What a VPN is

A Virtual Private Network, or VPN, is a private path built on top of another network.

The key word is “virtual”. There is no dedicated cable between you and the network you want to reach. There is only the ordinary Internet. The VPN builds something that behaves like a private link on top of it.

Here is how it works. Your device picks some packets and sends them into a tunnel. The VPN software protects them, wraps them inside other packets, and ships them to the other end. The other end removes the wrapper and forwards the original packets. Replies come back the same way.

Two endpoints do all the work. One runs on your device. The other runs at the edge of the network you want to reach.

laptop ──(protected outer packets, across the Internet)──▶ VPN endpoint ──▶ private network

On your device the tunnel shows up as a network interface, right next to the physical ones. Let’s list them:

ip -brief address
# lo     UNKNOWN  127.0.0.1/8
# eth0   UP       192.168.1.34/24
# wg0    UNKNOWN  10.14.0.2/24

wg0 is a virtual interface. Any packet the operating system routes into it gets protected and wrapped. Any packet arriving through it gets unwrapped and delivered like normal traffic.

That interface is the whole trick. The rest of the system does not need to know a VPN exists. It sees one more interface, with routes pointing at it, and uses it like any other. Your browser, your SSH client, your database tool: none of them change.

Why do we need this at all? Because networks route on addresses, and a private address like 10.14.0.7 means nothing on the public Internet. No router out there will carry a packet toward it. The tunnel gives those packets a routable outer envelope, so they can cross networks that would never carry them directly.

I want to give you one warning before you go further. A VPN is a path, not a promise that everything behind it is safe. Connecting to a network does not make that network trustworthy. A VPN endpoint forwards malicious packets exactly as well as honest ones.

Keep the picture from this lesson in mind for the rest of the course: two endpoints, a virtual interface on each side, and routes that decide what goes in. Everything else we build is a variation on it.