How Does a VPN Actually Work? (And What It Doesn't)

Introduction

A Virtual Private Network extends a private network across a public network. Creates an encrypted tunnel for secure data transmission

Let’s break down what VPNs actually do, what they don’t, and why the distinction matters.

The Basic Flow

Normally, when you visit a website, your traffic takes a straightforward path:

Without VPN: Your device → Your ISP → Website server

When you connect directly like this, your internet service provider can see which websites you’re visiting. More importantly, every website you access sees your real public IP address (the one assigned by your ISP).

With VPN: Your device → Encrypted tunnel → VPN server → Website server

The VPN adds an intermediate stop. Instead of your traffic going directly to the website, it first travels through an encrypted tunnel to a VPN server. Your ISP can still see that you’re connected to a VPN server, but here’s the key part: it can’t easily inspect what’s inside that tunnel. The contents remain encrypted.

From the website’s perspective, they don’t see your device at all. They see the VPN server’s IP address instead.

The IP Address Masking

This is where location spoofing comes in. Let’s say you’re physically in Nairobi but connect through a VPN server in Manchester. When you visit a website, that website’s logs show traffic coming from a Manchester IP address. That’s why VPNs are commonly used to access content that’s geographically restricted.

Some VPN services let you manually select which country’s server to connect through. Others automatically route you to a nearby server for better performance. Just be aware: choosing a distant server might reduce your speed, while a closer one gets you better throughput at the cost of less location masking.

VPNs Don’t Make You Anonymous

This is where most people get VPNs wrong.

Without a VPN, your internet service provider is the middleman with access to your traffic. With a VPN, you’re not eliminating the middleman, you’re shifting trust to a different company. The VPN provider becomes the one handling all your traffic.

Think about that for a moment. If you sign up for a free VPN that logs everything you do and sells your data to advertisers, you haven’t improved your privacy. You’ve just chosen a different organization to compromise it. You’ve traded your ISP’s visibility for a VPN provider’s visibility, and the VPN provider is often less regulated and less trustworthy.

This is why selecting a reputable VPN provider matters. Many commercial VPN services publish transparency reports and have external audits. Free VPNs? They almost always monetize your data somehow.

What Websites Still Know About You

Even through a VPN, a surprising amount of your identity leaks through:

Authenticated accounts: Open Instagram, log into your account, and Instagram immediately knows it’s you. The VPN hides your IP, but your login credentials don’t.

Cookies: These little text files stick around regardless of your VPN. A website that’s seen you before will recognize cookies in your browser.

Browser fingerprinting: Your device has unique characteristics: screen resolution, installed fonts, browser version, plugins, timezone, language settings. Companies can use these details to fingerprint your browser with startling accuracy. No VPN can hide this.

Tracking pixels and third party scripts: Most websites load tracking code from Google, Facebook, and other ad networks. These networks have their own tracking infrastructure and will identify you across sites.

Your actual behavior: Even if a site can’t connect you to your real name, your browsing patterns, search history, and purchases create a behavioral profile.

A VPN hides your IP address. It does not hide you.

What VPNs Actually Do Well

Let’s be clear about what VPNs genuinely protect:

1. Encryption Between Your Device and VPN Server

This is the core benefit. Everything between your device and the VPN server is encrypted. Your ISP can’t read it. A malicious router on a public WiFi network can’t intercept it. This matters enormously on untrusted networks.

2. Hiding Your Origin IP

The destination website sees the VPN server’s IP, not yours. This prevents basic IP based tracking and geolocation detection.

3. Protection on Untrusted Networks

Public WiFi at coffee shops, airports, hotels these are risky. Anyone on that network could potentially intercept unencrypted traffic. A VPN encrypts your tunnel, protecting you from local network observers.

That said, it’s worth noting that most modern websites already use HTTPS. HTTPS encrypts the connection between your browser and the website’s server, providing similar protection for web traffic specifically. A VPN provides encryption for all traffic (DNS queries, apps, everything), not just web browsing.

VPN Types and Use Cases

VPNs aren’t one size fits all. Different deployments serve different purposes:

Remote Access VPN (Client to Site)

This is what most people think of when they hear “VPN.” An individual connects from home or a coffee shop to a corporate network. The company’s VPN server acts as a gateway, letting the remote employee access internal resources like file servers, databases, or internal applications as if they were in the office.

Site to Site VPN

Instead of individual clients, entire networks connect to each other. A company might run VPN tunnels between its office in Nairobi and its office in Kigali, creating a secure connection between both networks over the public internet. This is also how companies securely connect to cloud infrastructure (AWS, Azure, GCP).

Host to Host VPN

A direct encrypted tunnel between two specific endpoints. Useful for secure service to service communication, peer to peer applications, or connecting IoT devices securely. WireGuard and Tailscale excel at this model.

The Protocols Behind VPNs

If you dig deeper into VPN technology, you’ll encounter protocol names: IPSec, OpenVPN, WireGuard, L2TP, IKEv2. These are the technical standards that define how encryption, authentication, and key exchange work.

IPSec is the industry standard for network security. It’s mature, widely supported, and handles both transport mode (host to host) and tunnel mode (network to network). Downside: it’s complex to configure and has higher CPU overhead.

OpenVPN runs over standard TLS/SSL (the same protocol that secures your bank’s website). It’s flexible, platform independent, and works everywhere. It’s slightly slower than IPSec but offers excellent compatibility across different operating systems and environments.

WireGuard is the newcomer and it’s impressively minimal. The entire protocol is roughly 4,000 lines of code compared to hundreds of thousands for IPSec or OpenVPN. It’s fast, modern, and uses Curve25519 elliptic curve cryptography. The trade off: it’s newer, so enterprise features lag behind the older protocols.

IKEv2/IPSec shines on mobile devices because it supports MOBIKE (Mobility and Multihoming Protocol), which means you can switch between WiFi and cellular networks without dropping your connection.

Most VPNs encrypt data using AES 256 or ChaCha20, both considered cryptographically secure. They exchange keys using elliptic curve diffie hellman or similar methods.

Performance Considerations

Encryption adds overhead. Your VPN connection will likely have slightly higher latency (typically 5 15 milliseconds) compared to an unencrypted connection. Bandwidth throughput depends on the protocol, encryption cipher, and whether your hardware has cryptographic acceleration (most modern CPUs do).

The encryption process is where most of the CPU cost sits. With hardware acceleration (AES NI on Intel/AMD, NEON on ARM), modern systems can handle 1 10 Gbps of encrypted throughput without excessive CPU usage. Without acceleration, older devices may struggle.

For most use cases, the performance impact is acceptable. Web browsing, email, video streaming all work fine through a VPN. High frequency trading or real time interactive applications might notice the latency.

When You Actually Need a VPN

Despite the misconceptions, VPNs remain genuinely useful:

Remote work security: Employees accessing corporate resources from home or public spaces benefit from encryption and IP hiding.

Public WiFi protection: Coffee shops, airports, hotels these networks are targets for attackers. A VPN protects traffic from local network snoopers.

Multi office connectivity: Companies securely connecting branch offices over the internet without buying expensive dedicated lines.

Cloud infrastructure: Securely connecting on premises systems to cloud providers (AWS, Azure) through VPN tunnels.

Regulatory compliance: Many compliance frameworks (HIPAA, PCI DSS, SOC2) require encrypted connections, which VPNs provide.

IoT device security: Embedded devices communicating securely with servers.

Accessing geographically restricted content: If the content restriction is based on IP location, a VPN can help.

The Encryption Middleman Analogy

Think of a VPN like this: it’s not an invisibility cloak. It’s an encrypted middleman.

Your traffic enters the tunnel from your device. It travels through that encrypted tunnel to the VPN server. From that point onward, the internet sees the VPN server instead of your original connection. The VPN server is a trusted intermediary that handles the traffic while keeping its contents encrypted from observers.

The trade off is that you’re trusting the VPN provider. You’re exchanging trust in your ISP for trust in the VPN company. That’s a reasonable trade if the VPN provider is reputable and actually practices what it preaches. It’s a terrible trade if you’re using a free service designed to monetize your data.

Best Practices

If you’re using a VPN, here’s what matters:

Choose reputable providers: Paid services from companies with transparency reports and independent audits beat free VPNs every time.

Understand what you’re protecting: A VPN encrypts your connection and hides your IP. It doesn’t hide your identity if you’re logged into accounts. It doesn’t prevent fingerprinting. It doesn’t stop websites from serving you personalized content based on previous behavior.

Combine with other security layers: A VPN is one tool, not a complete solution. Layer it with HTTPS, firewalls, intrusion detection, multi factor authentication, and good password hygiene.

On untrusted networks, use it: Public WiFi is risky. A VPN substantially reduces that risk.

At home on your own WiFi: The benefit is lower. Your own ISP already knows what you’re doing, and your ISP can’t intercept your traffic on your own network.

The Bottom Line

A VPN is valuable technology that solves specific security problems. It encrypts your connection and hides your IP address. It’s useful on untrusted networks and for accessing resources from remote locations. But it’s not a privacy silver bullet. It doesn’t make you anonymous, it doesn’t prevent tracking, and it doesn’t hide your identity if you’re logged into accounts.

Use VPNs where they genuinely help. Understand their limitations. Choose providers you can actually trust. And remember: the VPN provider becomes the new middleman. Make sure they’re worthy of that trust.