A VPN (Virtual Private Network) creates an encrypted, private connection between a device and a remote network over the public internet. All traffic is scrambled so that anyone intercepting it — an ISP or a hacker on the same Wi-Fi — sees only unreadable ciphertext. VPNs are a key network security measure in the GCSE specification.
What problem does a VPN solve?
When you connect to the internet directly, your data travels as packets across networks you do not control. These packets pass through your ISP's infrastructure, and if you use a public Wi-Fi hotspot, they may travel over a wireless link that anyone nearby can monitor.
For a private individual, this means browsing data is visible to the ISP and potentially to criminals on the same network. For a business with employees working from home, it means sensitive company data must travel across the open internet to reach the company's private network — a significant security risk.
A VPN addresses both problems by creating a secure, private channel inside the otherwise public internet.
How does VPN tunnelling work?
The core idea is encapsulation: the VPN client on your device wraps each packet of your data inside another packet that is encrypted and addressed to the VPN server. This outer packet travels across the internet like any other packet; the inner, encrypted packet is invisible to everything in between.
Step-by-step process:
- Your device establishes an authenticated connection with a VPN server — a server operated by a company or your employer.
- The VPN client encrypts your outgoing data using a negotiated encryption protocol (such as AES-256).
- The encrypted data is wrapped in a new packet addressed to the VPN server — this is the tunnel.
- The packet travels across the internet to the VPN server.
- The VPN server decrypts the inner data and forwards it to its destination (e.g. a company file server or a website).
- Responses take the reverse path: the VPN server encrypts them and sends them back through the tunnel.
From the perspective of anyone monitoring the network, only the encrypted tunnel packets are visible. The content and ultimate destination of your requests are hidden.
Why do businesses use VPNs?
The primary business use of a VPN is to give remote employees secure access to the company's internal network — servers, databases, and printers that should not be publicly accessible.
Without a VPN: a remote worker must either carry sensitive data on a personal device (a security risk) or the company must expose internal systems to the internet (a far greater risk).
With a VPN: the remote worker connects to the VPN server, which sits inside the company network. To the internal systems, it appears as though the employee is physically on-site. Traffic between them is encrypted.
| Scenario | Without VPN | With VPN |
|---|---|---|
| Employee accesses internal database | Database must be internet-facing | Database stays private; VPN provides access |
| Employee on public Wi-Fi | Traffic can be intercepted | Traffic is encrypted in tunnel |
| ISP can see sites visited | Yes | No — sees only VPN server address |
| Company can see employee's internet traffic | Depends on device management | Yes, if company operates the VPN |
How does a VPN differ from HTTPS?
Both VPNs and HTTPS use encryption, which causes frequent confusion.
HTTPS encrypts the content of a single connection between your browser and one specific website. An observer cannot read what you requested or what the server sent, but they can see the IP address of the website you connected to.
A VPN encrypts all your internet traffic — every application, every website, every protocol — and hides even which servers you are communicating with. From an outside observer's perspective, you appear to be communicating only with the VPN server.
Think of HTTPS as an armoured envelope for a specific letter, and a VPN as routing all your post through a secure sorting office so no one can see who you are writing to.
What are the limitations of VPNs?
- Trust shifts, not disappears. You are trusting the VPN provider rather than your ISP. If the VPN provider keeps logs or is compromised, your privacy is not protected.
- Performance overhead. Encryption and the extra routing through a VPN server add latency. The closer the VPN server, the smaller this impact.
- Not a complete security solution. A VPN does not protect against malware on your device, phishing attacks, or weak passwords.
- Legal and policy considerations. Some organisations' acceptable use policies restrict or require VPN use. In some countries, VPN use is restricted by law.
Frequently asked questions
Is a VPN the same as a proxy?
No. A proxy server forwards your requests on your behalf but does not encrypt your traffic — it simply changes your apparent IP address. A VPN both changes your apparent IP address and encrypts all traffic between your device and the VPN server. For security purposes, a proxy offers far weaker protection than a VPN. For GCSE, the key distinguishing feature of a VPN is the encrypted tunnel, not the IP masking.
Do VPNs make you completely anonymous online?
No. A VPN hides your activity from your ISP and other observers on the network, but the VPN provider itself can see your traffic if they keep logs. Websites can also identify you through cookies, browser fingerprinting, and logged-in accounts — none of which a VPN affects. VPNs significantly enhance privacy and security, particularly on untrusted networks, but they do not make someone truly anonymous.
How does the VPN server know the traffic came from you and not from an attacker?
Authentication is performed when the VPN connection is established. Common methods include username and password, client certificates, or multi-factor authentication. The VPN server verifies your credentials before the tunnel is created. Once authenticated, the session is protected by the encryption keys negotiated at setup — an attacker intercepting traffic mid-session would see only ciphertext that they cannot decrypt without those keys.
Why might a school or university provide a VPN?
Schools and universities provide VPNs to allow students and staff to access licensed academic resources — journal databases, library systems, and internal repositories — that are restricted to on-campus IP addresses. The VPN makes the user's connection appear to originate from the campus network, satisfying the licence restrictions, while keeping the connection secure. It also protects student and staff devices when using public Wi-Fi away from campus.
Professor Turing can guide you through VPNs, encryption, and all GCSE network security topics with Socratic questions at aitutors.me.