What "tunnel" means when people talk about VPNs

A VPN tunnel is a way of carrying one network connection inside another. Each packet your phone produces is encrypted and placed, whole, inside a new packet addressed to the VPN server. The outer packet travels across the Wi-Fi and the internet like any other; the network can see it exists but not what is inside. The server removes the outer packet, decrypts the inner one, and sends it on. Nothing is dug and nothing is physically separate; "tunnel" is the word for a packet riding inside a packet.

The literal meaning

Networking engineers use "tunnel" for any arrangement where one protocol's packets are carried as the payload of another's. Your browser's request is a packet with a source, a destination and some data. A VPN takes that entire packet, treats it as data, encrypts it, and puts it inside a fresh packet whose destination is the VPN server. This is called encapsulation.

The inner packet still says where you were really going. The outer packet only says "to the VPN server". Every router between your phone and the server reads the outer packet, because that is the one addressed in a way it can see, and forwards it. None of them can read the inner one, because it is encrypted. At the server, the process reverses: the outer packet is stripped, the inner one is decrypted, and the original request continues on its way with the server's address as its source.

Why the metaphor fits

Think of the path from your phone to a website as a road. Without a VPN, your packets drive along it in the open, and every checkpoint along the way, the Wi-Fi router, the ISP, can see the number plate and the destination. With a VPN, the packets travel inside a sealed vehicle that only goes to one place, the server. Checkpoints see a vehicle going to the server, over and over. What is inside, and where it goes after the server, is out of their sight. The step-by-step explanation of how a VPN works puts this in order.

The metaphor breaks in one useful place. A real tunnel hides that anyone is travelling. A VPN tunnel does not; the stream of sealed packets to one address is visible and distinctive, which is how some restrictive networks recognise and block VPN traffic.

The two ends

A tunnel needs something at both ends that understands the wrapping. On your phone, that is the VPN app, which Android hands a virtual network interface so that other apps' packets arrive at it for wrapping. At the far end, it is the VPN server, which unwraps. Both ends must hold the same encryption keys, agreed in a handshake before any traffic moves, and both must agree on the protocol, meaning the exact format of the outer packet and the encryption inside it. VPN encryption explained covers what the keys actually protect.

Full tunnel and split tunnel

When every app's packets go through the tunnel, that is a full tunnel, and it is the default. Split tunnelling means choosing some apps whose packets skip the wrapping and go straight to the network. People do this for banking apps that object to a foreign address, or for apps that need to reach a printer or a TV on the local Wi-Fi.

On Android the sensible way to do this is an exclude list: name the apps that stay outside, and everything else, including apps you install next month, is inside by default. The alternative, an allow list where only named apps are inside, means every new app silently leaks. Split tunnelling on Android explains how to set it up and which apps are worth excluding.

Overhead: why the tunnel changes packet size

Wrapping is not free. The outer packet has its own headers, and the encryption adds a few bytes of its own, so every packet grows by a fixed amount. Networks have a maximum packet size, usually 1500 bytes on Ethernet and Wi-Fi, and a packet that was already at the limit no longer fits once wrapped. The VPN app handles this by telling the phone that the tunnel interface has a smaller maximum, so apps produce packets that still fit after wrapping.

When that number is wrong, some sites load and others hang, with no error. It is one of the least obvious VPN faults and the MTU post is about it.

When the tunnel drops

A tunnel is only as good as its two ends staying in agreement. If the server stops answering, or your phone changes networks, the tunnel is down until the handshake is redone. In that gap Android would happily send packets unwrapped, with your real address, unless told not to. The setting that tells it not to is "Block connections without VPN" under Always-on VPN, and it is what a kill switch means on Android.

Tunnels inside tunnels

On a network that blocks the usual VPN packet shapes, an app can wrap the tunnel a second time, inside a TLS connection on port 443 so that it looks like ordinary web traffic. That is a tunnel inside a tunnel, and it costs a little more overhead in exchange for getting through. A well-built app tries the plain tunnel first and the wrapped one only if the plain one fails.

Culvert VPN builds its tunnel with WireGuard where the network allows it, tries a TLS-wrapped tunnel and other methods where it does not, offers split tunnelling as an exclude list, and is free on Google Play.