What Is a VPN? How It Works and What It Protects

Key takeaways

• A VPN routes selected traffic through a tunnel to another network endpoint.
• Full and split tunneling determine which connections use that protected path.
• HTTPS protects the web connection beyond the VPN endpoint and remains necessary.
• A different public IP address does not prevent account tracking, phishing, or malware.

A VPN, or virtual private network, connects a device or network to another network endpoint through a tunnel. In a typical remote-access deployment, that tunnel encrypts traffic between the client and the VPN gateway.

Imagine opening a company dashboard from a hotel. The dashboard is only reachable through the company’s private network. Connecting the work laptop to the corporate VPN supplies a route to it, while protecting traffic carried between the laptop and the company gateway.

That is a specific benefit. It does not mean the hotel connection, laptop, dashboard, and user account have all become secure.

What Happens When You Connect?

The VPN client establishes a connection with the gateway and authenticates according to the deployment’s configuration. Network routes then determine which traffic enters the tunnel.

For the private dashboard, packets travel through the hotel network inside the protected connection. The company gateway receives them, removes the tunnel protection, and forwards them toward the dashboard.

Different VPN protocols implement that protection differently. IPsec’s security architecture, for example, defines policy and mechanisms for protecting IP traffic. The important boundary for the user is the endpoint where that protection terminates.

Consumer, Remote-Access, and Site-to-Site VPNs

The term VPN covers several deployments with different purposes.

Deployment	What it connects	Typical purpose
Consumer VPN	Device to a provider’s gateway	Route internet traffic through the provider’s exit
Corporate remote access	Employee device to company gateway	Reach authorized private resources
Site-to-site VPN	One network gateway to another	Connect offices or cloud networks

With a consumer VPN, websites normally see the exit server’s public IP address for traffic sent through it. With corporate access, the important result may simply be that an internal destination becomes reachable.

An IPsec VPN can support connections between networks as well as remote users.

Full Tunnel and Split Tunnel Change the Scope

The worker’s dashboard and personal music application need not follow the same route.

A split tunnel can send company destinations through the VPN while other traffic uses the ordinary internet connection. A full tunnel generally directs internet-bound traffic through the gateway too, subject to more specific routes and exceptions.

Microsoft’s VPN routing documentation explains how these policies influence route selection. A connected status icon alone does not establish that every application uses the tunnel.

DNS resolution matters as well. Looking up an internal hostname may require a company resolver even when public names use another resolver. IPv4, IPv6, local network access, and application-specific settings all need to match the intended policy.

HTTPS Continues Beyond the Gateway

The VPN and the dashboard’s HTTPS connection protect different portions of the journey.

The VPN tunnel ends at the company gateway. HTTPS normally continues between the browser and the service terminating the website’s TLS connection. That application protection is still needed when traffic leaves the tunnel.

Without intentional TLS interception, a forwarding VPN operator cannot simply read the contents of a properly authenticated HTTPS session. It can still observe connection metadata, such as destination IP addresses and traffic timing. Domain visibility depends on DNS and other protocol choices.

This is why a VPN is no reason to bypass a certificate warning.

A VPN Changes Who You Trust

On the hotel network, an observer can generally see the connection to the VPN endpoint and its traffic patterns. The VPN operator becomes another party through which the worker’s traffic passes.

For a consumer service, that makes the operator’s handling of account information, connection records, DNS, and infrastructure relevant. Encryption to an intermediary does not remove the intermediary from the trust decision.

Nor does an exit IP provide anonymity. A website can still associate requests with a signed-in account, cookies, or information supplied directly.

What Happens When the Tunnel Drops?

Suppose the laptop switches from hotel Wi-Fi to a mobile hotspot. During reconnection, traffic might fall back to a direct route unless policy prevents it.

A kill switch is intended to block traffic that would otherwise escape the required tunnel. Its coverage depends on the product and platform. Sleep, restart, network changes, DNS requests, and startup before connection are useful situations to check when that guarantee matters.

A private dashboard becoming unreachable is different from public traffic silently taking an unintended route. Both can occur during failure, but they have different consequences.

Keep Access and Device Security Separate

The company should still decide which dashboard records the worker may view. Network reachability is not application authorization, a distinction central to the zero trust security model.

A VPN also cannot prevent the worker entering credentials into a phishing page, or stop malware already running on the laptop from reading data available to it.

Before relying on a VPN, identify the destinations it should carry, the endpoint receiving that traffic, and the behavior expected when the connection fails. Those details determine what the tunnel actually protects.

A protected route is useful only when you know which traffic takes it and where its protection ends.