How a VPN works
Updated 21 September 2026 · How we research
A VPN client builds an encrypted tunnel to a server you choose, then sends your traffic through it. Your device still uses its own internet connection; the difference is that everything inside the tunnel is unreadable to the network carrying it, and everything leaving the far end appears to come from the server rather than from you.
How a ZoogVPN connection works
Encryption protects the path to the VPN server; the server then forwards traffic to its destination.
Your device
Original IP and traffic
- ENCRYPTED
ZoogVPN server
Tunnel endpoint and IP exit
- FORWARDED
Internet
Sites see the server IP
Important
A VPN protects network traffic in transit; it does not replace device security, strong passwords or account protection.
Step by step
- Handshake. The client and server authenticate each other and agree on session keys. WireGuard does this in a single round trip; OpenVPN and IKEv2 use a TLS or IKE negotiation that takes longer but allows more options.
- Virtual interface. The client creates a virtual network adapter on your device and installs routes so that traffic is sent to it instead of directly to your router.
- Encapsulation. Each outgoing packet is encrypted and wrapped inside an ordinary UDP or TCP packet addressed to the VPN server.
- Egress. The server decrypts the packet and forwards it to the destination using its own address. Replies come back the same way.
- DNS. Name lookups must also go through the tunnel, or they will reveal which sites you visit even though the traffic itself is encrypted. See DNS leak protection.
What your ISP can still see
A VPN changes who can see what. It does not make you invisible.
What each party observes on a correctly configured tunnel.
| Observer | Can see | Cannot see |
|---|---|---|
| Your ISP or Wi-Fi operator | That you are connected to a VPN server, its IP address, the volume and timing of traffic | URLs, page contents, DNS queries carried inside the tunnel |
| The VPN provider | Your real IP address and the destinations you connect to, unless its design and retention policy prevent this | Contents of traffic that is already end-to-end encrypted, such as HTTPS |
| The website you visit | The VPN server's IP address, plus cookies, logins and browser fingerprints you supply | Your real IP address, unless it leaks through WebRTC or you reveal it |
A VPN is not anonymity
Why the protocol choice changes the experience
The tunnel described above can be built several ways. UDP-based protocols such as WireGuard and OpenVPN UDP are usually faster because a lost packet is simply retransmitted by the application above. TCP-based transports guarantee delivery, which helps on hostile networks but can cause the TCP-over-TCP problem, where two retransmission timers fight each other and throughput collapses. This is covered in OpenVPN TCP vs UDP.