VPNs and tunneling

In a nutshell A VPN wraps your network traffic in an encrypted tunnel to a server, so anyone in between sees only noise going to that server — not what you're actually doing. It's used for privacy, for reaching private networks remotely, and (in pentesting) for connecting your machine into a target's lab network.

The core idea — a tunnel inside the internet

Normally your packets travel with their real destination visible to every hop between (your ISP, café Wi-Fi). A VPN builds an encrypted tunnel to a VPN server: your real traffic is sealed inside, and to observers it looks like one encrypted stream to that one server. The server unwraps it and forwards it on.

To anyone in between, it's one opaque stream to the server — not your real destinations.

Analogy — an armoured courier. Instead of mailing readable postcards, you hand everything to an armoured van that drives to a trusted depot; only the depot opens the bag and sends things onward. Onlookers see the van, not the contents or the final addresses.

What it actually gives — and doesn't

Gives

confidentiality on the local link (café Wi-Fi sees only noise)
a new apparent IP / country
reach into a private network remotely

Does NOT give

anonymity from the VPN provider (they see the unwrapped traffic)
protection from malware already on your device
a magic cloak — it's one control, not all of them

The lab use is the third bullet: a pentest platform (TryHackMe) puts your Kali "inside" the target network via a tunnel, so you can reach 10.10.x.x machines as if physically on that LAN.

WireGuard and the modern kind

Older VPNs (OpenVPN, IPsec) work but are heavy. WireGuard is the modern favourite: tiny, fast, strong modern crypto, a keypair per peer. Its one tell is that its traffic is recognizable as WireGuard — which matters where VPNs are actively blocked. AmneziaWG is an obfuscated fork that disguises the traffic so DPI can't fingerprint it — the exact approach used in the VANTAGE work.

Full tunnel vs split tunnel

Full tunnel

ALL traffic goes through the VPN
maximum privacy
one choke point

Split tunnel

only some traffic (e.g. the lab range) is routed in
faster, lighter
easy to misjudge ("VPN is on but this site went direct")

The security angle A VPN server is a door into a private network — so it's a trust boundary and an attack surface, not a magic cloak. It must be hardened like any exposed service: strong keys, a whitelist of what the client may reach, monitoring. That "the tunnel is itself a target" mindset is what turned VANTAGE from a convenience into a security product.