Short answer: a VPN (virtual private network) is used to send your traffic through an encrypted tunnel to a VPN server, which forwards it to the internet under its own IP. People use it to protect their traffic on public Wi-Fi, reach a private office or home network, get a fixed exit IP for allowlists and hide browsing from the local network.
What a VPN does not do is just as important: it does not make you anonymous, and it moves trust from your local network to whoever runs the VPN server. This guide explains how the tunnel works, what it is good for, which protocols exist, and how it compares with a proxy and with Tor.
How does a VPN work?
Whatever the brand or protocol, a VPN connection comes down to five steps:
- Handshake. Your device and the VPN server prove who they are to each other (with keys or certificates) and agree on fresh session keys.
- A virtual network interface. Your operating system gets an extra network adapter, such as
wg0ortun0on Linux or a VPN adapter on Windows, with a private tunnel address like10.8.0.2. - Routes. The routing table decides which traffic goes into that adapter: everything (a full tunnel) or only certain networks (a split tunnel).
- Encapsulation. Each packet that enters the adapter is encrypted and wrapped inside an ordinary UDP (sometimes TCP) packet addressed to the VPN server.
- Forwarding. The server unwraps and decrypts the packet and sends it on to its destination, usually through NAT, so the destination sees the server’s public IP. Replies take the same path back.
One web request through a VPN looks like this from three places:
On the cafe Wi-Fi (the outer packet):
192.168.1.37:49152 -> 203.0.113.10:51820 UDP, encrypted payload
Inside the tunnel (only your device and the VPN server can read this):
10.8.0.2:53114 -> 192.0.2.80:443 TCP, TLS to the website
At the website:
203.0.113.10:41022 -> 192.0.2.80:443 the VPN server's IP, not yoursThe wrapping costs a few bytes per packet, which is why VPN interfaces use a smaller MTU than the usual 1,500 bytes. With WireGuard, wg-quick sets it from the underlying route when you do not, and on a normal 1,500-byte network that comes out at 1,420. A wrong MTU is the classic cause of a tunnel that connects but where large pages or downloads hang.
Who sees what, with and without a VPN
| Party | Without a VPN | With a VPN |
|---|---|---|
| The local network (café, hotel, office Wi-Fi) | Which servers you connect to, your DNS lookups, the site names in TLS, plain HTTP in full | One encrypted stream to the VPN server's IP: its size and timing only |
| Your internet provider | The same as the local network | The same as the local network: one encrypted stream |
| The VPN operator | Nothing | Your real IP, every destination, timing and volume, and any content not protected by HTTPS |
| The website | Your IP and its approximate location | The VPN server's IP; still your cookies, logins and browser fingerprint |
What is a VPN used for?
- Public Wi-Fi. On a network you do not control, the VPN hides your DNS lookups and the names of the sites you open, and protects anything that is not already encrypted. Most sites use HTTPS today, so the content was mostly safe anyway; what the VPN adds is that the network no longer learns where you go.
- Reaching a private network. The original business use: connect to the office network, a home NAS or a database that is not exposed to the internet, as if you were sitting on that network. A site-to-site VPN does the same for whole networks, joining two offices or two data centres.
- A fixed exit IP for allowlists. Admin panels, databases, payment APIs and customer firewalls often accept only known IPs. Your own VPN server gives every device and every team member the same, stable source address.
- Privacy from the network you are on. Your provider, the hotel or the employer’s guest network sees a tunnel to one IP instead of your browsing.
- Protecting server access. Allow SSH, RDP or a database port only from the VPN’s address range, and those ports disappear from the internet and from the bots that scan it all day.
- Appearing in another location. Testing how a site, an ad campaign or a CDN behaves from another country. Streaming services are unreliable here: many block known VPN and data-centre addresses.
What a VPN does not do
- It does not make you anonymous. Logins, cookies, browser fingerprinting and payment details identify you whatever IP you arrive from. A VPN changes your address, not your identity.
- It moves trust, it does not remove it. Everything your provider could see before, the VPN operator can see now, plus your real IP. A “no logs” promise is a policy you cannot check from the outside, and the operator answers to the law where it runs its servers.
- It does not stop malware or phishing. A malicious download or a fake login page works the same inside the tunnel.
- It can leak. If DNS queries still go to your provider’s resolver, if the tunnel carries only IPv4 while your device has IPv6, or if the tunnel drops and traffic falls back to the normal connection, the network sees you again. Good clients set DNS inside the tunnel, cover IPv6 and offer a kill switch that blocks traffic while the tunnel is down.
VPN protocols: WireGuard, OpenVPN, IPsec/IKEv2
| Protocol | Transport and ports | Strengths | Weak spots | Typical use |
|---|---|---|---|---|
| WireGuard | UDP only; one port you choose (51820 in the docs’ examples) | Small codebase, fast, in the Linux kernel since 5.6, simple key-based config | No TCP mode, so networks that block UDP block it; no built-in user database | Self-hosted VPNs, Tailscale, many commercial apps |
| OpenVPN | UDP or TCP; IANA port 1194, can run on 443/tcp | TLS-based, mature, works through strict firewalls in TCP mode | Slower than WireGuard, more config, mostly runs in user space | Corporate remote access, networks that block UDP |
| IPsec with IKEv2 | UDP 500 and 4500 (NAT traversal), ESP | Built into Windows, macOS, iOS and Android; survives switching networks (MOBIKE) | Complex to configure server-side; NAT and firewall issues | Site-to-site links between routers, native phone clients |
| L2TP/IPsec, PPTP | Legacy | Old devices support them | PPTP is broken; L2TP/IPsec is outdated | Nothing new: replace them |
For a new setup the default answer is WireGuard. Pick OpenVPN when you need TCP, for example on a hotel or office network that only lets web traffic out, and IPsec/IKEv2 when you want to use a device’s built-in client or connect two routers. WireGuard uses a fixed set of modern primitives (Curve25519, ChaCha20-Poly1305, BLAKE2s) and a handshake built on the Noise protocol framework, so there is no cipher list to get wrong; OpenVPN and IPsec negotiate ciphers, which is flexible and also the source of most of their weak configs.
Full tunnel, split tunnel and mesh
A full tunnel sends all traffic through the VPN; a split tunnel sends only chosen networks through it and lets the rest use your normal connection. In WireGuard the difference is one line in the client’s config:
[Peer]
PublicKey = <the server's public key>
Endpoint = 203.0.113.10:51820
# full tunnel: everything, IPv4 and IPv6, goes through the VPN
AllowedIPs = 0.0.0.0/0, ::/0
# split tunnel instead: only the tunnel network and the LAN behind the server
# AllowedIPs = 10.8.0.0/24, 192.168.50.0/24A mesh VPN connects devices directly to each other instead of through one central server, with a coordination service handing out keys and addresses. Tailscale is the best-known one, built on WireGuard. It can still send internet traffic through one machine, called an exit node; see using a VPS as a Tailscale exit node.
VPN vs proxy vs Tor
| VPN | Proxy | Tor | |
|---|---|---|---|
| Works at | The network: IP packets | One application: HTTP or SOCKS | One application, usually the Tor Browser |
| Covers | The whole device, or chosen routes | Only apps configured to use it | Only traffic sent into Tor |
| Encrypts the first hop | Yes | Only if the client-to-proxy hop uses TLS or SSH | Yes, in layers |
| Who can link you to your traffic | The VPN operator | The proxy operator | No single relay knows both ends |
| Exit IP | The VPN server's | The proxy's | A random exit relay's, changes per site |
| Speed | Near your line speed when the server is close | Near your line speed when the proxy is close | Noticeably slower |
| Good for | Untrusted networks, private networks, a fixed IP | Per-app routing, scraping, caching, filtering | Anonymity against websites and observers |
A proxy is the lighter tool when one browser or script should leave through another address. A VPN is the cleaner choice when the whole device should, including DNS. Tor is the only one of the three designed for anonymity, because no single relay sees both who you are and where you go; the price is speed and many sites treating Tor exits with suspicion.
Commercial VPN or your own on a VPS?
A commercial VPN is an app and a subscription: many servers, many countries, and an exit IP shared with other customers. Your own VPN on a VPS is one server and one IP that belongs to you alone. The trade-offs, briefly:
- Exit IP. Your own server’s IP is yours alone. That makes it perfect for allowlists, and it means nobody else’s behaviour gets it blocked. It also means everything that leaves through it points to one customer: you.
- Trust. With a commercial VPN you trust the company’s logging policy. With your own, you control the software and its logs, and the hosting provider’s network sees the destinations your ISP used to see.
- Effort. A commercial VPN needs no upkeep. Your own needs updates, a firewall and a key per device; with WireGuard that is a short config file on each side.
- Responsibility. Traffic from your VPN server is traffic from your server. On a VMHeaven VPS, the Acceptable Use Policy lists operating VPNs, proxies and privacy tools for personal use as permitted, and everything the AUP forbids stays forbidden when it leaves through your tunnel.
The full comparison, including which one is more private, is in VPS vs VPN. The setup itself, with phones, laptops and IPv6, is in running a WireGuard VPN server on a VPS.
How do you know the VPN is actually working?
With the VPN connected, ask an IP echo service which address it sees, once for IPv4 and once for IPv6:
curl -4 https://icanhazip.com # should print the VPN server's IPv4
curl -6 https://icanhazip.com # the server's IPv6, or an error if you have no IPv6 at allIf your own address appears on either line, the tunnel is up but the routes do not send that traffic into it. Our IP lookup tool shows the same in a browser. The causes and fixes (missing default route, IPv6 outside the tunnel, DNS still going to your provider) are listed in the VPS vs VPN guide’s check section.
Frequently asked
What is a VPN used for?
Mainly four things: protecting your traffic on public or untrusted Wi-Fi, reaching a private office or home network from outside, giving every device the same fixed exit IP for allowlists, and hiding which sites you visit from the local network and your internet provider. It can also make you appear in another country, although many streaming services block VPN addresses.
Does a VPN make you anonymous?
No. It replaces your IP address with the VPN server's, but logins, cookies, browser fingerprinting and payment details still identify you, and the VPN operator can see your real IP and every destination. Tor is the tool designed for anonymity; a VPN mainly moves trust from your local network to the VPN operator.
Which VPN protocol is best?
For a new setup, WireGuard: it is fast, simple to configure and part of the Linux kernel since version 5.6. OpenVPN is the fallback where UDP is blocked, because it can run over TCP, even on port 443. IPsec with IKEv2 suits the built-in clients of phones and operating systems and site-to-site links between routers. Avoid PPTP, which is broken.
What is the difference between a VPN and a proxy?
A VPN works at the network level: with a full tunnel it carries all of a device's traffic, DNS included, through an encrypted tunnel. A proxy works per application: only programs configured to use it send traffic through it, and the hop to the proxy is not encrypted unless it uses TLS or SSH.