A VPN works by encrypting your traffic and sending it through a tunnel to a gateway, which then forwards it to its destination. People on the path between you and the gateway see only scrambled packets. It protects the link, not your device, your accounts or your identity.
What happens when you connect?
Two things happen in order. First, the client and the gateway authenticate each other and agree on keys. In IPsec, that job belongs to the Internet Key Exchange protocol, specified in RFC 7296. WireGuard does it with a handshake built on the Noise framework, using Curve25519 for key agreement.
Second, the client wraps each outgoing packet inside a new encrypted packet addressed to the gateway. In IPsec's tunnel mode, the entire original packet is protected and carried inside a new IP packet. The gateway decrypts it and sends the original on its way. Replies take the reverse path.
NIST SP 800-77 Rev. 1 describes IPsec as a framework of open standards for ensuring private communications over IP networks.
What does the encryption cover?
Everything between the client and the gateway. Your coffee shop's Wi-Fi operator, or anyone sniffing that network, sees an encrypted stream to one address. After the gateway, the traffic travels as it normally would. If the final site uses HTTPS, that part is still encrypted. If it does not, it is readable on the far side of the gateway.
Authentication matters as much as encryption. A tunnel to the wrong gateway is encrypted straight to the attacker. That is why keys or certificates must be verified, not just accepted.
What does a VPN not do?
- It does not secure the device. Malware on your laptop sees traffic before it is encrypted.
- It does not make you anonymous. The gateway operator sees where your traffic goes. Logins identify you wherever you connect.
- It does not grant least privilege. A corporate VPN often puts you on the internal network with wide reach. In the 2015 Ukrainian power grid attacks described by ICS-CERT, the actors reportedly used VPN connections with legitimate credentials they had acquired earlier. The tunnel worked as designed. The identity behind it was the problem.
MITRE ATT&CK lists VPNs among the externally available services that valid-account abuse can reach.
What are the common uses?
Remote access. An employee connects to the office network from home.
Site to site. Two offices or a data center and an office link their networks through a permanent tunnel.
Privacy on untrusted networks. A traveler shields traffic from the local Wi-Fi.
Each has a different threat model, so the right configuration differs.
What should you know about split tunneling?
A VPN client can send all traffic through the tunnel or only traffic for specific networks. Sending everything through the gateway gives the company full visibility and filtering, at the cost of bandwidth and a single point of load. Splitting sends only corporate destinations through the tunnel and leaves the rest on the local connection. That is faster, but a compromised home device now bridges the public internet and the corporate network. Decide deliberately, document it, and pair split tunneling with endpoint controls.
How to check or apply this
- Decide which of the three uses you need before choosing a product or protocol.
- Require multi-factor authentication on remote access, since stolen credentials are the common failure.
- Limit what a connected user can reach. Do not give everyone the whole network.
- Patch the gateway promptly. It faces the internet and is a prime target.
- Log connections and review unusual ones, such as a user connecting from two countries within an hour.
- Keep endpoint protection in place, because the VPN does nothing for the device.
Quick check
Does a VPN protect me from malware?
No. It protects data in transit between you and the gateway. Malware runs on your device, before and after the tunnel.
Does a VPN hide my traffic from the VPN operator?
No. The operator terminates the tunnel and can see where your traffic goes. You are moving trust from the local network to the operator.
Sources
- NIST SP 800-77 Rev. 1, Guide to IPsec VPNs
- RFC 4301, Security Architecture for the Internet Protocol
- RFC 7296, Internet Key Exchange Protocol Version 2
- WireGuard, Protocol and Cryptography
- CISA ICS-CERT, IR-ALERT-H-16-056-01, Cyber-Attack Against Ukrainian Critical Infrastructure
- MITRE ATT&CK T1078, Valid Accounts
Last reviewed: 18 October 2026.
