How Does a VPN Work? Tunnels, Encryption and Protocols

A VPN works by building an encrypted tunnel. The app on your device encrypts every packet and sends it to a server the provider runs. The server decrypts it and forwards it to the internet under its own IP address. Replies come back the same way. Your network sees one encrypted stream, and websites see the server, not you.

Data crosses the internet in small pieces called packets. Encrypting a packet scrambles it so that only a receiver with the right key can read it. An IP address is the number that identifies a device or server online. Our page on what a VPN does lists what this protects and what it does not.

A VPN connection, step by step

These are the steps between tapping Connect and a page loading. We use WireGuard as the example, because most providers now use it by default. A protocol is the set of rules the app and the server follow to build and run the tunnel.

1. You choose a server. The app already holds the server’s address and public key. A public key is the half of a key pair that can be shared openly. In WireGuard, each side has a fixed key pair. A peer is either end of the connection. The whitepaper that describes WireGuard calls the core idea an association between a peer’s public key and the IP addresses it is allowed to use inside the tunnel. The project calls this cryptokey routing.
2. The handshake. The handshake is the opening exchange in which both sides agree on keys. Your device and the server swap a single round trip of handshake messages, one message each way. They derive fresh session keys using Curve25519 key agreement. They repeat the handshake every few minutes, so past traffic stays protected if a key later leaks. OpenVPN does this job with a TLS session and certificates. TLS is the standard that also secures HTTPS websites, and a certificate is a digital ID. IKEv2 does the job with the exchanges defined in RFC 7296.
3. The app takes over routing. It creates a virtual network interface, which works like a network card made of software. It then changes the device’s routing table, the list that decides where each packet goes. Every packet from every app now goes into that interface instead of straight to your Wi-Fi or mobile connection. The app also points the device’s DNS at the provider’s resolver. DNS turns site names into IP addresses, and a resolver is the server that does the lookup.
4. Each packet is wrapped. Take the original packet, say a request to a website. It is encrypted and authenticated with ChaCha20-Poly1305. Authenticated means any tampering would be detected. The result goes inside a UDP packet addressed to the VPN server. UDP is a basic way of sending packets without waiting for each one to be confirmed. Your network forwards that outer packet but cannot read the inner one.
5. The server unwraps and forwards. The VPN server decrypts the inner packet. It rewrites the sender’s address to one of the server’s own public IPs and sends the packet on to the website. The website answers the server.
6. The reply comes back through the tunnel. The server encrypts the response and sends it to your device. The app decrypts it and hands it to your browser as if nothing had happened.
7. If the tunnel drops, the kill switch decides what happens next. Your apps either fall back to the open connection or stop until the tunnel is back. The kill switch section below explains this.

VPN encryption: what it protects and what it does not

The VPN encrypts the path between your device and the provider’s server. Everything on that path sees only ciphertext, which is scrambled data. That includes the coffee shop router and your internet service provider (ISP). Beyond the server, your traffic travels exactly as it would without the VPN. HTTP is how your browser asks for web pages, and HTTPS is its encrypted version. An HTTPS request is still protected by TLS all the way to the website. A plain HTTP request can be read by the VPN server and by every network after it.

This decides what the provider can see. Most web traffic today uses HTTPS. With HTTPS, the VPN server sees your real IP address and the domains and IP addresses you connect to. It also sees when you connect and how much data moves. It does not see the content of pages, your passwords or your messages. TLS 1.3, specified in RFC 8446, keeps that content private, not the VPN.

A cipher is a method of encrypting data, and the ciphers differ by protocol. WireGuard uses a fixed set:

• ChaCha20 for encryption, authenticated with Poly1305
• Curve25519 for key agreement
• BLAKE2s for hashing
• HKDF for key derivation

OpenVPN instead negotiates its ciphers through TLS. NordVPN, for example, documents AES-256-GCM with a 4096-bit Diffie-Hellman key for its OpenVPN connections.

Post-quantum key exchange is designed to resist attacks by future quantum computers. It is arriving unevenly. Providers documented the following on 31 October 2026:

• ExpressVPN’s Lightway protocol uses a hybrid ML-KEM key exchange by default.
• Mullvad offers an optional quantum-resistant pre-shared key on WireGuard. A pre-shared key is an extra secret that both sides hold in advance.
• NordVPN’s post-quantum option is an opt-in toggle that works only with NordLynx.

The protocols: WireGuard, OpenVPN and IKEv2

WireGuard is the newest of the three and the simplest. Its whitepaper describes a layer 3 tunnel, which carries IP packets. Its key exchange takes a single round trip and is based on the Noise framework, a published recipe for building handshakes. It has perfect forward secrecy: a key stolen later cannot unlock past sessions. Its Linux version has fewer than 4,000 lines of code. That makes it easier to audit than the protocols that came before it. It runs over UDP only. Mullvad removed OpenVPN from all of its servers on 15 January 2026 and now offers WireGuard alone. NordVPN’s default NordLynx is its own WireGuard-based implementation.

OpenVPN is the older design and is built on TLS. In its TLS mode, each side presents a certificate. Key material is exchanged over the TLS session. OpenVPN then adds its own reliable layer, so the control channel works over UDP. The control channel is the part that sets up and manages the connection. OpenVPN can also run over TCP, including on port 443. TCP is the delivery method that confirms every packet arrived. A port is a numbered entry point on a server, and HTTPS uses port 443. That makes OpenVPN look like ordinary HTTPS to a restrictive network. It is more flexible than WireGuard and has far more configuration options. That flexibility is its strength, and also the reason it is harder to audit.

IKEv2/IPsec is the protocol built into Windows, macOS and iOS. IPsec encrypts the traffic, and IKEv2 sets it up. IKEv2 is defined in RFC 7296. It negotiates keys and security associations for IPsec. A security association is the agreed set of keys and settings for one connection. Its MOBIKE extension, in RFC 4555, lets a connection survive a change of network, such as moving from Wi-Fi to mobile data. That is why IKEv2 was the default on phones for years. Ten of the twelve providers we track still offer IKEv2 alongside WireGuard and OpenVPN. Mullvad offers WireGuard only, and Private Internet Access offers WireGuard and OpenVPN. Neither offers IKEv2.

Providers also ship their own protocols for networks that block VPNs:

• NordVPN’s NordWhisper
• Proton VPN’s Stealth, which carries WireGuard inside TLS
• ExpressVPN’s Lightway, with automatic obfuscation

Obfuscation disguises VPN traffic so it looks like ordinary web traffic. We have not yet tested the speed of any protocol in our lab. The trade-offs we can document are on WireGuard vs OpenVPN.

Who sees what

The last row is where no-logs policies matter. A no-logs policy is a provider’s promise not to record what you do. In April 2023, Swedish police searched Mullvad’s office under a warrant for customer data. The officers left with nothing, because no such data existed. NordVPN received a binding Panamanian warrant in October 2024. It disclosed the user data it held, which under its policy is account data, not activity. Both cases are recorded, with sources, in our provider data. Our page on what “no logs” means covers the general question.

DNS: the leak most people miss

Before your browser can reach a website, it asks a DNS resolver to translate the domain name into an IP address. Without a VPN, that resolver is normally your ISP’s. That gives the ISP a complete list of the domains you visit, even when every page is HTTPS. A working VPN sends those lookups through the tunnel to the provider’s own resolver. As of 31 October 2026, every provider in our data set states that its apps do this and include DNS leak protection.

A DNS leak is a lookup that escapes the tunnel. Leaks still happen, usually through edge cases. In February 2024, ExpressVPN disclosed a fault in one split-tunneling mode of its Windows app. Split tunneling lets some apps bypass the VPN. That mode had sent some DNS requests to the ISP’s resolver instead of ExpressVPN’s own. ExpressVPN disabled the feature, fixed it and turned it back on.

IPv6, the newer format of IP address, is another path:

• NordVPN states that it does not support IPv6 yet.
• ExpressVPN blocks IPv6 outside the tunnel.
• Proton VPN routes IPv6 through the VPN on Windows, Linux and Android, and disables it on macOS and iOS.

Browsers add a third path through WebRTC, which can reveal your local address. WebRTC is a browser feature for voice and video calls. Our VPN check, WebRTC leak test and IPv6 leak test exist for these cases. Our split tunneling page explains the feature that caused the ExpressVPN bug.

The kill switch

A tunnel can drop. The Wi-Fi hands over to mobile data, the server restarts or the laptop wakes from sleep. Without a kill switch, apps simply carry on over the open connection. Your real IP and DNS lookups are exposed until the app reconnects. A kill switch blocks all traffic outside the tunnel instead.

Kill switches differ, and the default setting matters more than whether the feature exists. Mullvad’s app has a kill switch that is built in, on by default and cannot be turned off. ExpressVPN’s Network Lock is on by default on Windows, macOS, Linux and Android, and always on for iOS.

Proton VPN offers two modes. The standard kill switch activates only when the connection drops by accident. An advanced mode works on Windows, the Linux app with a graphical interface and iOS. It allows internet access only while you are connected to Proton VPN, and it survives a restart. Proton VPN also documents a gap on macOS and iOS. There, some DNS requests from Apple services can bypass the VPN even with the kill switch on.

NordVPN’s kill switch varies by platform. Windows has separate internet and app kill switches. On macOS and iOS, NordVPN uses what it calls VPN bypass prevention. Our page on what a VPN kill switch does has the details and shows how to test yours. The rest of our explainers are in the Learn hub, and the providers are in the reviews hub.

Related

• What is a VPN?
• WireGuard vs OpenVPN
• What a VPN kill switch does
• Split tunneling explained
• Double VPN and multi-hop
• Is a VPN worth it?
• Is my VPN working? Leak check
• Best VPNs for privacy