A VPN (virtual private network) builds an encrypted tunnel between your device and a VPN server. Your packets are wrapped inside encrypted packets addressed to that server; it unwraps them and sends them on as if they came from there. To the network you're on, it all looks like one stream of scrambled traffic to one address.
Companies use VPNs so staff working from home can reach inside systems, like file servers and internal sites, as if they were in the office. Site-to-site VPNs join two offices' networks over the internet, so they behave like one network.
Consumer VPNs are about who can see your traffic. The café Wi-Fi and your internet provider see only that you're connected to the VPN, not which sites you visit. But the VPN provider can now see everything they used to see, so you're moving your trust, not removing the need for it. Sites still know who you are if you log in, and HTTPS already hides the contents of your pages either way.
Common VPN protocols are WireGuard (small, modern and fast), IPsec (built into many routers and operating systems) and OpenVPN. They all do the same two things as TLS: check who the other end is, and encrypt everything in between.
A tunnel is the general idea of carrying one protocol inside another. VPNs are one example; SSH can tunnel traffic too, and IPv6 is sometimes carried over IPv4 networks in a tunnel.
You use a VPN on café Wi-Fi. What can the café's network see?
| VPN | Encrypted tunnel to a VPN server. |
|---|---|
| Remote access | One device into a company network. |
| Site-to-site | Two whole networks joined. |
| Who sees what | Your network sees the tunnel; the VPN sees your traffic. |
| WireGuard, IPsec, OpenVPN | Common VPN protocols. |
| Tunnel | One protocol carried inside another. |