How a VPN actually works — tunneling, not just 'privacy'
A VPN doesn't make your traffic invisible — it wraps it in an encrypted tunnel to a server somewhere else, which then makes the request on your behalf. Understanding that shift in trust explains both what a VPN genuinely protects against and what it doesn't.
Beginner
3 min read
The core mechanism: a tunnel, not a cloak
A VPN (Virtual Private Network) works by encapsulation: your device
encrypts its traffic and wraps it inside another connection to a VPN server
somewhere else. From that VPN server onward, your original request continues
to its real destination — but as far as the destination and everyone in
between can see, the request came from the VPN server's IP address, not
yours.
This is the same "encapsulate one thing inside another" idea already familiar
from this domain — HTTP inside TCP inside IP — just with an extra encrypted
layer added on top, addressed to a VPN server instead of the final
destination directly.
What this actually hides, and from whom
Because everything between your device and the VPN server is encrypted:
Your local network and ISP can see that you're connected to a VPN
server, but not what's inside the tunnel — not which sites you're visiting
or what data you're exchanging.
The destination server sees the VPN server's IP address as the source
of the request, not yours — which is why VPNs are commonly used to appear
as if browsing from a different country.
What it doesn't hide: the VPN provider itself
The tunnel's encryption only covers the hop between you and the VPN server.
The VPN provider itself can see everything your ISP would have seen
otherwise — using a VPN doesn't remove that visibility, it just relocates
who has it, from your ISP to the VPN provider. This is exactly why a VPN
is a shift in trust, not a removal of trust: "does this VPN provider promise
not to log or sell what it sees?" is the real question, not "does a VPN make
me anonymous?"
Past the VPN server, the request continues in whatever form it would have
anyway — if the original request was HTTPS, it stays encrypted (using the
HTTPS/TLS mechanism from an earlier lesson) all the way to the real
destination; if it was plain HTTP, it's just as readable after the VPN
server as it always was.
Two very different reasons to use one
Corporate VPN: lets a remote employee's laptop join a private company
network as if it were physically in the office — reaching internal servers
that aren't exposed to the public internet at all, similar in spirit to
the private-network-only backend traffic from the load balancers lesson.
Consumer VPN: mainly used to hide your IP/location from the sites you
visit, or to encrypt traffic on a network you don't trust (like open public
Wi-Fi) — protecting against a local eavesdropper specifically, which
matters less than it used to now that most real traffic is HTTPS anyway.
Why this matters day to day
"Is a VPN safe/private enough for X?" always comes back to who you're
trying to hide your traffic from. It's genuinely effective against a nosy
local network or ISP; it does nothing against a destination site that
already requires you to log in, and it explicitly shifts trust to whichever
company runs the VPN server your traffic now flows through.