. Internet traffic then exits through that server.

A corporate VPN generally provides controlled access to private resources.

For example:

Employee → VPN Gateway → Corporate Application

The purpose is not necessarily to hide the employee’s location or Internet activity. Instead, the VPN provides an authenticated and protected path to authorized resources.

This distinction is important when evaluating VPN services.

Common VPN Protocols

A VPN is not a single protocol. Several different technologies can be used to create VPN connections.

WireGuard

WireGuard is a modern VPN protocol designed around a relatively small and simple protocol implementation and modern cryptography.

It uses UDP and cryptographic technologies including Curve25519, ChaCha20, and Poly1305. Its design emphasizes simplicity, performance, and ease of implementation.

WireGuard has become an important option for both personal and enterprise VPN deployments.

OpenVPN

OpenVPN is a widely deployed open-source VPN technology that can operate across many operating systems and network environments.

It supports multiple cryptographic configurations and has historically been popular for remote-access VPN deployments.

OpenVPN also provides flexibility in environments where network compatibility is important.

IPsec and IKEv2

IPsec is a suite of protocols used to secure IP communications.

IKEv2 is commonly used to establish and manage the security association, while IPsec’s Encapsulating Security Payload (ESP) protects the IP traffic.

IPsec is widely used for both site-to-site and remote-access VPNs and is particularly important in enterprise networking.

Legacy VPN Protocols

Older technologies such as Point-to-Point Tunneling Protocol (PPTP) and Layer 2 Tunneling Protocol (L2TP) have historically been used for VPN connections.

However, VPN technology has evolved considerably, and modern deployments should use appropriately configured contemporary protocols rather than relying on obsolete technologies.

VPNs and Internet Speed

A VPN can reduce Internet performance, although the amount varies considerably.

Several factors influence VPN performance.

Encryption Processing

Encryption and authentication require processing resources.

Modern CPUs and optimized VPN implementations can perform encryption at very high rates, so encryption itself does not necessarily create a large bottleneck. However, inexpensive routers, older devices, or poorly optimized VPN software can have difficulty processing high-speed connections.

Distance to the VPN Server

Distance matters because traffic must travel to the VPN endpoint before reaching its destination.

For example:

User → VPN Server in the Same Region → Internet Destination

will generally provide a shorter path than:

User → VPN Server on Another Continent → Internet Destination

Longer physical paths increase propagation delay and can also introduce additional routing and congestion.

VPN Server Capacity

The VPN server must have enough processing and network capacity to handle its users.

A heavily loaded VPN server can become a bottleneck.

Protocol and Implementation

Different VPN protocols and implementations can produce different performance characteristics.

WireGuard, for example, was designed with a relatively small protocol implementation and high performance in mind.

Your Original Internet Connection

A VPN cannot make a slow Internet connection faster.

If your broadband connection is 100 Mbps, a VPN cannot turn it into a 1 Gbps connection.

Likewise, if you have a 10 Gbps fiber connection, the VPN client, router, VPN server, and complete network path must all be capable of handling multi-gigabit traffic if you want to approach that performance.

Does a VPN Hide Your IP Address?

A VPN generally changes the public IP address that Internet destinations see.

Without a VPN:

Your Device → ISP → Website

The website can generally see the public source IP address associated with your Internet connection.

With a VPN:

Your Device → ISP → VPN Server → Website

The website generally sees the VPN server’s public IP address instead.

However, the ISP still knows that your device is communicating with a VPN endpoint. Depending on the VPN configuration and jurisdiction, the VPN provider may also have visibility into connection information.

Therefore, a VPN provides privacy and traffic protection, but it should not be confused with complete anonymity.

Can a VPN Prevent Your ISP From Seeing Your Traffic?

An encrypted VPN can prevent the ISP from directly inspecting the contents of traffic carried inside the VPN tunnel.

However, the ISP can still observe characteristics of the connection, such as the fact that your device is communicating with a VPN server and the amount and timing of traffic.

Once traffic leaves the VPN server toward the Internet, the VPN provider becomes an important intermediary.

This is why choosing a trustworthy VPN provider and understanding its privacy practices matters.

Can a VPN Prevent ISP Throttling?

This claim is often overstated.

A VPN can make it more difficult for an ISP to classify traffic based on the contents of an encrypted tunnel. However, a VPN does not guarantee that an ISP will stop throttling or traffic management.

An ISP can still apply policies based on factors such as:

• Total bandwidth consumption
• Network congestion
• Customer plan
• Destination or connection characteristics
• VPN traffic itself

A VPN can also introduce additional latency and processing overhead.

VPNs and Public Wi-Fi

Public Wi-Fi networks are another common use case for VPNs.

When using an untrusted network, an encrypted VPN tunnel can protect traffic between your device and the VPN endpoint.

This can be useful in places such as:

• Airports
• Hotels
• Cafés
• Conference centers
• Public libraries
• Other shared Wi-Fi environments

However, HTTPS remains important even when using a VPN. A VPN does not replace application-level security such as Transport Layer Security (TLS).

VPN Versus HTTPS

VPNs and HTTPS protect different parts of the communication path.

HTTPS encrypts communication between a web browser or application and the website or service.

VPN encryption protects traffic between the device and the VPN endpoint.

Consider:

Device → VPN Server → Website

HTTPS can protect:

Browser → Website

while the VPN protects the traffic between:

Device → VPN Server

Using both provides layered protection.

VPNs in Business Networks

VPN technology has long been important in enterprise Wide Area Networks (WANs).

Organizations can use VPNs to connect remote employees, branch offices, and other locations across public or shared infrastructure.

For example:

Branch Office → Internet → IPsec VPN → Headquarters

or:

Remote Employee → Internet → Remote-Access VPN → Corporate Network

VPNs can therefore provide a practical alternative to dedicated private connectivity when the application’s security, performance, and availability requirements can be met over the public Internet.

For more demanding enterprise applications, organizations may instead use carrier-provided connectivity such as Ethernet, MPLS, wavelength services, or dedicated Internet access.

VPN Versus MPLS VPN

A consumer Internet VPN and an enterprise MPLS VPN are not the same thing.

An Internet VPN typically creates a secure tunnel over the public Internet.

An MPLS VPN uses a service provider’s MPLS infrastructure to create logically separated customer networks.

MPLS VPNs can provide predictable carrier-managed connectivity between business locations, while Internet VPNs can use broadly available Internet connections.

The appropriate solution depends on requirements for:

• Security
• Performance
• Quality of service
• Availability
• Latency
• Geographic coverage
• Cost
• Network control

Advantages of VPNs

• Encrypted connectivity: Protects traffic between VPN endpoints.
• Remote access: Allows authorized users to connect to private networks from remote locations.
• Site connectivity: Can connect geographically separated networks.
• IP address masking: Internet destinations generally see the VPN server’s address rather than the user’s public address.
• Flexible deployment: VPNs can operate across existing Internet infrastructure.
• Secure access to cloud and corporate resources: VPNs can provide controlled connectivity to private services.

Limitations of VPNs

VPNs also have limitations.

A VPN does not:

• Make you completely anonymous
• Protect against every form of malware
• Stop phishing attacks
• Replace endpoint security
• Guarantee faster Internet speeds
• Guarantee protection against ISP traffic management
• Automatically make an untrusted website safe
• Eliminate the need for HTTPS
• Guarantee that a VPN provider cannot observe connection information

A VPN should therefore be considered one component of a broader security and networking strategy.

Are VPNs Still Important?

Yes. VPNs remain an important networking technology because they solve a fundamental problem: how to create a controlled, authenticated, and protected logical connection across infrastructure that may be shared or untrusted.

The technology is particularly useful for remote access, site-to-site connectivity, and secure communications across public networks.

At the same time, modern enterprise networking increasingly combines VPNs with technologies such as Zero Trust Network Access (ZTNA), Software-Defined Wide Area Networking (SD-WAN), cloud networking, and identity-based access controls.

The result is that the VPN is no longer the only tool available for securing remote connectivity, but it remains an important part of modern network architecture.

Conclusion

A Virtual Private Network (VPN) creates a logical network connection across an existing network such as the Internet. Through tunneling, authentication, and encryption, a VPN can provide secure connectivity between users, networks, and resources.

For consumers, VPNs can provide additional privacy and protection when using public networks. For businesses, VPNs can securely connect remote employees, branch offices, data centers, and cloud resources.

Modern VPN technologies such as WireGuard, OpenVPN, and IPsec/IKEv2 provide different approaches to creating secure tunnels.

Understanding VPNs also provides a useful foundation for understanding larger telecommunications and networking concepts. VPNs operate over the underlying physical and logical infrastructure that carries the traffic—including Ethernet, IP networks, fiber-optic networks, carrier networks, and the Internet.

If you are interested in developing a deeper understanding of the technologies that support modern telecommunications networks, explore FiberGuide’s Certified Optical Network Associate (CONA) and Certified Optical Network Engineer (CONE) programs. These scenario-based courses provide practical training in optical networking, transport technologies, network architecture, and the technologies used to build today’s high-capacity communications networks.

Frequently Asked Questions About VPNs

What does VPN stand for?

VPN stands for Virtual Private Network. It creates a logical network connection across an existing network, such as the Internet, using technologies such as tunneling, authentication, and encryption.

How does a VPN work?

A VPN establishes a connection between your device and a VPN server or gateway. Traffic is encapsulated and, when encryption is used, protected as it travels between the VPN endpoints. The VPN server then forwards the traffic toward its destination.

Does a VPN make you anonymous?

No. A VPN can hide your public IP address from websites and protect traffic between VPN endpoints, but it does not eliminate other forms of identification such as account logins, cookies, browser fingerprinting, or information you provide to websites.

Does a VPN slow down Internet speed?

A VPN can reduce Internet performance because of encryption processing, additional routing, server load, and the distance to the VPN endpoint. The actual impact varies considerably depending on the VPN technology, devices, network connection, and server.

What is the difference between a VPN and HTTPS?

HTTPS protects communication between an application such as a web browser and a website. A VPN protects traffic between your device and the VPN endpoint. The two technologies can be used together to provide layered security.

What is a site-to-site VPN?

A site-to-site VPN connects two or more networks using a VPN tunnel. Routers or firewalls at each location typically establish the connection, allowing devices at the connected locations to communicate through the VPN.

What are the most common VPN protocols?

Modern VPN deployments commonly use technologies such as WireGuard, OpenVPN, and IPsec/IKEv2. The appropriate technology depends on the application, operating environment, security requirements, and network architecture.