The basic idea
A virtual private network, or VPN, creates an encrypted connection, often called a tunnel, between your device and another point on a network. Traffic goes into the tunnel at your end and comes out at the other, and anyone watching in between sees only scrambled data going to one destination.
That is the core of it. Everything else, including the marketing claims, follows from this one fact, and the useful question is always: protected from whom, and for how much of the journey?
Two common uses
Remote access to a workplace. A company runs a VPN gateway. Employees connect from home or while traveling, and their devices behave as though they were on the office network, able to reach internal file servers and systems that are not exposed to the internet. This is the original purpose of the technology.
Site-to-site links. Two offices connect their networks through a persistent tunnel over the public internet, so devices at each site can reach each other as if joined by a private line.
Consumer VPN services. Individuals can subscribe to a service that routes their internet traffic through the provider’s servers. This is a different use: the “other end” of the tunnel is a company that you choose to trust, and your traffic emerges onto the internet from there.
What a VPN does
- Encrypts traffic between you and the VPN endpoint. On an untrusted network, such as public Wi-Fi, this stops other users of that network from reading your traffic in transit.
- Hides the destination from your local network and, in some cases, your internet provider. They can see that you use a VPN and how much data flows, but not which sites you visit through it.
- Changes the apparent source address. Sites see the address of the VPN server rather than your own connection. This can affect which content or region is shown, though services may block known VPN addresses and terms of use vary.
- Gives remote access to internal resources, which is the main business value.
What a VPN does not do
- It does not make you anonymous. The VPN operator can see your traffic’s destination and timing, subject to what else is encrypted. You are moving trust from one party to another, not eliminating it. Logging policies differ and can be hard to verify.
- It does not protect you from malware or phishing. A malicious download is just as dangerous inside a tunnel. Awareness of social engineering still matters.
- It does not stop websites identifying you. Logging in, cookies, browser fingerprints and accounts all identify you irrespective of your address.
- It does not secure the endpoints. If your laptop is compromised or the server at the other end is, the tunnel simply carries the problem. Patching and sound account practices still count.
- It does not guarantee speed. Extra distance and encryption add latency, and throughput can fall. Reasons for this are discussed in the article on bandwidth and packet loss.
- It is not a substitute for HTTPS. Most websites already encrypt their traffic. The VPN protects the stretch up to its endpoint; after that, the connection to the website is protected only if the site itself uses encryption.
Reading the trust model
The key idea is the endpoint. The tunnel protects the path between two points. Past the far end, traffic travels normally. Questions worth asking:
- Who runs the other end, and what do they log?
- Is the traffic between that end and the final destination encrypted?
- What else does the connection expose, such as DNS requests? A correctly configured VPN sends name lookups through the tunnel as well; a poorly configured one can leak them. The process is covered in the guide to DNS lookups.
VPNs in a business setting
For organizations, a VPN is one control among several. A few cautious practices tend to be recommended:
- Require multi-factor authentication to connect, since a VPN login that is guessed or phished grants network-level access.
- Apply least privilege, so that being connected does not mean being able to reach everything. Segmenting the network with firewall rules limits what a VPN user can see.
- Keep VPN software and gateways updated, because they sit on the network’s edge and are attractive targets.
- Log and review connections, and remove accounts promptly when people leave.
- Write the rules down in IT policies, including what devices may connect and what is allowed over the tunnel.
Some organizations move toward approaches that grant access to individual applications instead of the whole network, which narrows exposure. Which fits best depends on the situation.
Using one on public Wi-Fi
On an open network, a VPN adds a layer of protection against local snooping. But the benefit is smaller than it once was, because most web traffic is already encrypted. It is still reasonable for work devices or sensitive sessions. If you do use a consumer service, choose it with care, since you are handing it a view of your traffic.
Keeping expectations realistic
A VPN is a tool for protecting data in transit and extending a network securely. It is not an invisibility cloak or an antivirus. Used for the purpose it was designed for, it works well. Used as a cure-all, it can create a false sense of safety, and outcomes will always depend on the whole setup, not on the tunnel alone.