VPN basics · Plain-English answer
A VPN tunnel is the encrypted connection between your device and a VPN server. Your traffic is wrapped inside encrypted packets, travels across the ordinary internet, and is unwrapped at the server. Anyone in between sees only scrambled data addressed to the server, not what you are actually doing.
Your packets still cross the same physical internet as everyone else's. The tunnel is a metaphor for encapsulation. Each original packet is encrypted and placed inside a new packet addressed to the VPN server, like a sealed letter inside an outer envelope. Routers along the way handle the outer envelope only. The server opens it, decrypts the contents, and sends your original traffic on to its destination.
Because only your device and the server hold the keys, nothing in between can read or tamper with the contents.
The protocol defines how the tunnel is built and secured. WireGuard, which ROOT VPN uses, establishes tunnels almost instantly and re-establishes them smoothly when you change networks, which older protocols handled poorly.
A tunnel is only as good as its coverage. If DNS queries slip outside it, observers can still see which sites you visit, so it is worth running the checker at /tools/dns-leak-test/ once after setup to confirm everything flows through the tunnel.
More from the ROOT VPN answers hub.
ROOT VPN is free to start with unlimited data, no card needed, and no activity logs.
Get ROOT VPN, free