A VPN tunnel encrypts traffic between your device and a tunnel endpoint so observers on the local network cannot read the contents.
On that local network the visible connection is to the endpoint, while sites you open inside the tunnel stay hidden from it.
How it works
The tunnel is a protected path to a gateway you choose, such as a company concentrator.
After traffic leaves that endpoint it continues as ordinary network traffic, and the endpoint can see it.
This page is about that encrypted tunnel mechanism only.
How much you should trust a commercial provider who operates the endpoint is a separate question about logging, law, and the security of that provider.
Concrete examples
- A laptop sends company traffic through an office gateway while the person is on a home network.
- A branch office links to headquarters through an encrypted tunnel.
- A user reaches an internal application that is not published on the public internet.
Protective measures
- Terminate tunnels for internal traffic on systems you administer.
- Require strong authentication before a device may bring the tunnel up.
- Send through the tunnel only the traffic that truly needs that private path.
- Monitor the endpoint, because decrypted sessions are visible there.