VPN

A VPN (Virtual Private Network) is an encrypted tunnel between two endpoints that carries IP traffic over an untrusted underlay — typically the public Internet. To the operating system, the tunnel appears as an additional network interface; packets sent into it are encapsulated, encrypted, forwarded to the remote endpoint, decrypted and released onto the network on the other side. The remote network sees the traffic as if it had originated locally.

VPNs exist for two main reasons. The first is connecting trusted networks across untrusted infrastructure: a remote-access VPN lets an employee's laptop reach internal services as though it were in the office, and a site-to-site VPN joins two office or data-centre networks into one routed environment. The second is shielding traffic from observers on a local network — for example, on public Wi-Fi — by encrypting it before it leaves the device, so that the local network sees only opaque traffic to the VPN endpoint.

Common protocols include IPsec (often paired with IKEv2), WireGuard and OpenVPN. They differ in cipher suites, key exchange, NAT traversal and code complexity, but the operational model is the same: authenticate the peers, negotiate keys, and forward encrypted packets. Routing decides which traffic enters the tunnel — a full-tunnel configuration sends everything, a split-tunnel configuration sends only specific prefixes (for example, the corporate 10.0.0.0/8 range).

It is worth being precise about what a VPN does and does not provide. It hides traffic content and the real destination from the local network and changes the apparent public IP address of the user to that of the VPN exit. It does not make the user anonymous: the VPN operator sees the same traffic the ISP would have seen, browser fingerprints and logged-in accounts still identify the user, and DNS queries can leak outside the tunnel if not configured carefully. Privacy and anonymity are different properties, and a VPN is primarily a privacy and reachability tool, not an anonymity tool.