Skip to content
VPNmine
VPN QUESTION

How does a VPN work?

Also asked as: How does VPN encryption work? · What happens when I connect to a VPN?

Direct answer

When you connect, the VPN app and a server exchange keys and open an encrypted tunnel between them. Every packet your device sends is encrypted, carried to the server, decrypted there and forwarded to its destination under the server's IP address. Replies come back the same way, so your network sees only encrypted traffic to one server.

The four steps

Connect: the app authenticates with the provider and is told which server to use. Handshake: the app and the server agree on session keys — with WireGuard this is a Curve25519 key exchange that completes in a single round trip. Tunnel: a virtual network interface appears on your device, and the operating system routes traffic through it. Forward: the server decrypts each packet and sends it on to the website under its own address, then encrypts the reply and sends it back.

Because the whole device routes through the interface, every app is covered, not only the browser. A browser extension is different: it sets a proxy for the browser alone, so the rest of the machine stays on your own connection.

Where the encryption starts and stops

The tunnel encrypts between your device and the VPN server. Past the server, traffic is whatever it was — an HTTPS site is still HTTPS, a plain HTTP site is still plain. A VPN therefore hides your traffic from your local network and your ISP, and hides your address from the site; it does not add encryption to a connection that had none at the far end.

The VPNmine tunnel

VPNmine's desktop, mobile and TV apps open a WireGuard tunnel encrypted with ChaCha20-Poly1305 to a server VPNmine rents and configures itself in one of 68 countries. The browser extension proxies through the same network over HTTPS or SOCKS5, because an extension cannot open a system-wide tunnel.

Sources