How a VPN works

Updated 21 September 2026 · How we research

A VPN client builds an encrypted tunnel to a server you choose, then sends your traffic through it. Your device still uses its own internet connection; the difference is that everything inside the tunnel is unreadable to the network carrying it, and everything leaving the far end appears to come from the server rather than from you.

How a ZoogVPN connection works

Encryption protects the path to the VPN server; the server then forwards traffic to its destination.

Your device
Original IP and traffic
ENCRYPTED
ZoogVPN server
Tunnel endpoint and IP exit
FORWARDED
Internet
Sites see the server IP

Important

A VPN protects network traffic in transit; it does not replace device security, strong passwords or account protection.

Your ISP carries the tunnel but cannot read its contents. The destination site sees the VPN server's address.

Step by step

Handshake. The client and server authenticate each other and agree on session keys. WireGuard does this in a single round trip; OpenVPN and IKEv2 use a TLS or IKE negotiation that takes longer but allows more options.
Virtual interface. The client creates a virtual network adapter on your device and installs routes so that traffic is sent to it instead of directly to your router.
Encapsulation. Each outgoing packet is encrypted and wrapped inside an ordinary UDP or TCP packet addressed to the VPN server.
Egress. The server decrypts the packet and forwards it to the destination using its own address. Replies come back the same way.
DNS. Name lookups must also go through the tunnel, or they will reveal which sites you visit even though the traffic itself is encrypted. See DNS leak protection.

What your ISP can still see

A VPN changes who can see what. It does not make you invisible.

What each party observes on a correctly configured tunnel.

Observer	Can see	Cannot see
Your ISP or Wi-Fi operator	That you are connected to a VPN server, its IP address, the volume and timing of traffic	URLs, page contents, DNS queries carried inside the tunnel
The VPN provider	Your real IP address and the destinations you connect to, unless its design and retention policy prevent this	Contents of traffic that is already end-to-end encrypted, such as HTTPS
The website you visit	The VPN server's IP address, plus cookies, logins and browser fingerprints you supply	Your real IP address, unless it leaks through WebRTC or you reveal it

A VPN is not anonymity

If you sign in to an account, the service knows who you are regardless of the tunnel. A VPN changes the network path, not your identity. It also does not block malware or stop tracking inside a browser session.

Why the protocol choice changes the experience

The tunnel described above can be built several ways. UDP-based protocols such as WireGuard and OpenVPN UDP are usually faster because a lost packet is simply retransmitted by the application above. TCP-based transports guarantee delivery, which helps on hostile networks but can cause the TCP-over-TCP problem, where two retransmission timers fight each other and throughput collapses. This is covered in OpenVPN TCP vs UDP.

Frequently asked questions

Does a VPN hide my browsing from my ISP?

It hides the contents and destinations of traffic carried inside the tunnel, including DNS queries when the client routes them through the tunnel rather than leaving them to the system resolver. Your ISP can still see that you are connected to a VPN, how much data you move and when, because the tunnel itself is visible even when its contents are not. What it cannot see is which sites are inside that flow.

Does a VPN make me anonymous?

No. It changes your apparent network location, which is a narrow thing. Any account you sign in to still knows who you are, cookies persist across the change, and browser fingerprinting identifies the same browser on a new address. A VPN is useful against the network you are on and against address-based tracking; it does not make you a different person to the services you use.

Why does my connection slow down on a VPN?

Traffic travels further, is encrypted and decrypted at both ends, and the tunnel adds per-packet overhead. In practice the distance to the server dominates: a nearby server usually costs a few per cent of throughput, while an intercontinental one adds latency that no protocol choice removes. Encryption itself is rarely the bottleneck on hardware made in the last decade.

Can my ISP tell that I am using a VPN?

Usually yes. The tunnel is visible as a steady encrypted flow to one address, even though its contents are not. Standard protocols also have recognisable handshakes. Hiding the fact of VPN use is a separate problem from hiding its contents, and it is what obfuscated transports exist to address.

Does a VPN protect me from malware or phishing?

No. A VPN changes how your traffic is routed; it does not inspect what you download or decide which sites deserve trust. Some providers bundle DNS-level blocklists, which help against known bad domains, but that is a filter sitting beside the VPN rather than something the tunnel itself does.