What a VPN really does and what it leaves unprotected

VPNs get sold as a magic cloak: press a button and turn invisible. The reality is more modest and more useful: a tunnel that does three specific things, does them well, and stops there. Knowing these limits saves money on subscriptions and spares you nasty surprises at the worst possible moment.

How the tunnel works

The VPN app creates a virtual network interface in the system and routes all device traffic into it. Packets get encrypted and travel as one stream to the server, where they are decrypted and go on to websites in the usual way, and replies come back through the same tunnel. The key phrase here is all traffic, from the browser to background services. A proxy serves the programs you configured, while a tunnel captures the whole system, including apps that do not know it exists.

Three honest functions

• Encryption up to the server. The local network, from a coffee shop Wi-Fi to any intermediate node, sees one encrypted stream to one address. Nobody can extract from it which sites you open or what you send.
• A new address and location. Websites see the VPN server's address: a page from another country, prices for another region, access to resources closed to your address.
• Entry to a private network. The corporate variant: a tunnel to the office makes you a member of the internal network with its resources. That, by the way, is the original meaning of the abbreviation: virtual private network.

What a VPN does not do

Next comes the zone of advertising exaggeration, and it deserves a point-by-point walk. Anonymity: websites recognize you by accounts, cookies and browser fingerprint, and a new address does not cancel that. Protection from viruses and phishing: the tunnel carries bytes without judging whether they are useful or malicious, and a fake login page is just as dangerous over a VPN. End-to-end encryption: the tunnel ends at the VPN server, traffic continues as usual from there, and its protection depends on the HTTPS of the specific site. Finally, trust: everything your provider used to see, the VPN operator now sees. You did not remove the observer, you chose one, so choose deliberately.

VPN or proxy

The task decides. A tunnel suits personal protection: one user, the whole device, unfamiliar networks. A proxy is built for working setups: separate programs, many different addresses, automation. You cannot build a scraper that needs a thousand exits on a VPN, because the tunnel gives one address per device. And the other way round: for a laptop at an airport a proxy falls short, since it leaves the traffic of apps you forgot about uncovered. We compare them step by step in the article on how a proxy works, and a practical breakdown of tasks is in the piece on what proxy servers are for.

A word on protocols

A protocol lives under the tunnel's hood: people value the modern WireGuard standard for speed and resilience on mobile networks, the veteran OpenVPN for compatibility, and IKEv2 for quick recovery when the network changes. For the user the difference comes down to speed and stability: if the client offers a choice, start with WireGuard. The encryption math is equally reliable in all three when configured correctly.

Choosing the tunnel's operator

Since all traffic goes through the VPN server, the identity of the server's owner becomes the product's main property. Free tunnels with no business model live by the same laws as free proxies and browser extensions: someone pays for them, usually with user data. For corporate access the answer is obvious: the company's tunnel. For personal use: an operator with a clear jurisdiction, a paid model and a track record. Technically confident users can run their own WireGuard server, which takes an evening to set up and removes the trust question entirely, leaving the question of a single address.

How to check your tunnel

After connecting, visit the IP lookup page: the address must belong to the VPN server. Then run the anonymity check: a WebRTC leak and a time zone at odds with the address reveal the tunnel to websites, and the report shows both points right away. DNS is a separate story: name queries must go through the tunnel and stay away from the local provider, otherwise the list of domains you visit stays visible to the very network you wanted to hide from. A good client handles this itself, and the same anonymity check lets you verify the name servers.

A short formula to remember: a VPN is an encrypted pipe with a new address. Anything promising more than a pipe deserves a test against protection practice on unfamiliar networks: there you can see which part of the job the tunnel does and which part habits do.