How does a VPN work? Follow one packet through the tunnel

A VPN creates an encrypted tunnel between your device and a VPN gateway. Your packets are encrypted and wrapped inside new packets addressed to that gateway, which unwraps them and forwards them onward. Anyone watching the path sees traffic to the gateway, not your destinations or content.

What happens to one packet?

Constructed example: a laptop in a hotel connects to a company VPN and opens an internal wiki at 10.0.4.20.

1. The laptop's VPN software holds keys it negotiated with the gateway. The wiki request is an ordinary packet addressed to 10.0.4.20.
2. The software encrypts that whole packet and authenticates it, then puts it inside a new packet addressed to the gateway's public address.
3. The hotel network, and anyone on it, forwards the outer packet. They see the laptop, the gateway and a stream of ciphertext.
4. The gateway checks the authentication, decrypts the inner packet and forwards it on the company network to 10.0.4.20.
5. The reply takes the reverse path.

RFC 4301, the IPsec security architecture, describes this kind of protection as security services for traffic at the IP layer. NIST SP 800-77 Rev. 1 calls IPsec a widely used network layer control and a framework of open standards for private communication over IP networks, usually configured with the Internet Key Exchange protocol.

How do the keys get set up?

Before data flows, the two ends authenticate each other and agree on keys. In IPsec that is the job of IKE. WireGuard does it with a short handshake based on the Noise IK pattern: each peer has a Curve25519 key pair, all packets travel over UDP, and the handshake repeats every few minutes so session keys rotate, which gives forward secrecy. Its data packets use ChaCha20 with Poly1305 for authenticated encryption.

The practical point: the strength of a VPN depends on how each side proves who it is. A tunnel to the wrong gateway is still a tunnel, so protect the keys, certificates or credentials.

What does a VPN protect?

• Confidentiality and integrity on the untrusted segment between you and the gateway.
• The destination addresses you visit, from the local network, since the outer packet only names the gateway.
• Access to private resources: the company network can be reached without exposing it to the internet.

What does it not protect?

• The path after the gateway. From the gateway to the destination, traffic is only as protected as the destination protocol, so HTTPS still matters.
• Your device. If malware is on the laptop, the tunnel carries its traffic into the company network. Many incidents involve a valid VPN login from a compromised or poorly managed device.
• Your identity from the VPN operator, who sees the destinations you reach.
• Authorization. Once on the network, what you can reach depends on rules behind the gateway. Broad network access is a common weakness, and NIST's zero trust model argues for authentication and authorization at each resource rather than trust from network location.

What is split tunneling?

In full tunnel mode all traffic goes through the gateway. In split tunnel mode only traffic for company ranges does, and the rest goes straight to the internet. Split tunneling saves bandwidth, but it means the device bridges two networks and the gateway no longer sees all its traffic.

How to check or apply this

1. Know which protocol and mode your VPN uses, and keep the gateway software patched. Gateways face the internet.
2. Require multifactor authentication for VPN logins, and certificates or keys on managed devices.
3. Check device health on connect, for patch level and disk encryption.
4. Restrict what each group can reach after login instead of giving access to the whole network.
5. Decide on split or full tunnel deliberately, and document why.
6. Log connections, and alert on logins from new locations or devices.
7. Review accounts and keys often, and remove those of departed staff the same day.

Quick check

Sources

• RFC 4301, Security Architecture for the Internet Protocol
• NIST SP 800-77 Rev. 1, Guide to IPsec VPNs
• WireGuard protocol and cryptography
• NIST SP 800-207, Zero Trust Architecture

Last reviewed: 18 October 2026.