Follow a connection from your device through a VPN tunnel to its destination, and see where routing, encryption, and privacy limits apply.
By Andreas Lazarou · Content reviewed 7 September 2026
The connection step by step
- The client contacts an endpoint. Your VPN app connects to a chosen server or an organisation’s gateway over your existing internet connection.
- The peers authenticate and establish keys. The details depend on the protocol and configuration. A VPN handshake should not automatically be described as a TLS handshake.
- Routing decides what enters the tunnel. A full-tunnel configuration aims to route the selected network traffic through the VPN. Split tunneling deliberately sends some destinations or apps through other routes.
- The client protects tunnel packets. The encrypted packets travel through your ISP to the VPN endpoint. The ISP can observe that endpoint and connection characteristics.
- The endpoint forwards the traffic. A consumer service usually forwards it to the public internet using an exit IP. A work VPN may route it to private organisational resources.
- Responses travel back. Return traffic passes through the endpoint and the tunnel to your device. The application processes the response as it normally would.
The VPN changes a route, not your identity. Logging into an account still identifies that account to the service.
VPN encryption and HTTPS protect different links
The VPN tunnel protects the link between its endpoints. When your browser uses HTTPS, the browser-to-website TLS connection continues through the tunnel; the VPN endpoint does not automatically decrypt that HTTPS content.
Traffic without suitable end-to-end protection can be visible after it leaves the VPN tunnel. Keep HTTPS enabled and pay attention to certificate warnings. A VPN cannot make a phishing site legitimate or stop a compromised device from exposing data.
Protocols use different authentication, key-exchange, and encryption mechanisms. For example, WireGuard’s protocol specification describes its Noise-based handshake and ChaCha20-Poly1305 protection. Avoid treating “AES-256,” a code-line count, or a marketing protocol name as a complete security assessment.
What protocol choices mean
| Protocol family | What to check |
|---|---|
| WireGuard and services built on it | Device support, app implementation, routing controls, and the provider’s account and address management. |
| OpenVPN | Supported configuration, transport, authentication, and the features exposed by your app. |
| IKEv2/IPsec | Operating-system support, authentication, and the behavior during network changes. |
| Provider-specific protocols | Published design information, current app support, limitations, and the scope of any independent assessment. |
No protocol is guaranteed to be fastest, impossible to block, or interruption-free on every connection. Measure the behavior that matters on your device and network, with the relevant settings recorded.
Consumer, work, site-to-site, and router VPNs
Consumer VPN: a provider supplies exit servers for internet traffic. The service changes which network carries that traffic beyond the tunnel.
Remote-access work VPN: an organisation connects authorised devices to its private resources. The NCSC’s VPN guidance is specifically about choosing and deploying this kind of organisational infrastructure.
Site-to-site VPN: gateways connect separate networks, such as offices, using configured routes and access controls.
Router VPN: a compatible router can carry traffic for selected connected devices. It does not automatically cover excluded devices, every IPv6 route, or all DNS traffic. Check the actual configuration.
Who can see what?
- The local network and ISP can see the tunnel destination, timing, and volume. Traffic or DNS requests outside the intended tunnel can expose additional information.
- The VPN operator processes the connection and may have visibility into destination and connection metadata. HTTPS still matters for content protection. Read the policy and the date and scope of audits.
- The destination website generally sees the exit IP for the routed request, along with account, browser, cookie, and application information supplied to it.
- Other apps and trackers may identify activity using signals unrelated to the public IP. A VPN does not erase existing accounts, cookies, or device identifiers.
See VPN benefits and limits and our IP and WebRTC checks for practical examples.
Frequently asked questions
Can my ISP see the websites I visit through a VPN?
For traffic and DNS correctly carried inside an encrypted tunnel, the ISP normally sees the VPN endpoint and connection metadata rather than the individual destinations inside it. Excluded routes, DNS behavior, and leaks can change that.
Does a VPN hide my MAC address from websites?
A VPN changes network routing and can change the public exit IP. A device’s local link-layer MAC address is not normally forwarded across the internet to a website, so this is a different issue from public-IP privacy.
Does a VPN always slow down a connection?
It adds processing and changes routing, so the result varies with distance, load, hardware, protocol, and the original route. Repeat measurements against a baseline before drawing a conclusion.
Does the VPN server decrypt HTTPS?
It removes the VPN tunnel protection for traffic it forwards, but it does not ordinarily decrypt the separate browser-to-website HTTPS connection. Device compromise or a separately configured TLS interception system is a different situation.
Evaluate evidence before choosing a service
A benchmark should identify the date, devices, app versions, protocol, baseline connection, locations, repeated measurements, and results. We do not claim that an unsourced percentage represents the VPN market. Read our assessment method and buying checklist.