From the outside, a VPN is just an app with a single "Connect" button. But inside, a rather elegant chain of events takes place, and understanding that chain helps you quickly solve problems when something goes wrong: speed drops, websites won't open, the connection keeps dropping.
Let's go step by step: what happens to your traffic when you turn on a VPN.
Without a VPN: what a normal connection looks like
When you open a website the usual way, the request goes directly to your internet provider. The provider sees who is connecting, where to, when, and for how long. It then forwards the request onward — through a chain of servers — to the website. The website also sees your real IP and can work out your approximate location.
Bottom line: your provider knows which websites you visit. Websites know who you are and where you are. That's how the internet normally works, but it's also a privacy problem. Add to that the dozens of intermediate routers between you and the website — and on any of them, traffic that isn't encrypted on its own (HTTP rather than HTTPS) can be read.
With a VPN: what changes
Once you turn on a VPN, an intermediary appears between your device and the internet: the VPN server. It all happens in four stages:
Step 1. Launching the app and authenticating
The VPN app connects to the server and checks that you have a valid subscription. The exchange of encryption keys happens here too, in a fraction of a second. This uses asymmetric cryptography: the keys that you and the server will use to encrypt further traffic are agreed on via a protocol that is protected against interception (most often based on Diffie-Hellman or X25519).
Step 2. Creating the tunnel
An encrypted channel is established between your device and the VPN server — this is what's called a tunnel. Everything that enters it is automatically encrypted as it leaves your device and decrypted on the server. To the operating system, it looks like a virtual network interface — hence the name "virtual private network."
Step 3. Encrypting traffic
When you open a website, the request is encrypted first, turning it into a meaningless jumble of bytes for any observer. In that form it reaches the VPN server. Even if someone technically intercepts the packet along the way (your provider, public Wi-Fi, a government filter), all they'll see is an encrypted block and the fact that you're connected to a VPN server.
Step 4. Going online from a new IP
The VPN server decrypts the request and forwards it to the website — but in its own name. The website sees the server's IP (a German one, for example), not your real one. The response comes back the same way in reverse: the website replies to the server, the server encrypts the response and sends it into the tunnel, and the app on your device decrypts it and hands it to the browser.
What protocols are and why there are several
A protocol is the set of rules for establishing the tunnel and encrypting traffic. Different protocols are optimized for different tasks:
- WireGuard. Modern, fast, and lightweight. The best default choice for speed and stability. It has only about 4,000 lines of code (for comparison, OpenVPN has more than 100,000), which makes security audits much easier.
- OpenVPN. Time-tested and very reliable, but slightly slower than WireGuard. It holds a connection well and can disguise traffic as ordinary HTTPS, so it works even on networks where other VPNs are blocked.
- IKEv2/IPsec. An excellent protocol for mobile devices: it quickly restores the connection when the network changes, as when your phone switches from Wi-Fi to 4G and back.
Usually you don't need to choose a protocol manually — the VolnaLink app does it automatically. VolnaLink itself doesn't use the protocols listed above but the modern VLESS Reality, Trojan and Hysteria 2.
Where the VPN server physically is
A VPN server is an ordinary server in a data center in some country. VolnaLink VPN runs 1000+ servers in 100+ countries. The choice of location matters: the closer the server is to you geographically, the faster the connection. The intuition is simple: light in optical fiber is no faster than the speed of light in a vacuum, so distance sets a physical limit on latency.
Often the location is dictated not by proximity but by your goal. Need access to US Netflix? A server in the US, even if it's 8,000 km away. Need to open a "home" website from abroad? A server in your own country. For everyday privacy protection, the closest fast one.
What happens if the connection drops
A proper VPN has a kill switch: if the tunnel suddenly breaks, all internet access on the device is temporarily blocked. This protects you from a situation where you think you're on the VPN but actually aren't anymore. Without a kill switch, the moment the connection drops, your real IP leaks to the websites you have open sessions with — a small but real risk, especially if you use a VPN specifically for privacy.
If your client supports a kill switch, keep it on — turning it off makes sense only in very rare cases, for example when configuring allowed local resources.
Why speed can drop
There are three main reasons:
- Physical distance to the server. From Europe, a server in Singapore will always be slower than one in neighboring Germany.
- Server load. If a thousand users are on one server, the speed gets shared.
- Encryption itself. Processing traffic takes time, even if very little. On modern processors, encryption overhead is just a few percent.
If your VPN is noticeably slow, we've covered what to do about it in why a VPN is slow.
What DNS leaks are and why they're worth worrying about
When you type "google.com" into your browser, your device asks a DNS server: "What's the IP address for this name?" Without a VPN, the DNS request goes to your provider's server, and the provider can see which websites you visit, even if the traffic itself is encrypted (HTTPS).
If a VPN is poorly configured, DNS requests bypass the tunnel and go straight to your provider. The traffic is encrypted, but the website's name leaks. In a proper VPN, all DNS goes through the tunnel as well, and each server has its own resolvers. You can check whether your current VPN has a leak at dnsleaktest.com.
Summary
A VPN is a layer between your device and the internet that does two things: it encrypts your traffic and changes your visible IP. Under the hood are the tunnel, cryptography, protocols, and server infrastructure. For the user, it all comes down to one button, but now you understand what happens behind that button.
Ready to try it? VolnaLink VPN works on all popular devices and chooses the connection protocol on its own: VLESS Reality, Trojan, or Hysteria 2.