A high-level journey from the connect button to the encrypted tunnel and VPN gateway.
Most people experience a VPN as a single action: select a location, press Connect, and continue using the internet.
At WrapVPN, that action coordinates several systems across the application, the operating system, the network and the VPN gateway. A secure session must be established, traffic must be redirected into a virtual network interface, packets must be encrypted and the gateway must forward them without disrupting the applications running on the device.
The encryption itself is only one part of the process. The larger engineering task is making the entire path work as one reliable connection.
This article follows that path from the moment a user connects to WrapVPN until a web response returns to the device.
Starting the Connection
The process begins when the user selects a location and requests a connection.
Before the tunnel can be created, the WrapVPN application confirms that the session can proceed and identifies a suitable VPN gateway. The selected gateway may come directly from the user’s choice or from a recommendation based on factors such as location, availability and network conditions.
The application then contacts the gateway and begins establishing a secure session.
At this stage, the device and the gateway perform a cryptographic handshake. The purpose of the handshake is to confirm that both sides can communicate securely and to establish the keys that will protect the session.
These keys are not sent openly across the network. They are derived through a cryptographic exchange, allowing the device and gateway to establish shared session information over an untrusted internet connection.
Once the handshake is complete, both sides are ready to exchange protected traffic.
Moving Traffic Away from the Normal Route
Applications do not need to understand how the VPN works.
A browser continues creating web requests. A messaging application continues communicating with its service. From their perspective, they are using an ordinary network connection.
The operating system handles the change in routing.
When WrapVPN connects, it creates a virtual network interface on the device. This interface behaves like an additional network adapter, but it is implemented in software rather than connected to a physical cable or Wi-Fi network.
Traffic that should pass through the VPN is redirected into this interface.
The VPN software receives the traffic, processes it and sends it through the secure session established with the gateway. This allows the VPN to protect traffic from multiple applications without requiring separate integration with every browser, service or application on the device.
The implementation differs between operating systems, but the underlying model remains consistent:
- An application creates network traffic.
- The operating system directs that traffic to the VPN interface.
- The VPN client encrypts it.
- The encrypted traffic is sent through the device’s existing internet connection.
The physical connection still matters. The device may be using mobile data, home broadband, office Wi-Fi or a public hotspot. The VPN does not replace that connection. It creates a protected network layer on top of it.
Encapsulation and Encryption
Before traffic is sent to the VPN gateway, the original network packets are encrypted and placed inside new packets.
This is called encapsulation.
The original packet contains the destination the application wants to reach. The outer packet contains the information required to deliver the encrypted data to the VPN gateway.
Routers between the device and the gateway only need to process the outer packet. They can forward it across the internet without accessing the original request contained inside it.
From the perspective of the local Wi-Fi network or internet provider, the device is exchanging traffic with a VPN gateway. The individual requests carried inside the tunnel are protected.
The VPN connection is not invisible. The surrounding network can usually determine that a VPN session exists. It may also observe characteristics such as connection duration and the volume of data transferred.
What changes is the network’s ability to inspect and directly associate each protected request with its final destination.
Crossing the Internet
The encrypted packets now travel from the user’s device to the selected WrapVPN gateway.
Their route may pass through several independent networks. Each network forwards the packets towards the gateway based on the destination information in the outer packet.
The encrypted payload remains protected during this part of the journey.
This section — from the device to the gateway — is the VPN tunnel. It is not a separate physical connection. It is a logical and cryptographically protected path carried over the existing internet.
While the tunnel is active, many different types of traffic may pass through it:
- Website requests
- Application API calls
- Messaging traffic
- DNS requests, depending on the configuration
- Background application activity
- Software updates
The tunnel is established once and then reused. A new VPN connection is not created every time the user opens a page or sends a request.
Processing Traffic at the Gateway
When the encrypted packets reach the VPN gateway, the gateway verifies and decrypts them.
It then extracts the original network traffic and forwards it towards the requested destination.
This changes the visible source of the connection.
Without a VPN, a destination service normally receives traffic associated with the public IP address assigned by the user’s current network. With WrapVPN connected, the traffic is forwarded through the selected gateway, so the destination normally sees the gateway’s public IP address instead.
The gateway therefore sits between two different network paths:
- An encrypted session between the device and the gateway
- A connection between the gateway and the destination service
It receives traffic from one side and relays it to the other.
This forwarding process is what allows a user’s traffic to appear as though it is coming from the selected VPN location.
The gateway does not need to understand the application using the connection. It forwards network traffic whether it belongs to a browser, a mobile application or a background operating-system service.
VPN Encryption and HTTPS
A VPN and HTTPS protect different parts of the same journey.
The VPN protects the network path between the user’s device and the VPN gateway.
HTTPS protects communication between the user’s browser or application and the destination service.
When a user opens an HTTPS website through WrapVPN, the website’s encryption remains in place while the traffic travels through the VPN tunnel.
The result is a layered connection.
The original HTTPS traffic is protected by the website’s encryption. That traffic is then carried inside the encrypted VPN session until it reaches the gateway.
At the gateway, the VPN layer is removed so the traffic can be forwarded. The HTTPS layer remains intact and continues to protect the communication between the application and the website.
A VPN therefore does not replace HTTPS. The two technologies solve different problems and operate at different parts of the network path.
Returning Data to the Device
After the destination service receives and processes the request, it sends a response back to the VPN gateway.
The gateway associates that response with the correct VPN session, encrypts it and sends it back through the tunnel.
The device receives the encrypted packets and verifies that they belong to the established session. It then decrypts them, extracts the original response and passes it back through the virtual network interface.
The operating system delivers the response to the application that initiated the request.
From the browser’s perspective, it sent a request and received a response. It does not need to know that the traffic was encrypted, routed through a remote gateway and returned through a virtual interface.
This cycle continues while the VPN remains connected:
- Applications generate network traffic.
- The operating system directs it into the VPN interface.
- WrapVPN encrypts and sends it to the gateway.
- The gateway forwards it to the destination.
- Responses return to the gateway.
- The gateway sends them back through the encrypted tunnel.
- The device decrypts and delivers them to the correct application.
What Changes When the VPN Is Active?
A VPN changes both the route of the connection and what different parties can observe.
The local network sees an encrypted connection to the VPN gateway rather than a collection of direct connections from the device to different internet services.
The destination service sees a connection arriving from the gateway rather than directly from the public address assigned to the user’s current network.
The VPN gateway sits between these two views and relays traffic in both directions.
This provides meaningful network privacy, particularly on public or untrusted connections. It also allows the public source address of the traffic to correspond to the selected gateway location.
However, it does not make all user activity anonymous.
Websites and applications may still recognise users through account logins, cookies, device information or other identifiers. A VPN also does not protect a compromised device or replace secure passwords, software updates and safe browsing practices.
Its role is more precise: create a protected path to a trusted gateway and route internet traffic through that gateway.
One Connection, Several Systems
When WrapVPN displays Connected, several components have completed their part of the process.
The application has selected a gateway and established a secure session. The operating system has created a virtual route for network traffic. The VPN client is encrypting and encapsulating packets. The gateway is receiving, processing and forwarding them to the internet.
None of these parts is particularly useful on its own.
The connection works because they operate together as a single continuous path — from the application, through the device, across the encrypted tunnel, into the gateway and onwards to the destination.
The user sees one connection state. Behind it is a coordinated network system handling every request in both directions.
What Actually Happens When You Click “Connect” on a VPN was originally published in WrapVPN Engineering on Medium, where people are continuing the conversation by highlighting and responding to this story.