Inside the tunnel
A VPN changes the path, not the laws of networking.
A VPN client creates an encrypted connection to a VPN endpoint and sends selected traffic through it. The endpoint may then forward that traffic toward an internal service or the public Internet.
A full-tunnel configuration sends most traffic through the VPN. A split-tunnel configuration sends only selected destinations through it. In both cases, the VPN provider or gateway can become an important trust boundary, and the final service still has its own identity and security controls.
Protect IP traffic
IPsec secures packets between trusted tunnel endpoints.
IPsec is a suite for protecting IP traffic with authentication, integrity, and, commonly, encryption. ESP carries encrypted and integrity-protected payloads; AH authenticates selected packet fields but does not encrypt the payload and is uncommon with modern NAT-based paths.
Transport mode
Protects the payload of an IP packet while leaving the original IP header visible, often for host-to-host protection.
Tunnel mode
Encapsulates the original packet inside a new IP packet, which is common for site-to-site VPN gateways.
IKEv2
Negotiates peers, algorithms, keys, and Security Associations before protected traffic flows.
NAT-T
Encapsulates IPsec through UDP when address translation would otherwise interfere with the protected exchange.
IPsec protects the path between its security associations; it does not automatically authenticate the application or make the destination trustworthy. A VPN design still needs identity, routing, authorization, key rotation, and endpoint policy.
Map the observers
A tunnel changes visibility; it does not erase it.
The local network may see a connection to the VPN endpoint and metadata such as timing and volume. The VPN operator can see traffic arriving at the gateway and may see or control what happens after decryption. The destination usually sees the VPN gateway as the apparent source.
End-to-end encryption can still protect application content beyond the tunnel, while the destination can apply its own identity, logging, and access controls. Ask which observer, segment, and layer your privacy claim concerns.
Build the model
Four VPN decisions
Endpoints
Which client and gateway terminate the protected tunnel?
Route
Which destinations use the tunnel and which use the local path?
Trust
Who operates the gateway and can observe traffic at its boundary?
Access
Which identities and services are allowed after the tunnel is established?
Mini investigation
Inspect a VPN route choice
Select the observed behavior and identify the most direct question to ask.
Most traffic is sent to the VPN endpoint before continuing to its destination.
Inspect the route table and confirm which gateway handles public destinations.
Knowledge check
Test your VPN model
Answer eight questions. The answer order changes each time.