What is a VPN tunnel?

What does the word tunnel actually mean here?

A tunnel is encapsulation: one protocol carried as the payload of another. The original packet keeps its own source and destination addresses, but nothing on the path reads them, because they are now cargo inside a second packet. That is what lets private addresses travel across a public network, and it is the same mechanism behind every kind of tunneling, not just VPNs.

The V and the P do the rest of the work. Virtual, because the network is built in software rather than out of cable you own. Private, because the encapsulated payload is encrypted before it leaves your machine.

How does a VPN tunnel work?

The client and the server first authenticate each other and agree on encryption keys, usually with a public key exchange. The client then creates a virtual network interface on your machine and edits the routing table so that traffic is sent to that interface instead of straight out of your physical adapter.

From then on, every packet handed to that interface is encrypted, given a new outer header addressed to the VPN server, and sent over the real connection. The server decrypts it, forwards the inner packet to its real destination, and sends the reply back the same way. The encapsulation costs you some bytes per packet, which is why a VPN link has a smaller usable MTU than the connection underneath it.

What is the difference between a remote access VPN and a site-to-site VPN?

A remote access VPN connects one device to a network. You run a client, you authenticate, and your laptop behaves as though it were plugged into the office. A site-to-site VPN connects two networks to each other, and the tunnel is maintained by routers or firewalls at each end rather than by software on individual machines.

Mesh VPNs are a third shape. Instead of routing everything through a central concentrator, each device builds a direct encrypted link to every other device it needs to reach, with a coordination server handling keys and discovery.

What is the difference between a VPN and a proxy?

A proxy works at the application layer and only for the applications configured to use it. An HTTP or SOCKS proxy relays requests on your behalf, but your operating system keeps sending everything else, including DNS lookups from other programs, out of the normal interface.

A VPN works at the network layer and captures traffic from every process on the machine, because the change is made in the routing table rather than in each application's settings. A proxy also gives you no encryption of its own; the confidentiality you get is whatever TLS the application already used.

Which protocols do VPN tunnels use?

Several, and the choice mostly comes down to what the network in the middle will allow through and how much code you want in the security-critical path. Most of them run over UDP, because retransmitting a lost packet twice, once in the tunnel and once in the connection it carries, causes the throughput collapse known as TCP meltdown.

Does a VPN make you anonymous?

No. A VPN moves trust rather than removing it. Your internet provider stops seeing which sites you visit, and the VPN operator starts seeing it instead, along with the timestamps and volumes that go with it.

Sites you visit still identify you by the account you log into, the cookies you carry, and the fingerprint your browser presents. Encryption also stops at the VPN server: from there to the destination, your traffic is protected only by whatever TLS the connection already had.

When is a VPN the wrong tool?

A VPN is built to let trusted members join a private network. It is the wrong shape when you need to give an untrusted outsider access to exactly one service. A payment provider posting a webhook, a client reviewing a staging build, or a phone on a mobile network cannot be asked to install a VPN client and hold a credential for your network.

It is also more access than the job needs. Joining someone to a VPN puts them on the network, where routing and firewall rules are the only thing standing between them and everything else on it. For one HTTP service, a reverse tunnel that publishes a single URL is both simpler and narrower.