What Is a VPN? A Definition in Terms of Your IP Address
A VPN is software that gives your device an extra network interface and sends its traffic out through that interface to a server run by an operator you chose. The visible result is that the public address remote services associate with you stops being the one your internet provider issued and becomes the server’s instead. That is the whole of the mechanism: a change to addressing, and a change to routing. Anything a VPN is said to do that cannot be traced back to one of those two things is worth checking twice.
The name, read literally
All three words are doing real work, and reading them backwards is the fastest route to the definition.
Network has its ordinary meaning: a set of machines that can address each other and pass packets among themselves. A VPN makes your device a member of one it was not previously part of — the operator’s.
Private means the traffic crossing that membership is not readable by the networks it physically travels over. Your home link, your mobile carrier, and every intermediate network in between carry a stream they are not in a position to open.
Virtual is the word most people skip, and it is the most informative of the three. There is no cable and no new hardware. The membership is manufactured in software: a driver on your device presents something the operating system cannot distinguish from a network card, and the operating system duly treats it as one. The mechanics of that are in why a VPN gives you two IP addresses.
The same definition, stated as addressing
Without a VPN, two addresses already represent you, at two different scopes. Your device holds a private address on your own network, handed to it by your router. Your router holds a public address issued by your internet provider, and that public one is what every service on the internet sees as the source of your requests. That split is the subject of public vs private IP addresses.
Connecting a VPN adds a third address and changes which of them the outside world reads.
- Your private address is untouched. Your printer, your television, and your router still know your device by it.
- Your provider-issued public address is untouched too, and it has to be: the encrypted connection to the VPN server itself travels over it, so it must keep working exactly as before.
- What changes is the source address on your traffic at the point where it finally emerges onto the public internet, because it now emerges from the operator’s server rather than from your router.
So the definition can be given without the word “tunnel” appearing in it at all. A VPN is an arrangement in which your traffic reaches the internet through an address belonging to someone else, and gets to that someone in a form the networks along the way cannot read.
What belongs to the definition, and what is bolted onto it
Most of what a VPN app shows you is product, not definition. A kill switch, split tunnelling, a choice of protocol, per-application rules, tracker filtering, obfuscation, multi-hop routing: each of these is something a particular vendor decided to build around the mechanism. They are worth understanding on their own terms, but a service with none of them is still a VPN, and a piece of software with all of them and no address substitution is not one.
This distinction earns its keep when you are reading marketing copy. Feature lists compare products against each other. The definition tells you which category of problem the product is in at all, and that is what decides whether it can help with yours.
Four things the definition does not contain
Not anonymity. Substituting an address does not remove a name. Sign in anywhere and the service knows exactly who you are; no property of the address you arrived from changes that.
Not security software. Nothing in the mechanism inspects what you download, judges whether a page is genuine, or notices that your device is already compromised. Encryption in transit protects traffic from the networks carrying it. It says nothing about what is at either end of the conversation.
Not a change to what you have already disclosed. Accounts, cookies, saved payment details, and anything you typed into a form last week are unaffected by a change of routing today.
Not a change to your own network. Your local addressing, your router’s behaviour, your household’s other devices, and the plain fact that your provider knows you have a connection all remain as they were.
Why the definition is enough to predict behaviour
Take any claim and ask which of the two mechanisms it would have to use.
“It stops the café network from seeing which sites I use.” Routing plus encryption in transit. Plausible, and it does that.
“It stops a site from recognising me.” That would require changing accounts, cookies, or device characteristics. Neither addressing nor routing, so no.
“It gets me into a service that says my account is not eligible.” An account property. Not addressing.
“It changes which country a service thinks I am in.” Partly addressing — but your address is one of several signals a service can weigh, so the honest version is that it changes one input, not the outcome.
The reason this test works is that the definition is narrow. A tool whose mechanism you can state in a sentence is a tool whose limits you can derive yourself, instead of waiting for somebody to publish a list of them.
Checking that this is what is happening on your machine
None of the above needs to be taken on faith, and confirming it takes a couple of minutes. List your network interfaces before connecting and again afterwards: a new one should appear, with an address of its own and its own resolver settings. Note the public address a service reports for you in each state. Then look at where your default route points.
If the new interface exists but the default route still leaves through your physical adapter, the VPN is connected and doing nothing — a condition that looks identical to working in most apps’ status displays. How to read your own network settings covers the fields involved. Doing it once converts the definition from something you have read into something you have watched happen, which is a considerably more durable thing to own.