Home / Glossary / VPN (Virtual Private Network)
Tech & ITVPN (Virtual Private Network)
By Sitraka Forler · Lecturer, Durham Business SchoolUpdated 3 October 2026 About this site
An encrypted tunnel that connects your device to a private network over the internet.
A corporate VPN lets you reach internal systems such as a database or intranet from home as if you were in the office, so a server that only answers on the VPN looks down once you disconnect. Consumer VPN services instead route your browsing through the provider's servers. Neither makes you anonymous: the VPN operator can see where your traffic goes, and logins and cookies still identify you.
The intuition
A virtual private network builds an encrypted tunnel between your device and a network somewhere else, then routes some or all of your traffic through it. To the servers inside that network you appear to be one of them, with an internal address, which is why the market-data server that only answers to office addresses suddenly works from your kitchen. To anyone watching the path in between, your café's Wi-Fi operator or an internet provider, the traffic is an opaque stream to one endpoint: they can see that you are connected to the VPN, not what you are doing through it.
The mental picture is a sealed courier bag carried through the public post. The postal service sees the bag and its destination, the VPN gateway, but not the letters inside. Once the bag reaches the gateway it is opened, and the letters travel onward on the private network as ordinary mail. Corporate VPNs exist to extend the office network to remote staff; consumer VPN services do something different, routing your browsing out through their own gateway so that websites see the provider's address instead of yours.
The word private causes the most misunderstanding. A VPN protects the tunnel, not your identity. The VPN operator sees everything that leaves the gateway in the clear, including which sites you visit, and websites still recognise you by your login, your cookies and your browser. A corporate VPN usually logs connections by design. Nor does the tunnel make the far end safe: a compromised laptop on the VPN is a compromised laptop inside the office network, which is why firms increasingly pair VPNs with device checks and multi-factor authentication, or replace them with zero-trust access per application.
Reaching the market-data server from home, and understanding why it goes dark when the VPN drops
- A data engineer at home runs a script that pulls end-of-day prices from mdata.internal.example.com, a server on the bank's private network with the address 10.20.5.40. Without the VPN, the hostname does not resolve and the connection times out: the server does not exist as far as the public internet is concerned.
- Connect: open the VPN client, choose the profile Office-EU, and sign in with the work account. The identity provider asks for a password and a push approval on the phone, and the client checks that the laptop's disk is encrypted and its antivirus is current. After a few seconds the client shows Connected and the laptop gains a second address, 10.200.14.37, on the private range.
- Verify the tunnel: ping 10.20.5.40 now answers, and nslookup mdata.internal.example.com resolves because DNS queries are sent through the tunnel to the firm's own resolvers. Run the script: it connects, downloads 1.2 GB of prices and finishes. The café's network, if used, would only have seen encrypted packets to the VPN gateway vpn.example.com.
- Split tunnelling: the profile sends only traffic for 10.0.0.0/8 and internal domains through the tunnel; a video call goes directly to the internet. A full-tunnel profile would route everything through the office, which protects more but makes the video call slower and loads the gateway.
- What goes wrong: the home router reboots, the VPN silently drops, and the script, retrying every minute, logs connection refused for an hour. The server did not fail; the private address simply became unreachable. The script is changed to check the tunnel first and fail loudly, and the client's auto-reconnect is enabled.
- What the VPN did not do: when the engineer later opens a news site through the full tunnel, the site still greets her by name through her cookie, and the firm's web proxy logs the visit with her username. The tunnel hid the traffic from the café; it did not hide her from the destination or from the firm.
A VPN makes a remote device a member of a private network over an encrypted tunnel, so private servers reachable only on that network appear and disappear with the connection, and nothing about it makes you anonymous.
Common pitfalls
- Believing a VPN makes you anonymous: the operator sees your traffic after the tunnel, and logins, cookies and browser fingerprints identify you to every site.
- Debugging a dead internal server for an hour when the VPN simply disconnected: check the tunnel status and the private address before blaming the server.
- Running sensitive scripts on an unmanaged personal machine over the VPN: the tunnel brings that machine, and whatever is on it, inside the corporate network.
- Using a free consumer VPN for work data: the operator's business model may be your traffic, and corporate policies usually forbid routing company data through third parties.
- Mistaking the VPN for end-to-end encryption: traffic is encrypted between you and the gateway, then travels onward in whatever form it was sent, so HTTPS and database TLS still matter inside the private network.
Frequently asked questions
What does a VPN actually do?
It encrypts the traffic between your device and a gateway, then forwards it onto the network behind that gateway. A corporate VPN connects you to the office network so internal systems become reachable. A consumer VPN connects you to the provider's network so websites see the provider's address. In both cases the path between you and the gateway is hidden from intermediaries.
Does a VPN make you anonymous?
No. It hides your traffic from the local network and your internet provider, and hides your address from websites, but the VPN operator can see where your traffic goes, websites still identify you through logins and cookies, and corporate VPNs log connections as a matter of policy. A VPN changes who can observe you; it does not remove observation.
Why does an internal server stop working when I disconnect from the VPN?
Because the server has a private address such as 10.20.5.40 that is only routable inside the company network. The VPN gives your device an address on that network and a route to it; when the tunnel drops, both vanish and the hostname may not even resolve. The server is fine; your path to it is gone.
What is the difference between a VPN and SSH?
SSH encrypts one connection to one machine, typically a terminal session, and can forward individual ports through it. A VPN encrypts all traffic to an entire network and gives your device an address on it, so every application benefits without configuration. SSH is a precise tool for one server; a VPN is a general-purpose extension of the network.