The five main stages
The app retrieves an authorised configuration, selects a server and establishes an authenticated channel. The system then adds routes to direct the intended traffic to a virtual interface.
Data is encrypted and encapsulated before leaving the device. The VPN server decrypts it, forwards it to its destination and reverses the process for the response.
Authenticate
The client verifies the server and presents the necessary technical credentials.
Negotiate
The protocol establishes the session keys and parameters.
Route
The system directs the intended traffic to the tunnel interface.
Relay
The exit server forwards packets to the internet.
Return
The response travels back through the tunnel and then to the application.
The role of DNS
Before connecting to a site, a DNS resolver often translates its name into an IP address. A VPN configuration can direct these requests through the tunnel, but an application using its own secure DNS may choose a different resolver.
This is why a statement such as “no DNS leaks” should always be tied to a specific platform, setting and test scenario.
The boundary of trust moves
The VPN conceals some traffic from the local network and internet service provider, but the VPN server becomes an intermediary. HTTPS continues to protect content between the browser and the site when used correctly.
Signed-in accounts, cookies, browser fingerprints and information you enter can still identify you. A VPN changes the transport path; it does not reset your digital identity.