How a VPN works
A VPN client creates a virtual network interface and establishes an authenticated, encrypted tunnel to a VPN gateway. It routes selected packets into that tunnel. The gateway removes the VPN wrapper, forwards the traffic to the internet or a private network and sends replies back.
Device → encrypted VPN tunnel → VPN gateway → example.comWebsites reached through this route normally see the gateway’s public IP instead of your connection’s address. A full-tunnel setup routes most device traffic through the VPN and usually sends DNS queries through a VPN-provided resolver. Split tunneling sends only selected apps or destination networks through it.
What a VPN protects
The tunnel protects data while it travels between your device and the VPN gateway. Its limits depend on the routing and applications involved.
- Local network and ISP: They can’t directly read tunneled packets, but they can see the VPN server’s IP, connection times and data volume.
- VPN gateway: The operator can see connection metadata and may see traffic that isn’t separately encrypted. You shift trust from your local network and ISP to the VPN operator.
- Traffic after the gateway: VPN encryption ends at the gateway. SSL/TLS protects HTTPS data between your application and the website.
- Online identity: A new public IP doesn’t remove cookies, account logins or browser fingerprinting.
VPN vs proxy
Both can change the IP a website sees, but a forward proxy is usually configured for specific applications or requests.
| Feature | VPN | Forward proxy |
|---|---|---|
| Scope | Device or selected network routes | Configured apps or requests |
| Encryption | Encrypted tunnel to gateway | Depends on proxy connection and protocol |
| Exit IP | Usually one gateway per connection | May be static or rotating |
| Typical use | Remote access and network privacy | Automation and location-specific requests |
When to use a VPN
- Access private company systems from outside the office.
- Protect traffic between your device and a trusted gateway on public Wi-Fi.
- Route several applications through one network location.
A proxy is often a better fit when you need per-request control, IP rotation or many target locations. For data collection, follow the site’s rate limits, robots.txt and terms. Neither tool fixes inconsistent headers, fingerprints or request behavior.
FAQ
Does a VPN hide my IP address?
Yes, from websites reached through the tunnel. They see the VPN gateway’s public IP, though incorrect routing or a WebRTC leak may expose other addresses.
Can my ISP see what I do with a VPN?
Your ISP can see that you’re connected to a VPN server, along with timing and traffic volume. With a properly configured tunnel, it normally can’t directly read the tunneled traffic or see its final destinations.
Is a VPN the same as a proxy?
No. A VPN creates a network tunnel and commonly covers multiple applications. A proxy forwards traffic from applications configured to use it and may offer more control over exit IP selection.