What Is a VPN Tunnel? The Encrypted Path, Explained

A VPN tunnel is the encrypted connection between your device and a VPN server through which all your traffic travels. "Tunnel" is a metaphor: your data is wrapped in a protective layer of encryption so that, as it passes through the open internet, the networks in between can see that something is going to the VPN server but can't see what's inside.

There's no literal pipe. A VPN tunnel is ordinary internet traffic that has been encrypted and "wrapped" so its real contents and destination are hidden from everything between your device and the VPN server.

How the tunnel is built

The tunnel is built the moment your VPN app connects to a server: the two exchange keys, agree on an encryption method, and from then on your device encrypts everything before it leaves. The picture below shows the shape of it — the encrypted section runs from your device all the way to the VPN server, and only past the server does traffic continue in the normal way. For the full connection sequence, see how a VPN works.

Encapsulation: a packet inside a packet

The technical heart of tunnelling is encapsulation — putting one packet inside another. Your original request (say, to load a web page) is encrypted and then placed inside a new outer packet addressed to the VPN server. To your ISP, that outer packet is all it can read: it's going to the VPN, and its contents are unreadable. The server strips off the outer wrapper, decrypts the inside, and sends the real request onward.

This is also why a VPN adds a little overhead: every packet carries the extra weight of its wrapper and the cost of being encrypted and decrypted. On a modern protocol and a nearby server, that overhead is small enough that most people won't notice it.

Do all your apps have to use the tunnel?

By default, yes — a VPN sends every app's traffic through the tunnel. But you can choose to route only some apps through it and let the rest connect directly, a feature called split tunnelling. It's useful when you want your bank app to see your normal address while your browser uses the VPN, though it also means the apps you leave out aren't protected. We cover the trade-offs in split tunnelling explained.

Tunnels and your router: VPN passthrough

You may meet the term "VPN passthrough" in a home router's settings. It's a router feature that lets older VPN protocols — PPTP, L2TP and IPsec — pass cleanly through the router's network address translation to a VPN client on a device behind it. Modern consumer VPNs usually run OpenVPN or WireGuard over UDP and don't rely on it, so passthrough is mostly a legacy toggle you'll see on older hardware rather than something you'll normally need to change.

The tunnel is really the whole idea of a VPN in one word — everything else is detail about how it's built and where it's allowed to run. If you're piecing the concepts together, the overview of what a VPN is ties the tunnel, the server and the encryption into a single mental model.

What the tunnel hides — and what it doesn't

It's worth being precise about the tunnel's reach. Inside it — between your device and the VPN server — your traffic is encrypted, so your ISP and anyone on the local network can't read its contents or see which sites you're reaching. They can still tell that you're connected to a VPN and roughly how much data you're moving, because the outer packets have to be addressed somewhere; they just can't see inside.

Beyond the far end of the tunnel, ordinary rules apply again. Once the VPN server decrypts your request and forwards it, the traffic travels to the destination like any other — protected by the website's own HTTPS if it has it, and exposed if it doesn't. The tunnel protects the first leg of the journey, the part running across networks you don't control; it does nothing about the destination itself, and it doesn't hide your activity from the VPN provider, which holds the keys to the tunnel.

This is why "encrypted tunnel" is a promise about the middle of the trip, not the ends. Understanding that keeps expectations honest: the tunnel is excellent at stopping the network between you and the server from spying, and it's simply not designed to make you invisible to everyone.

Two kinds of tunnel: remote-access and site-to-site

The tunnel most people mean is a remote-access tunnel: one device connecting to a VPN server, which is what a consumer VPN app builds. There's a second kind you'll hear about in a work context — a site-to-site tunnel, which permanently links two whole networks (say, two office locations) so they behave as one. It's the same underlying idea of an encrypted link, scaled up from a single device to entire networks.

For personal privacy you only ever deal with the remote-access kind, so if a definition mentions connecting offices or business sites, that's the enterprise cousin rather than the app on your phone. Both are "VPN tunnels"; they just solve different problems. Knowing the two exist explains why some explanations of tunnelling suddenly start talking about corporate networks — they've quietly switched to the site-to-site meaning.