Airport Wi-Fi. The VPN app says Connected. So what is that tunnel doing?
Short answer: a VPN tunnel encrypts every packet you send and wraps it inside a new one addressed to the VPN server. The Wi-Fi and your ISP see only sealed packets going to one address, and websites see the server’s IP instead of yours.
We built an encrypted tunnel on a test network and sniffed the Wi-Fi with and without it.
It hid everything we sent. Except one thing, in a setup plenty of laptops use.
What is a VPN tunnel, and how does it work?
A VPN tunnel is an encrypted connection between your device and a VPN server that carries all your other connections inside it. Every packet goes through two steps: encryption and encapsulation.
Think of a postcard. Anyone who handles it can read the address and the message. The tunnel locks that postcard inside an envelope addressed to the VPN server.
- The inner packet is your real traffic, from your laptop to a site like shop.example.
- The outer packet is the envelope, addressed to the VPN server, with the inner packet encrypted inside.
- At the server, the envelope comes off and the original packet goes on to the website. Replies make the same trip in reverse.
| Who’s looking | Without a VPN | With a VPN tunnel |
|---|---|---|
| Cafe Wi-Fi or ISP | Every site you visit, DNS lookups, plain HTTP pages | Encrypted packets to one server, plus their size and timing |
| VPN server | Nothing | Everything the Wi-Fi used to see |
| Website | Your real IP address | The VPN server’s IP address |
Look at the middle row. A tunnel doesn’t make your traffic invisible; it moves the view from your network to the VPN company.
We sniffed a test Wi-Fi with and without the tunnel
In November 2026 we built a small network on our Linux test box. It had a laptop, a cafe-style router with its own DNS resolver, a WireGuard VPN server and two test websites. We captured packets on the router, right where a nosy hotspot owner would watch.
It’s a lab built from Linux network namespaces and the kernel’s own WireGuard, not a commercial VPN app.
No VPN: the Wi-Fi read our request word for word
We looked up shop.example and opened a page on it. The router saw the DNS question and the full request in plain text:
10.0.0.2.47345 > 10.0.0.1.53: A? shop.example.
10.0.0.2.45876 > 203.0.113.80.80: HTTP: GET /account?user=demo HTTP/1.1
Host: shop.exampleHTTPS hid the page on our second request, but not the name. shop.example still showed up in the opening handshake, where the browser announces which site it wants.
Full tunnel: 31 sealed packets, nothing readable
Same lookup, same requests, tunnel up. The Wi-Fi saw 31 UDP packets between our laptop and port 51820 on the VPN server. That’s all:
10.0.0.2.40106 > 198.51.100.7.51820: UDP, length 96
198.51.100.7.51820 > 10.0.0.2.40106: UDP, length 112
10.0.0.2.40106 > 198.51.100.7.51820: UDP, length 96
198.51.100.7.51820 > 10.0.0.2.40106: UDP, length 96No URLs, no site names, no DNS lookups. The shop logged a visit from 198.51.100.7, the VPN server, instead of our laptop.
Then we captured on the server’s side of the tunnel. There sat GET /account?user=demo and the DNS lookup, in plain text. Whoever runs the server reads what the cafe can’t.
What does the wrapper cost? We measured it
WireGuard adds 32 bytes to every packet, plus 28 bytes for the new outer address and port. That’s 60 bytes per packet on IPv4, or 80 when the outer packet is IPv6.
Our pings matched to the byte. A 128-byte packet left the laptop as 160 bytes of encrypted data. A 1,028-byte packet became 1,072, because WireGuard also pads the inside to a multiple of 16 bytes so sizes give away less.
That overhead is why our tunnel’s MTU, the biggest packet it accepts, was 1,420 bytes instead of the usual 1,500. Add the 80-byte worst case and the result still fits a normal link. A 1,421-byte packet got refused with “Message too long”.
| Same 5 MiB download | Bytes on the Wi-Fi | Packets |
|---|---|---|
| No VPN | 5,482,255 | 3,625 |
| Through the tunnel | 5,726,514 (+4.5%) | 3,837 (+5.8%) |
Three runs gave identical counts. A 4.5% tax is small, so if a VPN feels slow, blame distance or a crowded server.
Real-world tip: if some sites load forever on a VPN while others work, the MTU is probably too big for your line. Mobile data and some fibre setups shave bytes off. Drop the tunnel MTU to 1,380 in the app or config and test again.
WireGuard, OpenVPN or IKEv2: which tunnel protocol fits you?
The protocol is the tunnel’s rulebook: how both ends agree on keys and wrap packets. It decides speed, battery life and whether the tunnel survives a strict network.
| Protocol | How it travels | Encryption | Pick it when |
|---|---|---|---|
| WireGuard | UDP only, any port | ChaCha20-Poly1305, Curve25519 keys | By default: quick to connect, small codebase |
| OpenVPN | UDP or TCP, 1194 by default | TLS keys, AES-256-GCM data | A network blocks UDP; run it on TCP 443 |
| IKEv2/IPsec | UDP 500 and 4500 | IPsec ESP, usually AES-GCM | Phones hopping between Wi-Fi and mobile data |
Our take: use WireGuard, or your provider’s version of it, until something breaks. OpenVPN over TCP is slower, but it looks more like web traffic, so it gets through hotel and office firewalls that drop UDP.
IKEv2 earns its row on phones. Its MOBIKE feature keeps the tunnel alive when your address changes, and it’s built into Windows, macOS and iOS.
If an old router offers PPTP or L2TP, skip them. The big consumer VPNs have dropped both. Our guide to VPN passthrough on home routers explains which protocols still need router help.
Full tunnel or split tunnel: does everything need to go through?
A full tunnel sends all your traffic through the VPN. A split tunnel sends only the apps or addresses you pick, and the rest uses your normal connection.
In WireGuard, one line called AllowedIPs decides what enters the tunnel. We set it to the shop’s address alone:
AllowedIPs = 203.0.113.80/32
shop.example -> sealed UDP to 198.51.100.7:51820 site saw 198.51.100.7
video.example -> GET /watch, Host: video.example site saw 10.0.0.2 (our real IP)The shop got the tunnel. The video site got our real IP, and the Wi-Fi read that request in plain text. That’s split tunnelling working as designed.
- Full tunnel on public Wi-Fi, hotels and any network you don’t trust. It covers every app, including the ones you forgot about.
- Split tunnel at home, when a banking app blocks VPN addresses or a game needs your lowest ping. Exclude those apps and keep the browser inside.
- Never exclude your browser or messaging apps on someone else’s network. Whatever leaves the tunnel is as exposed as having no VPN.
Excluded apps usually sit outside the kill switch too. Our explainer on what a VPN kill switch blocks shows what leaks when the tunnel itself drops.
What can’t a VPN tunnel hide?
A tunnel protects packets between your device and the VPN server. Anything outside that stretch is out of reach.
DNS lookups that skip the tunnel
Our lab caught this one with the tunnel connected. We left DNS pointing at the Wi-Fi router, as many laptops do after joining a network. The lookup for shop.example went out in plain text.
Why? The router sits on your local network, and the local route beats the tunnel’s catch-all route. Good VPN apps force DNS to their own resolver inside the tunnel; a manual config needs its own DNS line.
WebRTC in your browser
Browsers use WebRTC for calls, and it can hand your IP addresses to a website through a side door. Full-tunnel apps usually stop the public address leaking; browser-extension VPNs and split tunnels often don’t. Our proxy leak testing guide runs the same DNS and WebRTC checks.
The VPN company itself
The server-side capture said it plainly. HTTPS still hides page contents from the provider, but not which sites you visit or when. Choose one you’d trust with that list, which is the core of whether a VPN is worth paying for.
Logins, cookies and fingerprints
Log in to Google and Google knows it’s you, whatever IP you arrive from. Cookies, logins and browser fingerprints ride inside the tunnel untouched. A VPN changes your address, not your identity.
How do you check your VPN tunnel is working?
Run four checks after you connect. They take two minutes, and the second catches the leak most people miss.
Four checks for a working VPN tunnel
Run them with the VPN on, then once with it off to compare.
-
Step 1 of 4
Compare your IP address
Open any what-is-my-IP page with the VPN off, then on. The address and country should switch to the server’s. No change means the browser isn’t using the tunnel.
-
Step 2 of 4
Run a DNS leak test
It lists the resolvers answering your lookups. You want only your VPN provider’s. Your ISP or router in the list means lookups are skipping the tunnel.
-
Step 3 of 4
Run a WebRTC test
It shows the addresses your browser exposes. Your real public IP shouldn’t appear. Local ones like 192.168.x.x matter less.
-
Step 4 of 4
Watch the tunnel counters
Most apps show data sent and received; WireGuard’s
wg showalso prints the last handshake. Ours read 6 seconds ago, with data counted both ways. While you’re browsing, a handshake older than about 3 minutes means the tunnel is stuck.
Do you need a VPN tunnel? Our take by situation
You need one whenever the network you’re on is less trustworthy than the VPN company. That’s the whole decision.
- Public Wi-Fi, hotels, airports: yes, full tunnel, every time. Our no-VPN capture shows what an open hotspot can read.
- Home broadband: optional. It hides browsing from your ISP and moves your streaming location, but your ISP is often no worse than a cheap VPN.
- Remote work: use your employer’s VPN for company systems. It’s usually a business tunnel ending at a VPN concentrator, a different job from a consumer VPN.
- Scraping or running many accounts: a VPN gives you one shared IP at a time. Proxies suit that work; our HTTP vs SOCKS5 proxy comparison lays out the options.
Shopping for one? NordVPN’s default protocol, NordLynx, is built on WireGuard. Surfshark offers plain WireGuard, OpenVPN and IKEv2, and ExpressVPN defaults to Lightway, which it wrote itself.
Affiliate note: we get paid when you sign up through these links, at no extra cost to you. The list would be the same without them.
- NordVPN: pick it if you want WireGuard speed with the privacy tweaks already done.
- Surfshark: pick it for a whole household, because it doesn’t cap devices.
- ExpressVPN: pick it if you want an app you never have to configure.
We didn’t test these apps for this post, so run the four checks on day one.
Frequently asked questions
Is a VPN tunnel the same thing as a VPN?
Almost. The VPN is the whole service: the app, the servers and the company. The tunnel is the encrypted connection the app builds to one server while you’re connected. Disconnect and the tunnel disappears, even though your subscription and app are still there.
Can my ISP tell that I’m using a VPN tunnel?
Usually, yes. Your ISP can see encrypted packets going to a known VPN server address, plus how much data moves and when. It can’t read the contents or the sites inside. Obfuscated or stealth modes make the traffic look like ordinary HTTPS, which is harder to spot.
Can a school, office or country block a VPN tunnel?
Yes. Networks block known VPN server addresses, drop UDP or flag VPN traffic patterns. OpenVPN or a provider’s stealth mode on TCP port 443 gets through many of these blocks because it resembles normal browsing. Check the rules first, since dodging a school or employer’s network policy can get you in trouble.
What is a VPN tunnel between two offices called?
That’s a site-to-site VPN tunnel. Instead of one laptop connecting to a server, two routers or firewalls hold a permanent tunnel open between office networks, usually over IPsec. Staff don’t run any app; traffic between the offices goes through the tunnel automatically.
Is a VPN tunnel better than a proxy?
For privacy on an untrusted network, yes. A VPN tunnel encrypts all traffic from your device at the network level. Most proxies forward one app’s traffic and add no encryption of their own, so the Wi-Fi can still read anything that isn’t already HTTPS.
What is a double VPN or multi-hop tunnel?
It’s a tunnel inside a tunnel. Your traffic goes encrypted to a first VPN server, then to a second, and exits there. The first server knows your IP but not your destination; the second sees the destination but not you. Expect slower speeds and extra wrapper overhead.
Can a VPN tunnel be hacked?
Breaking the encryption of a modern tunnel such as WireGuard, or OpenVPN with AES-GCM, isn’t practical today. Real attacks go around it instead: malware on your device, a fake VPN app, leaks from bad settings, or a rogue network pushing routes that steer traffic outside the tunnel.
The bottom line
So, what is a VPN tunnel? A sealed envelope around every packet you send, addressed to a server you chose. In our test it turned a fully readable Wi-Fi session into 31 anonymous encrypted packets, for about 4.5% extra data.
Use a full tunnel on any network you don’t control, and split it only for apps that misbehave. The tunnel ends at the VPN server, so the provider matters more than the protocol. Next step: connect, then run a DNS leak test before you trust it.
