What a VPN Actually Does
It moves one thing and hides one thing. Knowing exactly which is the difference between a useful tool and a false sense of safety.
So after last lesson I wrote down my threat model. Now can I buy the VPN?
You can. But first I want you to be able to say, in one sentence, what it will do for you — because the adverts will not.
It makes me anonymous and encrypts my internet.
Half a sentence right, half a sentence that will get someone hurt. Let us fix both.
One picture
Without a VPNVPNA tunnel that moves your traffic’s exit point. It shifts trust from your ISP to the VPN company — it does not make you anonymous., your traffic goes from your device to your ISPISPYour internet service provider — the company whose wire or signal you use to reach the internet, and which can see every site you connect to., and from there out to whatever site you asked for. Your ISP sees every destination. A VPN inserts one hop: your device talks to the VPN server over an encrypted tunnel, and the VPN talks to the site.
Without a VPN:
you -> ISP (sees every site) -> the site (sees your IP address)
With a VPN:
you -> ISP (sees only: "talking to a VPN") -> VPN -> the site (sees the VPN's IP)
- Line 2The site learns your real IP addressIP addressThe number that identifies where your traffic comes from on the internet — roughly, which door it should be delivered back to., which usually maps to your household, not your name — but combined with your login, it maps to you.
- Line 5Your ISP no longer sees the destinations. It sees that you use a VPN, and when, and how much. That is metadataMetadataData about your data — not what you said, but who you said it to, when, from where, and how often., and it does not go away.
- Line 5The site now sees the VPN's address instead of yours. You have not disappeared — you have swapped which single party can see the other half.
The two honest sentences
A VPN moves your exit point — the site sees the VPN's IPIP addressThe number that identifies where your traffic comes from on the internet — roughly, which door it should be delivered back to. instead of yours — and it hides your destinations from your ISP and the local network. That is the whole product. Everything else is either a consequence of those two things or an advert.
You are on café Wi-Fi and turn on a VPN. Who can still see which sites you visit — the café, or the VPN company?
The four things it does not do
What people think a VPN hides
"I have a VPN, so I am anonymous."What still identifies you
1. Logins. You told the site who you are. A VPN cannot un-tell it.
2. Cookies and browser fingerprint. Same browser = same you, new IP or not.
3. DNS leaks. If lookups skip the tunnel, your ISP still sees destinations.
4. Behaviour. The account you reuse, the photo with location still in it.A VPN addresses exactly one identifier — your network address — and leaves every other one untouched. Most people are found by the others.
The DNS leak, because it is the common one
Before your device loads a site, it asks DNSDNSThe internet's phone book: it turns a name you type, like example.com, into the numeric address a computer connects to. for the address. If that question does not go through the tunnel, your ISP still sees every site name — even though the VPN is "on". This is the single most common way a VPN quietly does less than the label promises.
# with the VPN connected, ask: who is answering my DNS?
$ resolvectl status | grep 'DNS Servers'
DNS Servers: 10.8.0.1
# 10.x is the VPN. Good. If you see your ISP router (often 192.168.1.1)
# or your ISP's public resolver, your lookups are leaking past the tunnel.
Your VPN is connected, the padlock ([[tls|TLS]]) shows on every site, but a leak test shows your ISP's DNS server. What does your ISP still learn?
So when is a VPN actually the right tool?
When your adversary sits on the network — a café, a hotel, an ISP logging destinations, a country blocking sites. Move the exit point past them and you win.
And when it is the wrong tool — against a service you log into, or a person who already knows you — a VPN is a comfort blanket. Worse: paying for one can end the search that would have actually helped.
Legal
This teaches you to protect your own traffic and understand your own exposure. Using these techniques to evade authorisation you are subject to, or to surveil anyone else, is out of bounds and against the point.
So: a VPN moves one thing and hides one thing. Match it to a network-level adversary from your threat modelThreat modelFour honest answers: what you are protecting, from whom, what happens if it fails, and how much trouble you will go to. and it is excellent. Reach for it against a login or a person and you have solved a problem you did not have. Next: the adversary who does not attack your network at all — the one who simply looks you up, and finds you already in the open.