VPNs and Tunneling

What is a VPN?

A Virtual Private Network builds an encrypted tunnel across an untrusted network, usually the internet, so that two points can communicate as if they were on the same private network.

Think of shipping cash in a locked, tamper-evident box through a public road instead of on an open truck. Anyone watching the road can see that a box is moving between two places, but not what is inside.

Tunneling and Encapsulation

Tunneling means wrapping one packet inside another. The original packet (with your real destination) is encrypted and placed inside a new outer packet addressed to the VPN server.

Without VPN:  [ IP: you -> bank ][ TCP ][ data ]
With VPN:     [ IP: you -> vpn-server ][ VPN header ][ ENCRYPTED( IP: you -> bank, TCP, data ) ]

A person on the cafe Wi-Fi sees only "this laptop is talking to the VPN server". The VPN server unwraps the packet and forwards it. The destination sees the VPN server's address instead of yours.

Types of VPN

VPN Protocols

Corporate VPNs in Practice

A company VPN gives remote staff access to internal systems such as file servers, HR tools and admin panels. Banks including Access Bank and international firms rely on this kind of controlled remote access, combined with multi-factor authentication (MFA) and device checks.

Good practice:

• Require MFA. A stolen password alone must not open the tunnel.
• Least privilege. Give users access to the systems they need, not the whole network.
• Patch the VPN gateway quickly. Internet-facing VPN appliances are a favourite target, and unpatched ones have been exploited in many real breaches worldwide.
• Log and monitor who connects, from where and when.
• Consider zero trust access, which verifies every request rather than trusting anyone who is "inside the VPN".

Split tunneling sends only company traffic through the VPN and the rest directly to the internet. It saves bandwidth but bypasses corporate inspection, so many security teams disable it for sensitive roles.

What a VPN Does NOT Do

• It does not make you anonymous. The VPN provider can see your traffic (unless it is HTTPS) and may keep logs.
• It does not stop phishing, malware or a fake login page.
• It does not protect you once traffic leaves the VPN server towards an unencrypted website.

Choose a provider you trust, or use your employer's VPN, because a VPN moves your trust from the local network to the VPN operator. Free VPN apps have been found to sell data or contain malware.

Try It: See What an Attacker Sees

In the editor on the right, type a message and switch the VPN on and off. Compare what someone sniffing the cafe Wi-Fi can read.