How VPN Works: Beginner Guide with Real Examples (2026)
What is a VPN? How It Works, Types, When You Actually Need One & What It Cannot Protect You From (Complete 2026 Guide)
The Colonial Pipeline ransomware attack that shut down 45% of the US East Coast's fuel supply started with a single compromised VPN password — on a VPN account with no multi-factor authentication enabled. The attackers did not need to bypass any firewall. They did not exploit a zero-day vulnerability. They logged in through the front door, using a password almost certainly obtained from a dark web credential market.
That attack illustrates something important about VPNs that most guides miss entirely: a VPN is both a critical security tool and a significant attack surface if configured carelessly. A VPN with MFA is a powerful defence for remote workers. A VPN without MFA is an exposed entry point that attackers actively scan for and exploit.
This guide explains exactly what a VPN is, how it actually works technically, every type of VPN and when to use each, the protocols that power them (with a frank comparison), and — most importantly — the five myths about VPN "anonymity" and "security" that put people at risk when they believe them.
- What a VPN is — the honest, complete explanation
- How a VPN works — tunnelling, encryption, and IP masking explained
- VPN protocols — WireGuard vs OpenVPN vs IKEv2 compared
- Types of VPN — consumer vs corporate vs site-to-site
- When you genuinely need a VPN — the real use cases
- 5 VPN myths that put people at risk
- VPN security risks — the attack surface you might not know about
- VPN vs proxy — key differences
- How to choose a VPN that actually protects you
What a VPN Is — The Honest, Complete Explanation
A Virtual Private Network (VPN) creates an encrypted tunnel between your device and a VPN server. All your internet traffic flows through this tunnel — encrypted, so that anyone intercepting it between your device and the VPN server sees only unreadable ciphertext. Your real IP address is hidden from the websites and services you visit, which instead see the IP address of the VPN server.
That is what a VPN does. Here is the honest version of what that means in practice:
- It protects your traffic from your local network and ISP. On public WiFi, the coffee shop operator cannot read your traffic. Your ISP cannot see which sites you visit. This is genuinely valuable protection.
- It hides your IP address from websites you visit. They see the VPN server's IP, not your home or office IP. This provides geographic privacy and bypasses some regional restrictions.
- It does NOT make you anonymous. If you are logged into Google, Facebook, or any other account, those services know who you are regardless of your IP address. Cookies, browser fingerprinting, and account logins all identify you independently of your IP.
- It does NOT protect you from malware, phishing, or social engineering. A VPN encrypts your traffic tunnel — it cannot prevent you from downloading malware or entering your password on a phishing site.
- It shifts trust to the VPN provider. Your ISP can no longer see your traffic — but your VPN provider can. Choosing a trustworthy provider with a verified no-logs policy is essential.
How a VPN Works — Tunnelling, Encryption and IP Masking
When you connect to a VPN, three things happen in sequence:
The tunnelling protocols used (WireGuard, OpenVPN, IKEv2) handle the mechanics of creating and maintaining this encrypted tunnel. The encryption itself is typically AES-256 for the data channel — the same algorithm protecting bank transactions and government communications, as detailed in the encryption guide.
VPN Protocols — WireGuard vs OpenVPN vs IKEv2 Compared
| Protocol | Speed | Security | Use Case |
|---|---|---|---|
| WireGuard | Fastest — lean 4,000-line codebase, hardware-optimised | Excellent — modern cryptography (ChaCha20, Curve25519). Easier to audit than OpenVPN. | Best default choice in 2026. Mobile, desktop, streaming. |
| OpenVPN | Slower than WireGuard — larger overhead | Excellent — 20+ years battle-tested, highly configurable. Industry standard for enterprise. | Corporate environments requiring maximum configurability and compatibility. |
| IKEv2/IPSec | Fast — especially on mobile | Good — strong security, but some NSA involvement in design raises questions for high-sensitivity use | Mobile devices — handles network switching (WiFi to cellular) without dropping the tunnel. |
| L2TP/IPSec | Moderate | Weak — avoid. Potentially backdoored. Many providers still offer it for legacy compatibility. | Avoid unless required for legacy system compatibility only. |
| PPTP | Fast | Broken — completely insecure. Multiple known vulnerabilities. Do not use. | Do not use under any circumstances. Only appears in very old systems. |
For 2026: Choose WireGuard as your default. If your corporate environment requires OpenVPN, use it. Avoid PPTP and L2TP completely. IKEv2 is a reasonable choice for mobile where the WireGuard implementation is less mature.
Types of VPN — Consumer, Corporate, and Site-to-Site
Consumer VPN (Remote Access — Personal)
The VPN service most people think of — a subscription from providers like Mullvad, ProtonVPN, NordVPN, or ExpressVPN. You install the app, connect to a server in your chosen country, and all your traffic routes through that provider's infrastructure. Your ISP sees only encrypted traffic to the VPN server. Websites see the VPN's IP address.
Consumer VPNs are legitimate privacy tools for specific situations. They are not security magic. A consumer VPN on a $3/month plan from a provider with a questionable privacy policy may simply shift your surveillance from your ISP to the VPN provider — who has even more incentive to sell your data because their margins are thin.
Corporate VPN (Remote Access — Business)
Corporate VPNs allow remote employees to access internal company resources (intranets, databases, development servers, internal applications) as if they were physically in the office. The traffic is encrypted between the employee's device and the company's VPN gateway. The company's network sees the employee as a local user.
Corporate VPNs are extremely high-value attack targets — compromising a corporate VPN credential gives an attacker access to the entire internal network, not just one user's browser history. The Colonial Pipeline attack, the Pulse Secure VPN exploits (2021), the Fortinet VPN vulnerabilities (2022-2024), and countless ransomware incidents have all begun through corporate VPN compromise. This is why MFA on corporate VPNs is not optional — it is the minimum viable defence. The relationship between VPN credentials and ransomware is covered in detail in the ransomware guide.
Site-to-Site VPN
Connects two entire networks together permanently — typically a company's head office network to a branch office, or a corporate network to a cloud environment (AWS/Azure VPC). Unlike remote access VPNs which connect individual users, site-to-site VPNs connect network to network. All traffic between the two sites is encrypted automatically, making the connection behave like a single unified private network despite traversing the public internet. Commonly used by organisations with multiple offices or hybrid cloud architectures.
When You Genuinely Need a VPN — The Real Use Cases
Cut through the marketing: here is when a VPN actually provides meaningful protection, and when it does not.
- Public WiFi — YES, use a VPN. Unencrypted public WiFi (hotels, cafes, airports) allows anyone on the same network to perform man-in-the-middle attacks on unencrypted traffic. While HTTPS protects most traffic already, a VPN adds a full encryption layer that protects all traffic including DNS queries, which reveal every domain you visit. For any sensitive activity on public WiFi, a VPN is worthwhile.
- ISP tracking and data selling — YES, relevant. Many ISPs collect and sell browsing metadata. A VPN prevents your ISP from seeing your DNS queries and traffic destinations. This is a legitimate privacy concern, particularly in countries with limited ISP regulation.
- Accessing geo-restricted content — YES, this works. Streaming services, news sites, and services that restrict access by country see the VPN server's IP. This is the primary reason most consumers buy VPNs in 2026.
- Remote work access to corporate resources — YES, essential. Corporate VPNs are a core infrastructure requirement for remote access. See corporate VPN section above.
- "Complete anonymity" — NO, this is a myth. See the myths section below.
- Protection from malware or phishing — NO. A VPN encrypts your network tunnel. It cannot prevent you from downloading a trojan or entering your credentials on a phishing site. These threats operate at the application layer, above where a VPN operates.
- Protection on your home network — limited value. Your home network is private. The main risk is your ISP, which a VPN addresses. But if you trust your home network and ISP, the marginal security benefit of running a VPN 24/7 is small compared to the latency cost.
5 VPN Myths That Put People at Risk
VPN Security Risks — The Attack Surface
VPNs themselves are frequently exploited entry points for major attacks. This is not a reason to avoid VPNs — it is a reason to maintain them correctly:
- Unpatched VPN software is one of the top ransomware entry points. Fortinet, Pulse Secure, Citrix, and Palo Alto VPN appliances have had critical vulnerabilities exploited within hours of CVE publication. VPN software must be patched as a top priority — faster than almost any other system because it sits on the network perimeter and is directly internet-accessible.
- No MFA on VPN = open door. Credentials for corporate VPNs are available on dark web markets for $50–$500 per account. If the VPN has no MFA, those credentials are immediately exploitable. MFA turns a $200 credential purchase into a useless piece of text.
- Split tunnelling misconfiguration. Split tunnelling allows some traffic to bypass the VPN. Misconfigured split tunnelling can expose internal resources or allow malware on a user's device to communicate with C2 servers while bypassing corporate monitoring.
- DNS leaks. Some VPN implementations leak DNS queries outside the encrypted tunnel, revealing your browsing destinations to your ISP even with the VPN connected. Test for DNS leaks at dnsleaktest.com.
VPN Security Checklist
- For corporate VPNs: enable MFA immediately if not already active. No exceptions. The single most important VPN security control. See the MFA guide for implementation options.
- Patch VPN software within 24 hours of critical CVE disclosure. VPN appliances are the most exploited entry point for ransomware. Set up vendor security alerts and treat VPN patches as emergency deployments.
- For consumer VPNs: choose providers with independently audited no-logs policies. Mullvad, ProtonVPN, and ExpressVPN have all published independent audit reports. "We promise we don't log" without an audit is not meaningful assurance.
- Use WireGuard or OpenVPN protocol. Avoid PPTP and L2TP. Check your VPN app settings to confirm the active protocol.
- Enable a kill switch. A VPN kill switch blocks all internet traffic if the VPN connection drops — preventing your traffic from accidentally being sent unencrypted. Essential for privacy-sensitive use cases.
- Check for DNS leaks. Visit dnsleaktest.com while connected to your VPN. All DNS queries should resolve through your VPN provider, not your ISP.
- Consider Zero Trust Network Access (ZTNA) for corporate environments. ZTNA provides more granular access control than traditional VPN — instead of placing a remote user inside the entire internal network, ZTNA grants access only to specific applications they need. This limits lateral movement if a credential is compromised.
Comments
Post a Comment