What is a VPN and how does it work?
A virtual private network (VPN) is an encrypted tunnel between your device and a remote server. Every packet your device sends is wrapped inside another packet addressed to that server.
The server unwraps it and sends it on to the internet from its own address. Websites see the server's address, and your internet provider sees only encrypted traffic going to a single server.
Where the name comes from
The technology was built for companies long before it reached home users. A business wanted its branch offices, linked over the public internet, to behave as if they shared one internal network. The network is "virtual" because it runs over infrastructure the company does not own, and "private" because encryption keeps its traffic separate.
That use is still common in two forms: site-to-site links, and remote staff reaching the office network. Consumer VPN services use the same mechanism for a different purpose: making your connection reach the internet from somewhere other than where you are.
What happens to each packet
When a VPN client starts, it creates a virtual network interface in the operating system and adds routing rules that send traffic through it. From then on, each packet goes through these steps:
- An app on your device sends an ordinary IP packet to a website, like any other connection.
- The operating system looks up the destination in its routing table. The route points to the virtual interface, not the physical network card.
- The VPN client picks the packet up from that interface, encrypts it with a key shared with the server, and adds an authentication tag.
- It wraps the result in a new packet, usually UDP, from your real address to the server, and sends it over your normal connection.
- The server removes the outer layer, checks the tag and decrypts the payload, recovering the packet exactly as the app sent it.
- The server rewrites the source to its own public address and forwards the packet. The reply comes back to the server, which encrypts it and returns it to you the same way.
The IPsec standards call this "tunnel mode". The whole original packet, headers included, becomes the payload of a packet with a new outer header. The definition is in Security Architecture for the Internet Protocol (RFC 4301).
The parts of any VPN
Protocols differ in the details, but each one has to solve four problems:
- Authentication. Each side confirms the other is who it should be, using public keys, certificates or a password.
- Key agreement. Both sides derive temporary session keys that never cross the network, and replace them regularly.
- Encryption and integrity. Every packet is encrypted and carries a tag that reveals any change made in transit.
- Routing. Rules decide which packets enter the tunnel and which stay outside it.
Three protocols dominate today: WireGuard, IPsec with IKEv2, and OpenVPN. The first is explained in detail in How WireGuard works.
Who sees what
A tunnel does not hide your traffic from everyone. It moves the point of visibility from one party to another:
| Party | Without a VPN | With a VPN |
|---|---|---|
| Your internet provider, or the café network | The addresses you connect to, usually the site names, and the volume and timing of traffic | An encrypted connection to one server, with its volume and timing |
| The VPN provider | Nothing | The addresses and names of sites, the volume and timing of traffic, and your real address |
| The website you visit | Your real address | The VPN server's address |
| The content of an https page | Protected between your browser and the site | Protected between your browser and the site, as before |
In practice, the VPN provider takes over the vantage point your internet provider had. Choosing one is a question of trust before it is a question of speed or price.
What a tunnel does not do
- It does not make you anonymous. Once you sign in, the site knows you by your account, not your address. Cookies and browser fingerprints are unchanged.
- It does not replace https. Encryption ends at the VPN server. Past that point your traffic crosses the internet like any other, protected only by the site's own encryption.
- It does not stop malware. Anything running on your device sees your data before it enters the tunnel.
- It does not cover traffic that bypasses it. A DNS query, an IPv6 address or a WebRTC connection left outside the tunnel can reveal your real address or country. These cases are covered in DNS leaks, IPv6 leaks and WebRTC leaks.
How to check that the tunnel works
- With the tunnel off, open the My IP tool and note your address, network (ASN) and country.
- Turn the tunnel on and reload the tool. All three should change to match the server.
- Run the DNS leak test. No resolver belonging to your own internet provider should appear.
- Run the WebRTC leak test in the browser you actually use. Your original public address should not appear.
On Linux you can ask which interface will carry a packet to a given address:
ip route get 1.1.1.1If the answer names the virtual interface, such as wg0 or tun0, traffic to that address goes through the tunnel.
How to choose a VPN service
- Protocol. Prefer a modern, well-studied protocol such as WireGuard or IKEv2, and avoid legacy ones that are no longer secure, such as PPTP.
- What is logged. Read the privacy policy. Are the sites you visit stored? Is your real address stored, and when you connected?
- Leak protection. Look for explicit handling of DNS and IPv6, and an option that blocks the internet if the tunnel drops. See What is a kill switch.
- The kind of address you exit from. Data center ranges are well known to IP databases, and some services treat them with suspicion. See Residential, data center and mobile addresses.
- What you actually need. If only the browser needs to exit elsewhere, an extension or a proxy may be simpler than a tunnel for the whole device.
How syriaproxy applies this
Our Android, Windows and Linux apps tunnel the whole device, as does the WireGuard file for iPhone, iPad, macOS and routers. Traffic exits from the Syriatel 4G network inside Syria, names are resolved there by Syriatel's resolvers, and IPv6 is blocked inside the tunnel. We do not log the sites you visit or their content.
FAQ
Does a VPN slow down my connection?
Usually a little. Encryption adds processor work and a few dozen bytes to every packet, and the path through the server may be longer. Distance to the server tends to matter more than encryption.
Is using a VPN legal?
In most countries, yes, and businesses rely on them every day. Some countries restrict them or license their providers, and some services forbid them in their terms. Laws and terms apply to what you do through the tunnel just as they do outside it.
Does it protect me on public Wi-Fi?
It protects the path between your device and the server, so others on the same network cannot read or alter your traffic. It does not protect you from a fake sign-in page you open yourself.
How is a VPN different from a proxy?
A proxy works for one program at the connection level, while a VPN works on IP packets for everything routed into it. The details are in What is a proxy.
Open the free network tools to see what your connection reveals with the tunnel off and on.