VPN stands for Virtual Private Network. A VPN creates an authenticated and encrypted connection between a device and a server or destination network, so traffic travels through it instead of going directly to the Internet.
In the guide to IPsec VPNs, NIST describes a VPN as a virtual network over existing infrastructure that provides secure communication mechanisms for data and IP information. A VPN is a way to organize a connection, not a promise that every activity is private or safe.
How does a VPN work?
When you click connect, the client finds a server, authenticates an account or certificate, negotiates a protocol, and then creates an encrypted tunnel. The VPN server receives packets and forwards them to an internal network or website. It can see connection information, so using a VPN also means shifting trust to the VPN operator. NIST notes that a VPN reduces risk but does not eliminate every risk; software and configuration can still have weaknesses.
Not every connection puts the entire Internet into the tunnel. Full tunnel sends default traffic through the VPN, while split tunnel sends only specified networks or applications. Microsoft's VPN routing documentation explains these two approaches. A “Connected” status is not enough to conclude that every application is using the VPN.
Do not confuse a VPN tunnel with a proxy, client, or HTTPS
These terms often appear together but refer to different layers. A tunnel is the path between two connection endpoints; it can connect a device to a company network or a service server, and its protection scope depends on the route and on full- or split-tunnel mode.
Proxy
A proxy is an intermediary server that receives requests from an application and forwards them to the destination. A browser can use HTTP, HTTPS, or SOCKS proxies according to separate settings. MDN's documentation on proxies and tunneling describes how PAC decides whether a request goes directly or through a proxy. A proxy configured for a browser does not automatically protect other applications.
VPN client
The client is user-side software for signing in, receiving configuration, and controlling the connection. It may create a system-level VPN profile or only run a local proxy. An app name or shield icon does not prove that every mode is a “full VPN.” With a panel that offers multiple applications and protocols, inspect the network profile and the actual tunnel scope.
HTTPS
HTTPS is encryption between an application and a website, provided by TLS. It is independent of a VPN: you can use HTTPS on its own or inside a VPN. Mozilla's explanation of HTTPS-Only Mode describes a mechanism that forces web connections to use HTTPS; it does not turn all traffic into a VPN. A VPN protects the segment to the VPN server, while HTTPS protects the segment to the website.
Practical uses of a VPN
A VPN is often suitable for the following needs:
- Accessing internal resources while working remotely.
- Having a website see the VPN server's IP instead of the original public IP. This can change its location assessment, but does not guarantee access, speed, or region-specific content.
A VPN can still add latency or interruptions because traffic passes through an additional server; quality depends on the original network, location, and server load.
Security limits to remember
A VPN does not detect fake websites, prevent malware in files you open, or fix an account whose password has already been exposed. A website can still recognize you through your account, cookies, and data you provide deliberately. If a website uses HTTP, content after it leaves the VPN server is not protected by TLS.
A VPN operator may know connection times, data volume, destination addresses, or other information depending on the protocol and logging policy. Do not choose a service only because it says “100% anonymous”; check what it collects, how long it keeps the data, and how it handles legal requests.
CISA warns that traditional VPNs carry risks when misconfigured; its guidance on modern approaches to network access security recommends assessing risk and improving visibility. Keep your VPN and connected devices up to date.
How beginners can choose a VPN
Before subscribing, answer four questions:
- Do you need access to an internal network, protection for the whole device, or only a browser proxy? The answer determines whether to choose a system profile, full tunnel, or split tunnel.
- Which devices need to use it? Check whether the app has a suitable version for Windows, macOS, Android, iOS, or Linux; review the device limit and ability to switch networks.
- Who operates the servers? Look for company information, the logging policy, support methods, data handling, and update history. Even a transparent service cannot promise to work on every network.
- What is your fallback if the connection fails? Prefer a client with clear documentation, a kill switch if your needs call for one, and an easy way to export or delete profiles.
After installation, disconnect and reconnect, open an HTTPS service, check the route or IP with a trusted tool, and then try both Wi‑Fi and mobile data. Enable only one VPN or proxy application at the same network layer to avoid conflicts. If the place where you use it has its own rules, check the current rules yourself; this article is not legal advice.
In short, a VPN is a network tunnel with a specific scope and conditions. Understanding tunnels, proxies, clients, and HTTPS helps you avoid equating one application with a “full-device VPN” and set realistic security expectations. When you need to prepare each operating system, see the guide to installing a VPN on different devices; security and legal notes are in the overview of safe VPN use.