About VPN: Questions and Answers

PART 1: Connecting to a Company VPN

1. What is a VPN, what is its basic purpose?

A VPN (Virtual Private Network) is a system that encrypts the traffic leaving your device and carries it, inside a private "tunnel," over your existing internet connection to another point (the VPN server). The purpose is to hide your traffic from eyes on the local network and the ISP, and/or to connect to a remote private network (such as a company network).

This definition contains a few terms. We'll cover each of them in detail in later sections, but let's first define them all briefly in one place. That way the terminology won't be confusing.

Common basic terms:

• Encryption: Turning data into a form that no one without the right key can read.
• Encapsulation: Adding a new address label to the outside of encrypted data, showing where it should go.
• Tunnel / Tunneling: The method that results from applying encapsulation and encryption to every packet, consistently and systematically, throughout a connection. "Tunnel" is the name of the virtual connection set up this way.
• VPN client: The VPN app you install on your device, which does the encryption and encapsulation.
• VPN server: The computer at the other end of the tunnel that decrypts the data and forwards it to the real destination.
• Private IP (internal IP): An address that's only valid inside a specific private network.
• Public IP (external IP): The address visible on the internet, given by your ISP.
• ISP: The company that provides your internet connection.
• NAT: The router hiding internal IPs behind the public IP.
• Packet / IP packet: The unit of data carried on a network, which carries address information.
• Split tunnel / Full tunnel: Whether only certain traffic, or all traffic leaving the device, goes through the tunnel.

2. When you connect to a company VPN, what path does a data packet follow?

Device

→ VPN client: the VPN app installed on your computer (encrypts and wraps the data)

→ Internet (encrypted tunnel)

→ VPN server: the computer run remotely by the company or the provider you use (decrypts the data, forwards it to the real destination)

→ Destination server: a service/database inside the company

→ the response comes back the same way

3. How does encapsulation happen?

Imagine you're writing "Hi" to a friend. Both of these steps are done by the VPN app installed on your computer:

• Encryption: The VPN app turns the word "Hi" into something meaningless (example: X7!ap4b#tr), which only the VPN server can decode.
• Putting it in a new envelope: The VPN app then adds a new, readable address label around this encrypted data: [From: your public IP | To: VPN server] X7!ap4b#tr.

Think of it like an envelope in the mail: the address on the outside can be read by the postal service (the routers), but the letter inside is sealed, and only the recipient (the VPN server) can open it.

4. Does encryption happen on the device, and is that how the data leaves for the internet?

Yes. Here's the order:

1. Encryption and wrapping happen on your computer, done by the VPN app, before the data leaves for the internet.
2. The finished packet (readable outer address, encrypted inner part) goes to your home router (modem).
3. The router sends it to the ISP.
4. The ISP only looks at the outer (unencrypted) address and forwards it; it can't read the content.
5. The packet reaches the VPN server, where it gets decrypted.

It always passes through the ISP before reaching the VPN server.

5. When the VPN assigns a private IP, how do authentication and joining the network work?

There are two stages.

Stage 1: Authentication. The VPN server has a public IP address. You connect to it using your own real public IP; since you don't have a private IP yet, there's no other way to connect. You prove your identity through methods like a password or a certificate. Some systems also add extra security, such as a rule that only accepts connections from certain public IPs, but the actual authentication is done with a password or certificate.

Stage 2: Joining the network. Once your identity is confirmed, you're given a private IP (like 10.8.0.15). Since the company's other servers are also part of the same private network (10.x.x.x), you can reach each other using these private IPs. The VPN server acts as the bridge/gateway between you.

Can the destination server see your public IP? No, it only sees your private IP (10.8.0.15). The VPN server doesn't change the source address when it forwards the packet. The destination server may also have a firewall rule in front of it, such as "only accept requests coming from the VPN's private IP range." This is a separate, extra layer of security on top of authentication.

6. What happens when you access an address that doesn't belong to the company (like YouTube) while connected to the VPN?

This depends on whether the VPN is running in split tunnel or full tunnel mode (see 2.3).

Split tunnel (common, default behavior):

Only traffic going to the company's private network goes through the tunnel.

General internet destinations like YouTube never enter the tunnel; they go out directly through your normal internet connection.

Result: you go out with two different IPs at the same time. Company traffic goes through the VPN, and everything else goes through your own connection.

Full tunnel (some companies enforce this):

All traffic, including YouTube, first goes to the VPN server, then goes back out to the internet from there.

Result: everywhere you go sees you as if you're coming from the VPN server.

In both modes, your actual internet connection never changes. What changes is where your traffic exits from in the last step.

7. At which stages does a VPN provide security, and where doesn't it?

The path:

Device

→ Local network (your home/office WiFi) + ISP

→ VPN server

→ Destination server

The VPN protects the path from your device to the VPN server. It hides you from eyes on the local network (other devices on the same WiFi) and at the ISP.

But protection ends between the VPN server and the destination site. That part is the open internet.

If the site uses HTTPS, that part is protected by its own TLS encryption (a separate mechanism, independent of the VPN). If it uses HTTP, it's completely open.

Also, the VPN server itself can see your traffic, because it has to decrypt it in order to forward it. So using a VPN doesn't mean "no one can see this"; it means "the local network and the ISP can't see it, but my VPN provider can."

Note: if the tunnel drops unexpectedly, there's a feature that stops your traffic from silently continuing without encryption. This is called a kill switch (see 3.5).

PART 2: Details (Explanations That Complete the Basic Mechanics)

2.1 Terms and Concepts

In Part 1 we touched on a few terms in passing. Let's explain them here.

Is the VPN concerned with the NAT/private IP setup on your home network, or does it create its own network?

• Private IP: The address the router gives to devices on the local network (like 192.168.x.x). Only meaningful inside that local network.
• Public IP: The address your ISP gives you, visible on the internet.

The router hides the private IP behind the public IP. This is called NAT.

The VPN has nothing to do with this NAT/private IP setup on your home network, and doesn't touch it. Whether or not you connect to the VPN, your private IP on the home network stays the same.

What the VPN actually cares about is something else entirely: it sets up its own separate network, and assigns you a private IP that it gives you on that network (like 10.8.0.15). This is a brand-new network specific to the VPN, independent of the NAT on your home network.

What is an ISP?

Internet Service Provider: a company like Türk Telekom or Vodafone that gives you internet access and a public IP.

Where does the term "tunneling" come from, and why is it confused with encryption?

The name comes from a tunnel that goes through a mountain: vehicles enter from one end and exit from the other, and while inside, they're invisible from the outside. So the name means "opening a private path through a public network, without mixing into it." It's not directly related to encryption. In fact, some old tunneling protocols (like GRE) don't do any encryption at all.

Why can't I see my public IP from the command line (cmd)?

ipconfig only shows the local settings your device knows about; it doesn't show your public IP. But if you use a command that sends a request out and waits for a reply, like curl ifconfig.me, you can find it out.

2.2 Network Layers

Encapsulation (Part 1, item 3) is actually a general principle of networks applied to VPNs. This principle is called a "layer."

Why does the concept of a layer exist, and where does the name come from?

Network communication is split into independent tasks stacked on top of each other. Each layer does its own job and relies on the layer below it. They're called "layers" because they're stacked like layers of a cake. The benefit: you can change one layer (like WiFi instead of fiber) without affecting the others.

What are the network layers?

1. Physical layer: carries raw bits.
2. Data link layer: connects devices on the local network using MAC addresses.
3. Network layer (IP): routes between different networks.
4. Transport layer (TCP/UDP): separates applications using port numbers.
5. Application layer: the actual data, like HTTP, DNS, TLS.

How do the layers work independently of each other?

Like mail: letter (data) → envelope (port) → box (IP) → courier routing (MAC) → physical transport. The courier doesn't read the letter; they only look at the label for their own layer. So if one layer changes (a truck instead of a plane), the layers above it aren't affected.

What is an IP packet, how is it different from a data packet?

"Packet" is the name for the envelope at whichever layer you're talking about. An "IP packet" is specifically the envelope that has an IP address written on it. It's not a separate thing; it's a member of the same family.

2.3 Inside Tunneling

Now let's look at how a VPN uses these layers, and whether encapsulation has a size limit.

Does every packet go through encapsulation?

No. When the VPN connects, a rule is added to the operating system: "A packet going to the company network → send it through the tunnel, encapsulated. Everything else → send it the normal way." (See Part 1, item 6: split tunnel.)

Is there a size limit on encapsulation?

Yes. A network connection can carry only a certain amount of data at once. This is called the MTU; on Ethernet, this is usually 1500 bytes.

How does the header added by the VPN cause some websites to fail to load?

If a packet is already close to 1500 bytes, the extra header added by the VPN (about 30-60 bytes) pushes the total over that limit. As a result, the packet either gets split in two (many firewalls block this) or a warning message gets stuck at a firewall, and the connection hangs for no obvious reason.

Small requests (text, DNS) aren't affected; larger content (video, images) gets stuck. The fix: the VPN sets the tunnel interface's MTU lower from the start (like 1400), so packets are already produced smaller.

2.4 How Does a VPN Get Between the Layers?

So how does the VPN software actually become part of this layer system?

What is a virtual network interface?

An interface is the point where two systems meet, like an electrical outlet. It's normally something physical (like a WiFi chip), but software can create a fake one; the operating system treats it as real.

How does the VPN create this interface? Is it interfering with the system without permission?

Operating systems leave an official door open for exactly this purpose: TUN/TAP. With admin permission, the VPN uses this door and says "I'm an interface too." The operating system doesn't care which card it's using.

What is TUN/TAP?

TUN only carries IP packets (most VPNs use this). TAP behaves like a full Ethernet card, and is used to merge two networks so they act like one.

Doesn't this require serious system-level permission?

Yes. That's why installing a VPN asks for admin rights. Legitimate software like antivirus programs and firewalls use the same mechanism, but which VPN you trust matters.

2.5 Types of VPN

These different layers and mechanisms translate, in practice, into different types of VPN.

How are VPN types classified by purpose?

• Remote access VPN: A single user connects to a company network.
• Site-to-site VPN: Two office networks connect to each other.
• Personal/commercial VPN (like NordVPN): Connects you to the provider's own server.

What is an IPsec VPN?

IPsec (Internet Protocol Security) is a family of encryption and authentication protocols that works at the network layer (IP level). It creates a tunnel interface on the device (see 2.4) and encrypts all traffic leaving that device, no matter which app or port, sending it through the tunnel. Because of this, a separate VPN client app usually needs to be installed. It's one of the most common approaches used in company VPNs (Part 1).

What is an SSL VPN?

An SSL VPN gets its name from TLS/SSL encryption, meaning it uses the same mechanism that's behind HTTPS. Unlike IPsec, it works higher up, at the application level, instead of the network layer. This makes it more selective: it can tunnel a specific app or web-based service instead of all the traffic on the device. Some SSL VPNs can even provide access directly through a browser ("clientless"), without installing a separate program.

What are modern alternatives to traditional VPNs?

Mesh VPN (like Tailscale, ZeroTier): In a classic VPN, traffic always goes through a central server. In a mesh VPN, the central server just helps devices find each other (see 3.4); the actual traffic flows directly between devices. It's quick to set up, and is generally preferred by small teams for secure access to their own servers (see 2.6).

ZTNA (Zero Trust Network Access) / SASE: In a classic VPN, once you're in the tunnel, you have access to most of the network; a single compromised account can put the whole network at risk. ZTNA instead verifies every request separately; the user can only reach the specific app they're authorized for, and never sees the rest of the network. SASE turns this approach into a security/network service package delivered through the cloud.

2.6 Peer-to-Peer Tunnel

Up to this point, there was always a central VPN server. In peer-to-peer, that goes away.

What is a peer-to-peer tunnel?

Think of an old-style phone switchboard: normally the switchboard (the VPN server) sits in the middle of every conversation. In peer-to-peer, the switchboard just introduces the two sides, then steps out, and the devices talk directly.

What's the security difference compared to a centralized system?

In a centralized system, if the server is compromised, everything can be read. In peer-to-peer, the helper server never sees the encryption, so even if it's compromised, the traffic can't be read.

What are the benefits of setting up a personal mesh network?

With tools like Tailscale/ZeroTier, you can connect to each other using private IPs and set up a secure network that's closed off from the outside. If you want, you can turn one device into an "exit node" and go out to the internet through it as well. (See 3.4 for the technical details of how two devices find each other.)

2.7 DNS and DNS Leaks

A VPN doesn't just affect IP traffic; it also affects domain name lookups.

What is a DNS server?

A server that translates a domain name (example.com) into an IP address.

How are DNS queries normally handled while connected to a VPN?

When the VPN is working correctly, your DNS queries go through the encrypted tunnel, like the rest of your traffic, to the VPN provider's own DNS server. So even the question "what site do I want to go to" stays inside the tunnel, in a way the ISP can't see.

How does a DNS leak happen while using a VPN?

If the VPN fails to route these queries to its own server, the device still asks the old (ISP) DNS server. These queries go out unencrypted, outside the tunnel. This means which sites you visit ends up leaking to the ISP.

2.8 Censorship and Obfuscation

Finally, let's look at whether a VPN itself can be blocked.

Can VPN access be blocked at the state level?

Yes. Known VPN server IPs can be blocked, or DPI can be used to recognize the "pattern" of the traffic and stop it.

What is DPI (Deep Packet Inspection)?

DPI is when a network device tries to figure out what kind of connection is passing through, not just by looking at the destination address, but by looking at the general "behavior" of the packet (its size, timing, handshake pattern, and so on). It can't read the content because it's encrypted, but it can guess "this looks like a VPN handshake" and block the traffic.

What is obfuscation?

Dressing up a VPN packet to look like normal HTTPS traffic. DPI mistakes it for an ordinary website visit.

PART 3: Advanced Topics

This section briefly rounds out the picture with more intermediate-to-advanced, practical and architectural topics, after you've learned the basic mechanics.

3.1 Comparing VPN, Proxy, and Tor

All three are often confused with each other, but they work at different layers and with different trust models.

What is a proxy, what is it used for?

A proxy is a simple middleman that forwards your requests through another server on your behalf. It's usually specific to a single app (mostly the browser) and doesn't encrypt traffic. Its purpose isn't privacy; it's mostly just to change your IP/location. It's typically used for simple scenarios, like getting around a regional content restriction.

What is Tor, what is it used for?

Tor (The Onion Router) is a network that routes your traffic through three randomly chosen volunteer servers, encrypting each layer separately. Its purpose is maximum anonymity: it's used in scenarios where hiding your identity is critical, such as journalism, avoiding censorship, or sensitive research. The cost is a noticeable slowdown, because it passes through three servers.

Feature	Proxy	VPN	Tor
Scope	Usually a single app	OS-level, all traffic	Usually the browser
Encryption	Mostly none	Yes	Yes, three layers
Point of trust	Proxy provider	VPN provider	No single node knows both source and destination
Speed	Fast	Medium	Slow

A proxy only changes your IP; it doesn't encrypt.

A VPN encrypts all your traffic and routes it through a single server.

Tor routes traffic through three different servers; the entry node knows who you are but not the destination, and the exit node knows the destination but not who you are.

Tor is the most private option, but also the slowest.

3.2 Performance Differences Between Protocols

In the context of a VPN, a protocol is a shared set of rules that both sides (your device and the VPN server) agree on in advance, about how to set up the tunnel, how the data will be encrypted, and how packets will be encapsulated. In other words, a protocol is "the actual method/technology that does the tunneling"; a VPN can only work through a protocol it has chosen.

Why is a protocol needed at all? Because two different devices, your computer and the VPN server, possibly with different operating systems and hardware, need a shared "language" and a fixed sequence to talk to each other without issues: how they'll introduce themselves, how they'll exchange keys, what format they'll package the data in, and so on. These rules make different vendors' VPN software compatible with each other not because they aren't standardized, but precisely because they are standardized.

Let's first get familiar with the common VPN protocols:

• PPTP: One of the oldest VPN protocols. It's simple to set up, but its security is considered weak by today's standards, so it shouldn't be used anymore.
• L2TP/IPsec: L2TP sets up the tunnel structure, and IPsec provides the actual encryption. The two are usually used together.
• IKEv2/IPsec: Especially common on mobile devices. It can keep the connection alive without dropping it when the network changes (for example, switching from WiFi to mobile data).
• OpenVPN: An open-source protocol based on TLS/SSL. It's been one of the most widely used options for a long time, with broad device and operating system support.
• WireGuard: A newer, open-source protocol with a small, simple codebase. It stands out for both speed and simplicity, and is preferred by many VPN apps today.

Why are some VPN protocols faster than others?

There are a few reasons:

• Codebase size: a small codebase runs faster and is easier to audit.
• Where it runs: protocols that run in the operating system kernel have less delay than ones that run in user space (no extra handoff layer needed for each packet).
• Encryption algorithm: some algorithms (like AES) benefit from hardware acceleration circuits on modern CPUs (AES-NI); others (like ChaCha20) are designed to run fast in software even without hardware acceleration. Which one is faster depends on the hardware being used.
• Number of handshake steps: a handshake with fewer steps lets the connection re-establish faster, especially when the network changes (like switching from WiFi to mobile data).

3.3 Advanced Encryption Concepts

What is Perfect Forward Secrecy (PFS)?

Let's first recall two concepts. A key is a usually long, random sequence of numbers used to encrypt/decrypt data; someone without the right key can't read the encrypted data. Key exchange is the process where the two sides (the device and the VPN server) securely agree on this shared secret key; this happens right when the connection is being set up, just before the tunnel opens.

If the shared key produced during key exchange always stayed the same, it being compromised later would expose all past traffic. PFS ensures that a new, temporary key is generated for every session. This way, if a key is compromised, it only affects a short period, and past records stay safe.

What are certificates and PKI (Public Key Infrastructure)?

A certificate is a digital document, signed by a CA (Certificate Authority), that says "this public key really belongs to this server." Mutual TLS (mTLS): not just the server, but the client also presents its own certificate, so both sides prove who they are to each other.

3.4 NAT Traversal: How a Peer-to-Peer Connection Gets Established

How do two devices find each other and connect directly?

This is called "hole punching." The process involves three different components; two are servers, and one is a method/algorithm.

STUN server: A server computer running on the internet, with a fairly simple job. A device connects to it and asks, "what IP and port do you see me as from the outside?" and STUN answers. This is how a device learns how it appears from outside its own router. This is information the device normally couldn't know on its own.

ICE (Interactive Connectivity Establishment): Not a server. It's a method that both devices run on their own side. It tries several possible connection paths, including the addresses learned from STUN, one by one, and picks whichever one actually works.

TURN server: A server that runs on the internet, like STUN, but with a different job. When a direct connection can't be made between two devices, it relays the data itself, through its own connection. Think of it like a post office: a middleman that steps in and carries the letter when it can't be delivered directly. In this case, the connection is no longer truly peer-to-peer, because the TURN server can see the traffic. It's used as a last resort, when other methods don't work.

3.5 Kill Switch

What is a kill switch, and why does it matter?

If the tunnel drops suddenly, the operating system usually keeps going without the VPN, silently. This means unencrypted traffic can leak without you noticing. A kill switch stops all traffic the moment the tunnel drops; no packet goes out until the tunnel is re-established.

3.6 IPv6 Leaks

What is an IPv6 leak?

Most VPNs only route IPv4 traffic through the tunnel, and can forget about IPv6. If IPv6 is enabled on the device, this traffic can go out unencrypted, outside the tunnel. The fix: have the VPN route IPv6 through the tunnel as well, or turn IPv6 off on the system.

3.7 VPN Detection and Chaining

How do services like Netflix detect users who are using a VPN?

Through signs like lists of known VPN provider IPs, a large number of accounts connecting from the same IP, and the IP being in a "datacenter" range instead of a home/mobile one.

What is a datacenter? It's a range of IPs belonging to hosting/cloud companies that host servers in data centers, rather than to home/mobile users. A regular home user's IP comes from a range that belongs to an ISP; since VPN servers usually run from this kind of data center IP, a connection coming from a "datacenter" range is a strong sign that a VPN is being used.

What is Double VPN (VPN chaining)?

Traffic passing through two VPN servers, one after the other. Benefit: compromising a single server isn't enough. Cost: latency increases significantly.

3.8 VPN at Cloud and Enterprise Scale

What is Cloud VPN, how is it different from VPC peering?

Cloud VPN is a method for connecting a company's own physical office or data center network to a cloud provider's virtual network (VPC/VNet), such as AWS or Azure. The logic is the same as the site-to-site VPN in Part 1: since there's a public internet between the two separate networks, they're connected through an encrypted tunnel.

VPC peering describes a different scenario. Here, both networks already sit inside the same cloud provider's own internal infrastructure, and traffic never goes out to the public internet. The connection flows over the provider's own private backbone, and access is controlled through the provider's own permission and firewall rules.

In short: Cloud VPN encrypts a connection that travels over the internet. VPC peering directly joins a connection that stays within the cloud provider's own network.

Is there something similar to a VPN in Kubernetes?

Some network plugins (CNI) encrypt traffic between pods. A service mesh (like Istio, Linkerd) provides similar security at the application level, using mTLS.

What is SD-WAN, how does it work?

Think of a company with many branches: each branch may have multiple tunnels reaching headquarters through different types of connections (like a dedicated line, regular fiber internet, or a backup mobile line). In the classic approach, which traffic goes over which line is set manually and stays fixed.

SD-WAN (Software-Defined WAN) manages this automatically, through central software:

• It continuously measures the real-time status of the available connections (latency, packet loss, cost).
• It decides based on how important the traffic is. For example, it might route a video call over the lowest-latency line, and a file backup over the cheapest line.
• If a line fails, it automatically shifts traffic to another line, without needing a person to step in.

Most of these tunnels are already encrypted with VPN protocols (like IPsec); SD-WAN adds a smart routing layer on top of the tunnels that already exist. In short: site-to-site VPN solves "how do you set up a tunnel," while SD-WAN solves "how do you best distribute traffic across many tunnels."