The word VPN is used for very different things: an employee connecting to the company network, two offices joined across the Internet, the subscription service promising "anonymous" browsing. The technical mechanism is the same, but purposes and benefits vary a lot. Understanding how it works helps you choose the right solution and not expect what a VPN cannot deliver.
The principle: an encrypted tunnel
A VPN (Virtual Private Network) creates a tunnel: your network's packets are encapsulated inside other packets, encrypted and sent across the Internet to an endpoint, the VPN server or gateway. There they are unwrapped and delivered to the destination network as if your device were plugged into it directly.
Anyone watching the traffic between you and the gateway, for example on a hotel Wi-Fi network, sees only an encrypted connection to one address, without being able to read its content or tell which services you are using.
A virtual network interface with its own IP address appears on the device. Routing tables decide which traffic goes through the tunnel and which does not.
Three different uses
| Type | Purpose | Example |
|---|---|---|
| Remote access | Connect one device to a private network | Reaching your home NAS or the office management software from outside |
| Site-to-site | Join two networks permanently | Two company offices sharing servers and printers |
| Commercial | Route traffic out through a provider's server | Protecting browsing on public networks, changing your apparent location |
The main protocols
- WireGuard: modern, with a very small codebase and simple configuration based on key pairs. It is fast and reconnects transparently when you switch networks, for example from Wi-Fi to mobile data. It runs over UDP.
- IPsec: the long-standing standard, widespread in business equipment and in site-to-site VPNs between routers from different vendors. It is powerful but harder to configure correctly; it is often paired with IKEv2 for negotiation.
- OpenVPN: mature and flexible, based on TLS, it can run over UDP or TCP, even on port 443, which is useful on networks that block a lot of traffic.
For a new home or small office installation, WireGuard is usually the simplest choice. Many routers and firewalls already include it.
Everything through the tunnel, or only part of it
With a full tunnel all of the device's traffic goes through the VPN: Internet browsing exits from the remote gateway too. With split tunnelling only traffic destined for certain networks goes through the tunnel, for example your home 192.168.37.0/24, while everything else goes straight to the Internet.
- A full tunnel offers more protection on untrusted networks and a single point of control.
- A split tunnel reduces load on the gateway and latency for services that do not need it.
Watch out for DNS: if you use a split tunnel but DNS queries still go to the local network's resolver, the names of internal services will not resolve, and whoever controls that network will still see which domains you look up.
Kill switches and traffic leaks
A kill switch blocks all traffic if the tunnel drops, preventing the device from silently falling back to the normal connection. It matters when the VPN is there to keep traffic off a hostile network. It can be implemented with the client's built-in feature or with system firewall rules that allow outbound traffic only through the VPN interface and towards the VPN server.
IPv6 leaks must also be checked: if the VPN handles only IPv4 and the local network offers IPv6, part of the traffic may leave outside the tunnel.
What a VPN does not do
- It does not make you anonymous: you shift trust from the network provider to the VPN operator, who sees your connections.
- It does not protect against phishing and malware: if you open a malicious attachment, the tunnel will not stop it.
- It does not replace HTTPS: beyond the gateway, traffic continues as it normally would.
- It does not make a vulnerable device safe: in fact, a corporate VPN connects that device to the internal network.
Good practice for remote access
- Prefer a VPN over opening ports directly to NAS units, cameras or admin panels.
- Use a separate key or profile for each device, so you can revoke one without touching the others.
- Enable multi-factor authentication where the system supports it.
- Use the firewall to limit what VPN clients can reach: they do not need to see the whole network.
- Keep the gateway updated: VPN concentrators exposed to the Internet are frequent targets.
In short
- A VPN encapsulates and encrypts traffic in a tunnel to a gateway.
- Remote access, site-to-site and commercial services use the same technique for different goals.
- WireGuard is simple and fast; IPsec and OpenVPN remain widespread and compatible.
- Choose between full and split tunnel, and check DNS, IPv6 and the kill switch.
- A VPN protects the path, not the device or your choices online.
