A VPN encrypts your traffic on your own device, then routes it through a server the VPN company runs. The website answers that server, not you, so it sees the server’s address rather than yours. A VPN company runs hundreds or, in some cases, thousands of servers around the world. That’s why you can choose which country a site believes you’re connecting from.
more
Your internet provider doesn’t vanish from the arrangement. It still carries your connection as far as the VPN’s server, and it sees you connecting to that server. What it loses is any view of what happens after that point: which domains you visit, what you send them, and what comes back. The company running the server sees roughly what your provider used to see. A VPN doesn’t remove a watcher. It changes which one gets the job.
How the tunnel gets built
The UK’s National Cyber Security Centre names two protocols as the ones most VPNs actually use: Transport Layer Security and IPsec. Older options exist, but PPTP has fallen out of use over security concerns. WireGuard is gaining ground, though it hasn’t yet proven itself in large organisations. The centre recommends IPsec specifically, because it’s an open standard. Anyone can build a client or server that works with any other IPsec setup, and many operating systems already carry one built in. Some networks block or restrict IPsec traffic regardless. That can stop a VPN connection starting on a particular network. TLS VPNs are the other option. It needs a separate client and server from the same vendor, but it copes better with the network address translation and firewalls that IPsec sometimes trips over.
Setting up either kind of tunnel needs both ends to agree on an encryption key first. The Internet Key Exchange protocol, known as IKE, is the one most commonly used to do that for an IPsec connection. The US National Institute of Standards and Technology revised its own guidance on the pairing in 2020, fifteen years after the original version. The update describes how organisations can implement IPsec, IKE and their alternatives. Once the tunnel is up, the data passing between your device and the VPN server stays encrypted.
Why public wifi is the case everyone reaches for
Plenty of routers in cafés and airports still run old software and weak encryption, and anyone else sharing that network can potentially read your data or ride along on your session. Some networks aren’t what they claim to be at all. An “evil twin” hotspot copies the name of a genuine one, set up by someone nearby specifically to catch the traffic of people who join it by mistake. A VPN encrypts your device’s traffic before it ever reaches that local network, so which router you’ve joined stops mattering as much.
What the tunnel takes away from your provider, and why that reaches further than browsing
The same tunnel changes what your provider learns more broadly. The encryption stops your provider tracking the domains you visit. Taking that visibility away from a provider also takes it away from a government that would otherwise demand it, which is one reason people reach for a VPN to get at news sites blocked under censorship.
The personal case for doing any of this grew out of a specific decision. WIRED pointed readers towards VPNs in March 2017, days after the US House of Representatives voted to reverse a rule that would have stopped internet providers selling customers’ browsing data without asking first. A VPN takes a provider out of the loop on what its own customers look at.
Who this was actually built for
None of this began with someone browsing at a café. The National Cyber Security Centre writes its VPN guidance for organisations, not individual users, and individuals are explicitly out of scope of that document. It gives several reasons a business might want one. Staff can reach internal email and file systems from outside the office. A VPN can also add a second layer of defence around old internal services that were never built to sit on the open internet, and it can limit which devices reach sensitive servers at all. Whether an organisation needs a VPN depends on how its network is already built, the centre notes. A business running a zero-trust model may get little extra benefit from adding one on top.
What to check before you pay for one
Because a VPN moves the watching rather than removing it, the question that matters isn’t whether the mechanism works. It’s whether you trust the company running the far end of the tunnel more than the one you’re avoiding. A VPN provider can see, and in principle log, everything you send through it, so its promise not to matters as much as the encryption itself.
Checking that promise from outside is hard. WIRED’s advice is to read a provider’s terms of service for what it says about logging and about handing data to authorities, and to be wary of a VPN that’s free with no other business behind it, since running servers worldwide costs money somewhere. Sergiu Candja, chief executive of the Canada-based provider CactusVPN, argues that an internet provider sharing its clients’ personal information with third parties is “wrong on all levels.” He suggested picking a smaller company, which is less likely to be targeted for holding valuable data, and one based in a different country. A “kill switch,” which shuts down chosen programs automatically if the VPN connection itself drops, guards against those programs leaking data unencrypted during the gap.
None of that proves a no-logs claim true. What it does is put the decision back on you. The tunnel settles who can watch. Picking who gets to be that watcher is the part no diagram of the mechanism can answer for you.
