AnyProxy

Get Pro
Glossary · VPN & tunneling

VPN tunnel

Also calledwhat is a vpn tunnelencrypted tunnel
Definition

A VPN tunnel is the encrypted link between a device and a VPN server, made by wrapping each original packet inside a new packet addressed to the server.

Explanation

In depth

Tunnelling is a packaging trick. Your device builds a normal packet for, say, a news site, then the VPN software encrypts that whole packet and places it inside a new outer packet addressed to the VPN server. Routers along the way only see the outer packet: your address, the server's address, a port and a protocol. The server unwraps it, sends the original packet on, and wraps the reply the same way on its way back. The rules for wrapping are the tunnel protocol: WireGuard, OpenVPN and IKEv2/IPsec are the common ones today, while PPTP is considered broken. Wrapping has costs. Every packet carries extra headers, so the usable packet size (MTU) shrinks, and a tunnel that ignores this can connect fine yet stall on large pages. The outer packets also have a recognisable shape, which is how some national filters spot and block tunnels without decrypting them. Encryption ends at the VPN server; from there to the website only the site's own HTTPS protects the data. A web proxy does not build a tunnel at all: it relays individual web requests at the application layer.

In practice

VPN tunnel in the real world

A tunnel wraps each of your packets inside another packet addressed to the VPN server. The wrapping costs space: WireGuard's tools default to an MTU of 1420 bytes instead of the usual 1500 to leave room for its headers. When that sizing goes wrong, the classic symptom is a tunnel that connects but where large pages or downloads stall, because oversized packets are silently dropped along the path.

Sources: WireGuard — quick start

Questions about VPN tunnel

Why do some sites hang on a VPN while others load?
Often an MTU problem: the tunnel adds headers, packets get too large for part of the path and are dropped. Lowering the tunnel MTU usually fixes it.
Can my network tell a tunnel is running?
Generally yes. It sees steady encrypted traffic to one server, often on a protocol's typical port. It cannot see the sites inside, but it can block or throttle the tunnel, which is what obfuscation tools try to prevent.
Is a web proxy a tunnel?
Not in the VPN sense. Your browser makes ordinary HTTPS requests to the proxy site, and the proxy fetches each page for you; nothing else on your device is wrapped or redirected.
See alsoVPN tunnel deep-dive

Related terms

VPNA VPN (virtual private network) is software that sends all of a device's network traffic through an encrypted connection to a provider's server, which then contacts websites on the device's behalf.WireGuardWireGuard is an open-source VPN protocol that encrypts traffic with a small, fixed set of modern algorithms and runs only over UDP.OpenVPNOpenVPN is an open-source VPN protocol and program, first released in 2001, that builds its encrypted tunnel with TLS and can run over either UDP or TCP.VPN kill switchA VPN kill switch is a setting that cuts a device's internet access whenever the VPN connection drops, so apps cannot fall back to the unprotected connection.

Put the concept to work

Try AnyProxy free — no install, no signup, six regions.

Open a blocked page