November 6, 2026
Updated: November 11, 2026
How encapsulation works, who can still see your traffic, which protocols matter and where tunnels fall short.
Mohammed Khalil
What is a VPN tunnel? It is an encrypted connection between your device and a VPN server that carries your internet traffic inside protected packets. Your device encrypts each packet and wraps it in a new one addressed to the server, so your Wi-Fi network and internet provider see only a connection to that server. The server unwraps the traffic and sends it on. A tunnel protects data in transit along that stretch. It does not make you anonymous, stop phishing or remove malware, and the VPN provider can still see where your traffic goes.
Think of a letter inside a second envelope. The inner envelope has the real address and is sealed so nobody can read it. The outer envelope is addressed to a forwarding office. Mail carriers along the way see only the forwarding office. When the letter gets there, the office opens the outer envelope and posts the inner one.
Your data is the letter and the VPN server is the forwarding office. Two ideas make up the tunnel:
"VPN" and "VPN tunnel" are often used as if they mean the same thing. The VPN is the whole service or network. The tunnel is the protected connection it creates. NIST describes a VPN as a virtual network built on top of existing physical networks that provides a secure way to send data between computers or networks.
These steps happen each time you connect. Details vary by protocol.
The IPsec standard states the wrapping idea precisely. In tunnel mode (RFC 4303), an inner IP header carries the final source and destination, an outer IP header carries the addresses of the two tunnel endpoints, and the entire inner packet is protected. You can follow one request through the tunnel.
Here is an illustrative example using reserved documentation addresses. You are on hotel Wi-Fi at 198.51.100.7 and request a page from a site at 203.0.113.50 through a VPN server at 192.0.2.10. Your device builds the normal request, encrypts it and sends a packet addressed from 198.51.100.7 to 192.0.2.10. The hotel network can route that packet, but it cannot read the destination inside it. The server decrypts the request and contacts 203.0.113.50 from its own address, so the site sees the server rather than you.
A tunnel changes who can see your traffic. It does not remove the need to trust someone, because the party at the far end of the tunnel now holds the view your network used to have.
| Who is looking | Without a VPN | With a VPN tunnel |
|---|---|---|
| Local Wi-Fi | Your device, the sites' addresses and any unencrypted content | A connection to one VPN server, plus its timing and volume |
| Internet provider | Which sites you reach and any unencrypted content | A connection to one VPN server, plus its timing and volume |
| VPN provider | Nothing, because it is not involved | Your real IP, the sites you reach and any unencrypted content |
| Website | Your real IP, plus your login, cookies and browser details | The server's IP, but still your login, cookies and browser details |
This is also why a VPN and HTTPS do different jobs. HTTPS encrypts content between your browser and one website, all the way to that site. A VPN tunnel encrypts all traffic from your device, but only as far as the VPN server. After the server, your traffic is protected only if the site itself uses encryption. Using both is sensible.
On untrusted networks, a tunnel makes it harder for someone nearby to run a man-in-the-middle attack against your traffic. If your question is whether a VPN, proxy or Tor fits your situation, our proxy vs VPN vs Tor comparison covers that choice, including why a provider's "no-logs" claim is a promise you cannot easily verify.
A tunneling protocol is the set of rules for the handshake, encryption and wrapping. Most VPN apps choose one for you. The "Our read" column is DeepStrike's editorial summary.
| Protocol | How it tunnels | Typical use | Our read |
|---|---|---|---|
| WireGuard | Encrypted packets over UDP only, with a fixed set of modern algorithms | Consumer apps and newer deployments | A strong default where supported |
| OpenVPN | TLS-based, over UDP or TCP | Consumer apps and self-hosted servers | Mature and flexible, with more configuration to get right |
| IKEv2/IPsec | IKEv2 sets up keys; IPsec ESP carries the traffic | Phones, corporate remote access, site-to-site links | Standards-based and good for roaming |
| L2TP/IPsec | L2TP forms the tunnel; IPsec supplies the security | Older built-in clients | Legacy; use something newer when you can |
| SSTP | Carries network frames over an HTTPS connection | Mainly Windows environments | Specialist choice |
| PPTP | Tunnels PPP through an IP network, a design from 1999 | Old equipment only | Avoid it |
The sources behind that table:
For most people, the practical rule is simple: use a current protocol your app supports and move away from PPTP.
NIST's Guide to IPsec VPNs (SP 800-77 Rev. 1, June 2020) lists four architectures: gateway-to-gateway, remote access, host-to-host and mesh. Most readers will only meet the first two:
Tunnels can also be full or split. A full tunnel sends all traffic through the VPN. A split tunnel sends only some of it, while the rest uses your normal connection. Anything outside the tunnel gets none of its protection.
A kill switch blocks your internet traffic when the VPN tunnel is down, so apps cannot quietly fall back to your normal connection. Tunnels drop for ordinary reasons: a weak signal, a change of network, a device waking from sleep. Without a kill switch, traffic can go out unprotected before you notice.
Many VPN apps have their own version, and some operating systems build it in:
Expect side effects: when the tunnel is down you have no connection at all, which is the feature working.
A kill switch is also not absolute. In October 2022, BleepingComputer reported that Android sends connectivity checks outside the tunnel when joining a Wi-Fi network, even with the block setting on, and that a Google engineer described this as intended behavior. So "block everything" can still have exceptions.
A tunnel protects only the traffic that actually enters it, and devices decide that through routing and network settings. That is where leaks come from.
| Leak type | What goes wrong | What it can expose |
|---|---|---|
| Tunnel drop | The tunnel fails and apps use the normal connection | All traffic until it reconnects |
| IPv6 leak | The tunnel handles IPv4 only, so IPv6 traffic goes around it | Destinations and any unencrypted content |
| DNS leak | Name lookups go to your local network's resolver instead of through the tunnel | The site names you look up |
| Routing manipulation | A hostile local network changes routes so traffic skips the tunnel | Traffic meant for the tunnel, while the app still shows connected |
Evidence behind this list:
Our guide to DNS spoofing explains how DNS gets manipulated, and the leaks section of our VPN comparison covers DNS and WebRTC checks.
The FCC's advice for public Wi-Fi works well alongside a VPN:
For a company, a remote access VPN is a door into the internal network. In the NSA and CISA words of September 2021, these servers are "entry points into protected networks". The incidents below did not involve anyone breaking the tunnel's encryption. They went through the login or the gateway.
The login. Colonial Pipeline's CEO told senators in June 2021 that attackers got in through a legacy VPN that did not have multifactor authentication. CISA's advisory on Akira ransomware, last revised November 13, 2025, also lists VPN services without MFA and stolen VPN credentials among its initial access routes. Portals like these are natural targets for password spraying.
The gateway. The Verizon 2025 DBIR reported that edge devices and VPNs made up 22% of the targets in its exploitation-of-vulnerabilities action, almost eight times the 3% in the 2024 report. These are 2025 report figures: Verizon's public 2026 DBIR executive summary does not repeat the edge-device breakdown.
The table shows examples from the CISA Known Exploited Vulnerabilities catalog. A KEV entry means CISA has evidence of exploitation. Check the vendor's advisory for affected and fixed versions; this table is not a patch list.
| CVE | Product | What CISA's entry describes | Added to KEV |
|---|---|---|---|
| CVE-2018-13379 | Fortinet FortiOS SSL VPN | Path traversal that may let an unauthenticated attacker download system files | Nov 3, 2021 |
| CVE-2019-11510 | Ivanti Pulse Connect Secure | Arbitrary file read by an unauthenticated remote attacker | Nov 3, 2021 |
| CVE-2024-21762 | Fortinet FortiOS | Out-of-bound write allowing unauthenticated code or command execution | Feb 9, 2024 |
| CVE-2024-3400 | Palo Alto Networks PAN-OS GlobalProtect | Command injection with root privileges, no authentication needed | Apr 12, 2024 |
| CVE-2025-22457 | Ivanti Connect Secure | Stack-based buffer overflow allowing unauthenticated remote code execution | Apr 4, 2025 |
| CVE-2026-50751 | Check Point Security Gateway | IKEv1 flaw allowing a remote access VPN connection without a valid user password | Jun 8, 2026 |
| CVE-2026-19868 | SonicWall SonicOS SSLVPN | Can bypass SAML authentication controls, and may bypass SAML-enforced MFA | Nov 6, 2026 |
CISA marks known ransomware use on the first six entries as of November 6, 2026. NVD records: CVE-2018-13379, CVE-2019-11510, CVE-2024-21762, CVE-2024-3400 and CVE-2025-22457.
To see how common this is, we ran a keyword filter over the catalog on November 6, 2026 (version 2026.11.06, 1,769 entries). Thirty-five entries contain "VPN" or "SSLVPN" in the vendor, product, name or description. Adding gateway product names (Connect Secure, Pulse, GlobalProtect, NetScaler Gateway, Citrix Gateway, SMA and AnyConnect) gives 79 entries, and CISA marks known ransomware use on 38 of them.
By year added, those 79 split into 17 in 2021, 13 in 2022, 8 in 2023, 11 in 2024, 13 in 2025 and 17 so far in 2026. Treat this as a rough count, not an audit. Some entries concern other features on the same appliance, others may be missed, and the catalog began in November 2021, so its first year includes older bugs.
After the tunnel. A VPN login can land a user on a broad internal network. NSA and CISA warn that VPN compromise usually leads to further access and can mean large-scale compromise of the corporate network. From there, the next problem is lateral movement.
The NSA's summary of that guidance gives four top actions, and the full sheet also recommends standards-based IKE/IPsec over non-standard SSL/TLS VPN products:
In June 2024, CISA and its partners went further, urging organizations to move toward Zero Trust, Secure Service Edge and SASE for better visibility of network activity. That is a longer project, so existing gateways still need testing.
With written authorization and an agreed scope, a penetration test can answer questions that a configuration review alone cannot:
Testing shows what was exploitable at a point in time. It does not guarantee a gateway stays secure, so pair it with fast patching and log review. If you want your remote access tested, DeepStrike's penetration testing services include infrastructure testing with manual validation and remediation guidance, or you can contact our team to talk through scope.
A VPN is the overall service or network. A VPN tunnel is the encrypted connection it creates between two endpoints, such as your phone and a VPN server. The tunnel is the part that carries and protects your traffic.
A tunnel built with a current protocol is a sound way to protect traffic in transit, especially on untrusted networks. Its safety also depends on the provider or gateway at the far end, correct configuration, and habits such as using HTTPS and watching for phishing.
The tunnel's encryption is rarely the part that fails. The attacks documented above target stolen logins, unpatched VPN gateways or routing tricks that push traffic outside the tunnel. Older protocols such as PPTP are the exception and should be avoided.
Your provider can see that you are connected to a VPN server, along with the timing and amount of data. It cannot read the encrypted traffic inside the tunnel or see the sites you visit, assuming there are no leaks.
For most people, WireGuard, OpenVPN or IKEv2/IPsec are all reasonable, and the default in a reputable app is usually fine. Avoid PPTP. Organizations choosing a remote access gateway should read the NSA and CISA guidance, which favors standards-based IKE/IPsec.
No. A VPN tunnel is a protection you choose to use. DNS tunneling is usually a covert channel attackers use to hide data inside DNS traffic. They share the idea of carrying one protocol inside another, but nothing else.
At home, turn on the block setting where your device offers it, keep using HTTPS and move off PPTP. At work, patch the gateway, enforce MFA on every profile and limit what a VPN login can reach. A penetration test can confirm those controls hold, so talk to DeepStrike if you would like that tested.
Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.
Stay secure with DeepStrike penetration testing services. Reach out for a quote or customized technical proposal today
Contact Us
