DEV Community

Cover image for 🔐 How Does a VPN Work?
Sh Raj
Sh Raj

Posted on

🔐 How Does a VPN Work?

#vpn #security #cybersecurity #layers

🔐 How Does a VPN Work?

The Complete Visual Guide

A VPN (Virtual Private Network) creates an encrypted connection between your device and a VPN server. It changes the path your internet traffic takes and makes websites see the VPN server's public IP address instead of your own.

But there is an important distinction:

A VPN improves privacy and security. It does not make you completely anonymous.

1. What Happens Without a VPN?

Normally, when you access a website, your traffic follows roughly this path:

flowchart LR
    A["💻 Your Device"] --> B["📡 Router"]
    B --> C["🌐 ISP"]
    C --> D["🌍 Internet"]
    D --> E["🖥️ Website"]

For example, when you open:

https://example.com
Enter fullscreen mode Exit fullscreen mode

your request travels through your network and ISP before reaching the destination.

Who can see what?

Your ISP can generally see information such as:

  • That you're communicating over the internet
  • Which IP addresses you're connecting to
  • Timing and amount of traffic
  • Depending on the protocol and encryption, potentially more information

The website can see:

  • Your public IP address
  • Approximate geographic location derived from that IP
  • Your requests and account activity

2. What Changes When You Turn On a VPN?

Now imagine switching on a VPN:

flowchart LR
    A["💻 Your Device"] --> B["🔒 VPN Tunnel"]
    B --> C["🖥️ VPN Server"]
    C --> D["🌍 Internet"]
    D --> E["🖥️ Website"]

Instead of:

You → ISP → Website
Enter fullscreen mode Exit fullscreen mode

the important part becomes:

You → ISP → 🔒 VPN Server → Website
Enter fullscreen mode Exit fullscreen mode

The connection between your device and the VPN server is encrypted.

This is commonly described as an encrypted tunnel.

3. What Is the VPN Tunnel?

Think of your internet traffic as letters.

Without additional encryption, someone along the route may be able to inspect the contents if the traffic isn't otherwise protected.

A VPN puts that traffic inside an encrypted connection.

flowchart LR
    A["📄 Original Data"] --> B["🔐 Encryption"]
    B --> C["📦 Encrypted Data"]
    C --> D["🚇 Secure VPN Tunnel"]
    D --> E["🖥️ VPN Server"]
    E --> F["🌐 Destination"]

Conceptually:

BEFORE

GET /profile
User-Agent: Chrome
Cookie: ...


        ↓ VPN encryption


AFTER

8F 91 A2 7C 4B 19 0D
A8 31 F2 91 72 44 ...
Enter fullscreen mode Exit fullscreen mode

The actual cryptographic protocols are considerably more sophisticated than simply converting readable text into random characters, but this gives you the right intuition.

4. What Actually Happens to a Packet?

Let's simplify the process.

Suppose you want to access:

example.com
Enter fullscreen mode Exit fullscreen mode

Your device creates network traffic containing information needed to deliver the request.

The VPN client encrypts the appropriate traffic and sends it through the VPN connection.

sequenceDiagram
    participant U as 💻 You
    participant V as 🔒 VPN Server
    participant W as 🌐 Website

    U->>V: Encrypted VPN traffic
    V->>W: Request from VPN server
    W->>V: Response
    V->>U: Encrypted response

The VPN server acts as the middle point between you and the public internet.

5. Your IP Address Changes

This is one of the most noticeable effects of a VPN.

Without VPN 

flowchart LR
    A["💻 You"] --> B["🌐 Website"]
    B --> C["Website sees:<br/>Your Public IP"]

With VPN 

flowchart LR
    A["💻 You"] --> B["🔒 VPN Server"]
    B --> C["🌐 Website"]
    C --> D["Website sees:<br/>VPN Server IP"]

So if your actual public IP were:

203.0.113.10
Enter fullscreen mode Exit fullscreen mode

the website might instead see something like:

198.51.100.25
Enter fullscreen mode Exit fullscreen mode

—the public IP of the VPN server.

6. So Does the VPN Hide You From Your ISP?

Not completely.

This is one of the biggest misconceptions about VPNs.

Your ISP can still observe that your device is communicating with a VPN server.

flowchart LR
    A["💻 You"] --> B["ISP"]
    B --> C["🔒 VPN Server"]
    C --> D["🌐 Website"]

    B -. "Can see VPN connection" .-> C
    B -. "Cannot normally see inside VPN tunnel" .-> C

The ISP generally doesn't get to see the contents of the traffic protected by the VPN tunnel.

However, it can still observe metadata, such as traffic timing, volume, and the VPN server you're connecting to.

7. What Does the VPN Provider See?

This is extremely important.

When you use a VPN, you're shifting trust.

Without a VPN:

You → ISP → Internet
Enter fullscreen mode Exit fullscreen mode

With a VPN:

You → ISP → VPN Provider → Internet
Enter fullscreen mode Exit fullscreen mode

The VPN provider operates the server through which your traffic exits.

Therefore, your VPN provider may be able to observe significant information about your connection, depending on its infrastructure, logging practices, configuration, and the protocols/services involved.

The key idea:

A VPN doesn't eliminate trust. It moves part of that trust from your ISP to the VPN provider.

That's why choosing a trustworthy VPN provider matters.

8. What Does the Website See?

From the website's perspective:

flowchart LR
    A["💻 Your Device<br/>203.0.113.10"]
    B["🔒 VPN Server<br/>198.51.100.25"]
    C["🌐 Website"]

    A --> B
    B --> C

The website generally sees:

Source IP:
198.51.100.25
Enter fullscreen mode Exit fullscreen mode

rather than:

203.0.113.10
Enter fullscreen mode Exit fullscreen mode

This is why VPNs can also make it appear as though you're connecting from another region when the VPN server is located there.

9. But What About HTTPS?

Here's an important layer that many basic VPN explanations skip.

A VPN isn't the only thing protecting your data.

When you visit:

https://example.com
Enter fullscreen mode Exit fullscreen mode

HTTPS typically provides encryption between your browser and the website.

So you can think of the connection as having multiple security layers.

flowchart LR
    A["💻 Your Device"]
    B["🔒 VPN Encryption"]
    C["🌐 Internet"]
    D["🔐 HTTPS"]
    E["🖥️ Website"]

    A --> B --> C --> D --> E

A simplified mental model is:

Your Device
     │
     │ VPN encryption
     ▼
VPN Server
     │
     │ HTTPS encryption
     ▼
Website
Enter fullscreen mode Exit fullscreen mode

This is why saying:

"Without a VPN, your ISP can read all your passwords"

is generally wrong for HTTPS websites.

Modern HTTPS already protects the contents of your web traffic from ordinary network observers.

10. VPN vs HTTPS

Feature VPN HTTPS
Encrypts connection between you and VPN server ✅ ❌
Encrypts browser ↔ website traffic Not necessarily by itself ✅
Hides your public IP from website ✅ ❌
Hides VPN use from ISP ❌ ❌
Protects against some hostile local networks ✅ ✅ for HTTPS traffic
Makes you anonymous ❌ ❌

Best mental model 

VPN = protects the path to the VPN server
HTTPS = protects the connection to the website
Enter fullscreen mode Exit fullscreen mode

Using both can provide complementary protections.

11. The Complete Journey of a Request

Let's put everything together.

Suppose you type:

youtube.com
Enter fullscreen mode Exit fullscreen mode

Step 1 — Your device creates traffic 

💻 Browser
   ↓
Request for youtube.com
Enter fullscreen mode Exit fullscreen mode

Step 2 — VPN encrypts the VPN connection 

💻 Device
   ↓
🔐 Encrypted VPN traffic
Enter fullscreen mode Exit fullscreen mode

Step 3 — Traffic travels to the VPN server 

💻 You
   ↓
🔒 VPN Tunnel
   ↓
🖥️ VPN Server
Enter fullscreen mode Exit fullscreen mode

Step 4 — VPN server sends the request onward 

VPN Server
    ↓
🌐 Internet
    ↓
YouTube
Enter fullscreen mode Exit fullscreen mode

Step 5 — Website responds 

YouTube
   ↓
VPN Server
   ↓
🔒 VPN Tunnel
   ↓
💻 You
Enter fullscreen mode Exit fullscreen mode

12. The Complete VPN Flow 

flowchart LR
    A["💻 YOU<br/>Real IP"] 
    B["🔐 Encrypt"]
    C["🚇 VPN Tunnel"]
    D["🖥️ VPN SERVER<br/>VPN IP"]
    E["🌍 INTERNET"]
    F["🌐 WEBSITE"]

    A --> B --> C --> D --> E --> F

    F --> E --> D --> C --> B --> A

Or remember it as:

YOU
 │
 │  🔐 encrypted
 ▼
╔══════════════════════╗
║    VPN TUNNEL        ║
╚══════════════════════╝
 │
 ▼
VPN SERVER
 │
 │
 ▼
INTERNET
 │
 ▼
WEBSITE
Enter fullscreen mode Exit fullscreen mode

13. Why Use a VPN?

VPNs can be useful for several legitimate reasons.

☕ Public Wi-Fi

On an untrusted network, a VPN can provide an additional encrypted layer between your device and the VPN server.

Laptop
   │
   │ 🔒
   ▼
Public Wi-Fi
   │
   ▼
VPN Server
Enter fullscreen mode Exit fullscreen mode

🌍 Change apparent IP location

The website sees the VPN server's IP rather than your own public IP.

🛡️ Additional privacy

It prevents your ISP from directly seeing the contents of traffic protected by the VPN tunnel.

🏢 Remote work

Organizations commonly use VPN technologies to provide secure access to internal resources.

14. What a VPN Does NOT Do

A VPN is not an invisibility cloak.

❌ It doesn't make you completely anonymous

If you log into:

Google
Instagram
GitHub
YouTube
Enter fullscreen mode Exit fullscreen mode

those services can still associate activity with your account.

❌ It doesn't make malware harmless

If you download malware while connected to a VPN:

VPN + Malware = Still Malware
Enter fullscreen mode Exit fullscreen mode

❌ It doesn't stop phishing

A VPN won't prevent you from entering your password into a fake website.

❌ It doesn't automatically stop tracking

Websites can use:

  • Cookies
  • Browser fingerprinting
  • Logged-in accounts
  • Tracking technologies
  • Other identifiers

A VPN mainly changes the network-level source IP and protects the VPN leg of the connection.

15. VPN ≠ Tor

Another common misconception is that a VPN and Tor are the same thing.

They're not.

VPN 

flowchart LR
    A["You"] --> B["VPN Server"] --> C["Website"]

Tor

Simplified:

flowchart LR
    A["You"] --> B["Entry Node"] --> C["Middle Node"] --> D["Exit Node"] --> E["Website"]

Tor routes traffic through multiple relays rather than relying on one VPN server.

Each technology has different goals, trade-offs, and threat models.

16. A VPN in One Diagram

Image

Image

Image

Image

Image

Image

The simplest way to remember it:

             WITHOUT VPN

YOU ──────── ISP ───────── WEBSITE
 │                           │
 └────── Your IP ────────────┘


              WITH VPN

YOU ───🔐 ENCRYPTED─── VPN SERVER ─── WEBSITE
                         │
                         └── Website sees VPN IP
Enter fullscreen mode Exit fullscreen mode

17. The Most Important Concept

Don't think:

"A VPN makes me invisible."

Think:

"A VPN changes the path my traffic takes and encrypts the connection between my device and the VPN server."

That's a much more accurate mental model.

🧠 Final Takeaway

A VPN essentially works like this:

1. You connect to a VPN server
             ↓
2. A secure encrypted VPN connection is established
             ↓
3. Your traffic travels through that connection
             ↓
4. The VPN server sends traffic to the internet
             ↓
5. Websites see the VPN server's IP
             ↓
6. Responses return through the VPN connection
Enter fullscreen mode Exit fullscreen mode

In one sentence:

A VPN creates an encrypted tunnel between your device and a VPN server, routing your internet traffic through that server so your public IP is masked from the destinations you connect to.

And the most important caveat:

VPN ≠ anonymity.

It is a privacy and security tool, not magic.

🎬 If you're turning this into your short

The article gives you the complete technical foundation. For the Reel, I'd reduce it to one story:

Normal internet → VPN tunnel appears → packet gets encrypted → VPN server forwards it → website sees VPN IP → “But VPN ≠ anonymity.”

That gives you a much stronger visual narrative than trying to explain every VPN protocol in 60 seconds.

Top comments (0)