A VPN tunnel is an encrypted pipe between your device and a remote server. Everything your device sends to the internet gets wrapped inside this pipe on the way out, then unwrapped on the other end. Your local network sees the pipe. It cannot see what is inside it.
That is the whole idea. Every VPN, cheap or expensive, is a variation on how it builds and maintains that pipe.
How the tunnel actually works
A VPN app on your device holds one persistent connection to a server run by the VPN provider. When you open Instagram in your browser, your device does this:
- Package the Instagram request into a normal HTTPS blob.
- Wrap that blob inside a second encrypted envelope, addressed to the VPN server.
- Send the outer envelope through the tunnel.
- VPN server unwraps the outer envelope, sees the Instagram request, and forwards it out from its own address.
- Instagram’s reply travels back the same way in reverse.
Your ISP sees traffic to the VPN server (and how much, and when) and nothing else. Instagram sees a request from the VPN server, not from you.
What runs inside the tunnel
Once the tunnel is up, every app on your device talks through it — not just the browser. This is the main difference from a web proxy, which routes one browser tab only.
- Browser tabs, all of them.
- Native apps like Slack, Steam, WhatsApp, iMessage.
- Background telemetry from apps you did not think about.
- OS-level requests — software updates, time-sync, App Store pings.
Common VPN tunnel protocols
Different protocols wrap the envelope differently. The three worth knowing:
| Protocol | Speed | Encryption | Where it wins |
|---|---|---|---|
| WireGuard | Fastest | ChaCha20 + Poly1305 | Modern default; short codebase, easy to audit |
| OpenVPN | Medium | Configurable; AES-256-GCM is common | Widely supported on every OS; can run over TCP port 443 |
| IKEv2 / IPsec | Fast | Configurable; AES is common | Reconnects fast when a mobile switches Wi-Fi to cellular |
Most consumer VPN apps let you pick the protocol from a dropdown. WireGuard is usually the fastest and simplest to reason about, so default to that unless the network you are on blocks it. Some firewalls block WireGuard’s UDP traffic; OpenVPN over TCP port 443 is the usual fallback, because it looks more like ordinary HTTPS. IKEv2 also runs over UDP, so it is often blocked by the same rules.
The envelope costs space. WireGuard’s own quick-start guide uses an MTU of 1420 bytes rather than the usual 1500 to leave room for its headers (WireGuard quick start). When that sizing goes wrong, the classic symptom is a tunnel that connects but stalls on large pages or downloads.
What the tunnel does not hide
- Sites you log into. If you sign in to Google inside the tunnel, Google still knows it is you. The tunnel moved where the request came from, not who owns the account.
- Browser fingerprint. Your user agent, screen size, installed fonts, and timezone are visible to the destination.
- What your VPN provider chooses to log. The traffic is encrypted to your ISP, not to the VPN. The provider can see which servers you reach and when, and anything inside the pipe that is not separately encrypted with HTTPS — the “no-log” promise depends on which company you trust.
- DNS leaks. If your OS or browser sends DNS lookups outside the tunnel (an old bug that still shows up in some configurations), your ISP sees which domains you asked about. Most current VPN apps include DNS leak protection; check that yours has it switched on.
When a tunnel is worth the overhead
A VPN tunnel adds one hop and constant encryption. That has a small speed cost — usually invisible, occasionally noticeable on a slow connection.
Turn it on when:
- You are on public Wi-Fi and want your ISP-level traffic protected.
- You need every app on your device to appear from a specific country.
- You want to keep your ISP from building a per-domain profile.
- Compliance or workflow requires whole-device privacy.
Skip it — or use a lighter tool — when you only need one site opened on one network right now. That is what a web proxy is for.
The plain summary
A VPN tunnel is an encrypted pipe carrying every request from your device to a remote server. It hides your destination from your local network and moves your apparent IP to the VPN provider’s. It does not anonymise you from sites you sign in to, and it gives the VPN provider a view of where your traffic goes.
Pick the tool for the job — the tunnel is powerful, but it is also the largest hammer in the box.