What a VPN is

A Virtual Private Network, or VPN, creates a logical private path across another network.

“Virtual” is the key word. There is no dedicated cable between you and the network you want to reach. There is only the ordinary Internet. The VPN builds something that behaves like a private link on top of it.

Here is the mechanism. Your device sends selected packets into a tunnel. The VPN software protects them, wraps them inside other packets, and sends them to the other endpoint. The endpoint removes the outer wrapper and forwards the original packets. Replies travel back through the tunnel.

Two endpoints do all the work. One runs on your device. The other runs at the edge of the network you want to reach.

laptop ──(protected outer packets, across the Internet)──▶ VPN endpoint ──▶ private network

On your device the tunnel appears as a network interface, right next to the physical ones:

ip -brief address
# lo     UNKNOWN  127.0.0.1/8
# eth0   UP       192.168.1.34/24
# wg0    UNKNOWN  10.14.0.2/24

wg0 is a virtual interface. Packets the operating system routes into it get protected and wrapped. Packets arriving through it get unwrapped and delivered like any other traffic.

That interface is the whole trick. The rest of the system does not need to know a VPN exists. It sees one more interface, with routes pointing at it, and uses it like any other.

Why does this arrangement exist? Because networks route on addresses, and a private address like 10.14.0.7 means nothing on the public Internet. No router out there will carry a packet toward it. The tunnel gives those packets a routable outer envelope, so they can cross networks that would never carry them directly.

One warning before you go further. A VPN is a path, not a promise that every system behind it is safe. Connecting to a network does not make that network trustworthy, and a VPN endpoint forwards malicious packets exactly as well as honest ones.