What a VPN does (and what it doesn’t)

A VPN (Virtual Private Network) creates an encrypted “tunnel” between your device and a VPN server. Once connected, your internet traffic is typically routed through that server, so the websites you visit see the VPN server’s network address rather than your own.

Key idea: a VPN is about protecting the path between your device and the VPN server, and about changing the apparent network origin of your traffic. It does not magically make you invisible, fix every website risk, or guarantee security against everything you might encounter online.

How VPNs work in practice

In a typical setup, three components are involved:

  • Your device and apps: they generate traffic (web browsing, streaming, downloads).
  • The VPN client: the software on your device that establishes the encrypted connection.
  • The VPN server: the remote endpoint that receives your encrypted traffic and forwards it to the destination.

When the VPN is connected, your traffic is encrypted in transit to the server and then sent onward from the server to the internet. Depending on configuration, DNS lookups (the “address book” used to find websites) may also be handled through the VPN to reduce exposure of the domains you query.

Setup decisions you should understand before you begin

Before installing or configuring anything, clarify what “correctly” means for your use case. The most important decisions are usually:

1) Choose a reputable client and follow its default integration carefully

Use the official app or well-documented configuration method for your operating system. If you bypass the intended integration, it’s easier to end up with traffic that doesn’t go through the VPN.

2) Pick a VPN protocol carefully

Many VPN clients offer different connection protocols. Protocol choice can affect compatibility, speed, and how the connection behaves on different networks. If a protocol doesn’t work on your network, switch to the alternative options your client provides.

3) Verify DNS behavior (a common weak point)

A frequent mistake is assuming that “VPN connected” automatically means “all name lookups are protected.” Look for a setting related to DNS through the VPN, secure DNS, or DNS leak protection. The exact wording varies, so focus on whether DNS queries are routed through the VPN connection.

4) Use the right kill-switch (where available)

A kill switch is designed to prevent traffic from continuing unprotected if the VPN connection drops. If your client offers it, enable it when your priority is to reduce accidental unencrypted fallback.

5) Think about what should or shouldn’t use the VPN

Some clients let you route all traffic through the VPN or only specific applications. If you want comprehensive protection, ensure “route all traffic” (or an equivalent option) is enabled. If you only route certain apps, confirm your goal matches that behavior.

Step-by-step: setting up a VPN correctly

  1. Install the VPN client for your device from a trusted source and open it.
  2. Sign in and connect using the method provided by the client.
  3. Select a location/server that makes sense for your goal (for example, accessing content available in a region). Remember that availability varies by service.
  4. Check your settings before browsing:
    • Ensure the VPN connection is actually “on.”
    • Enable DNS protection options if present.
    • Turn on the kill switch if available and appropriate.
    • Confirm whether all traffic or only selected apps are routed.
  5. Run an immediate validation (details below) before you rely on the VPN.
  6. Adjust if something breaks: if websites fail to load, try a different protocol option or server location offered by the client.

Practical checks to confirm it’s working

You can’t rely solely on a green “connected” indicator. Instead, use simple checks that answer two questions: Is my traffic actually going through the VPN? and Are there leaks such as DNS queries?

1) Check your public IP address while connected

Before connecting, note your public IP (from any “what is my IP” style site). After connecting to the VPN, your public IP should change to the VPN server’s network. If it doesn’t, routing may not be active or full-tunnel may be disabled.

2) Compare DNS behavior

If your client has DNS leak protection, the expectation is that DNS lookups happen through the VPN tunnel (or via an integrated secure DNS mechanism). If you run a DNS leak test, ensure the test reports consistent results with VPN protection.

3) Confirm app traffic routing

When your client supports per-app routing, verify that the specific applications you care about are included. A quick test is to connect, open a site in the target app, and then confirm that the public IP and DNS behavior change as expected.

4) Watch for connection drops and fallback

If the VPN drops, check whether your kill switch works the way you expect. A correct setup avoids sudden unprotected browsing when the connection is interrupted.

Differences and limitations to keep in mind

VPNs differ by configuration, not just brand

Two VPNs can both claim “encryption,” yet behave differently depending on protocol support, DNS handling, routing mode (full tunnel vs selective), and whether kill switch features are enabled.

Your activity can still be visible to some parties

Even with a VPN, websites and services you use may still log what you do (for example, accounts, cookies, browsing patterns, or payment identifiers). A VPN changes network path and apparent origin, but it doesn’t erase application-level identifiers.

Captive portals and restrictive networks may complicate setup

Some networks (airports, hotels, corporate environments) use captive portals or filtering rules that can interfere with VPN connection. If the VPN connects but browsing fails, protocol choice or DNS handling may be the cause.

Speed and latency can change

Because your traffic is routed through an extra server and encrypted, performance may be different from direct browsing. Correct setup focuses on stability and compatibility first, then you can evaluate usability.

Proxy vs VPN

A proxy can route traffic, but it usually does not provide the same end-to-end encrypted tunnel behavior that a VPN client aims to provide. If your client offers both features, ensure you know which one you’re actually using.

Split tunneling

Split tunneling routes only some traffic through the VPN. It can improve performance, but it increases the chance that some traffic is not protected in the way you intend.

Device vs browser VPN scope

Some people think “VPN in the browser” is identical to a full-device VPN. Device-level VPN behavior generally provides more consistent routing across apps, while browser-only approaches may leave other apps unprotected.