How does a VPN work?
Also asked as: How does VPN encryption work? · What happens when I connect to a VPN?
Direct answer
When you connect, the VPN app and a server exchange keys and open an encrypted tunnel between them. Every packet your device sends is encrypted, carried to the server, decrypted there and forwarded to its destination under the server's IP address. Replies come back the same way, so your network sees only encrypted traffic to one server.
The four steps
Connect: the app authenticates with the provider and is told which server to use. Handshake: the app and the server agree on session keys — with WireGuard this is a Curve25519 key exchange that completes in a single round trip. Tunnel: a virtual network interface appears on your device, and the operating system routes traffic through it. Forward: the server decrypts each packet and sends it on to the website under its own address, then encrypts the reply and sends it back.
Because the whole device routes through the interface, every app is covered, not only the browser. A browser extension is different: it sets a proxy for the browser alone, so the rest of the machine stays on your own connection.
Where the encryption starts and stops
The tunnel encrypts between your device and the VPN server. Past the server, traffic is whatever it was — an HTTPS site is still HTTPS, a plain HTTP site is still plain. A VPN therefore hides your traffic from your local network and your ISP, and hides your address from the site; it does not add encryption to a connection that had none at the far end.
The VPNmine tunnel
VPNmine's desktop, mobile and TV apps open a WireGuard tunnel encrypted with ChaCha20-Poly1305 to a server VPNmine rents and configures itself in one of 68 countries. The browser extension proxies through the same network over HTTPS or SOCKS5, because an extension cannot open a system-wide tunnel.
Sources
Related questions
- What is a VPN?A VPN is an encrypted connection between your device and a provider's server. What that changes about your IP address, your ISP's view and your privacy.
- What is WireGuard?WireGuard is a modern VPN protocol: small codebase, fixed modern ciphers, one-round-trip handshake, fast reconnects. Why it replaced OpenVPN in most apps.
- Does a VPN hide my IP address?A VPN replaces the IP address websites see with the server's. Where that holds, where it leaks (DNS, WebRTC, IPv6), and how to check your exit address.
- VPN extension vs VPN app: which one do I need?An extension routes the browser through the VPN; an app routes the whole device. When the browser is all you need, when it is not, and how VPNmine does both.