In This Article
The short answer: clicking Connect starts four steps, not one. The client and the server agree on a protocol, then derive a shared key without ever sending it, then switch to AES-256 for the actual traffic, then wrap every packet inside a second packet addressed to the VPN server. Encryption hides what you sent. Encapsulation hides where it was going. A weak link in any of the four quietly cancels the other three.
A Virtual Private Network routes your traffic through a remote server that acts as an intermediary. That description is true and it explains almost nothing, because it skips the handshake, the authentication, the cryptography and the delivery. What follows is what actually happens the moment you tap Connect, and why the result is worth having on a public Wi-Fi network.
The four stages of a VPN tunnel
| Stage | What happens | What it protects against |
|---|---|---|
| Handshake | The client and the VPN server agree on the parameters: the protocol, and the strongest cipher both sides support. | Connecting to a rogue server, and the exposure that comes with settling for a weak protocol. |
| Key exchange | The two sides establish a shared secret key using asymmetric cryptography. | A third party reading the traffic between the client and the VPN server. |
| Symmetric encryption | Data packets are encrypted with AES-256 and sent. | ISP surveillance, and interception attacks such as man in the middle. |
| Encapsulation | Each packet travels inside a wrapper addressed to the VPN server. | Anyone watching the traffic learning where it is actually going. |
The tunnel begins with a handshake
Every web server on the Internet has an identifier that lets clients reach it and make requests, and a VPN connection follows the same logic. The handshake starts when the client sends an authentication request and the server answers with the cipher suites it supports. Negotiation follows: the two sides settle on the best protocol and encryption model available to both.
The exchange is over in an instant, which is exactly why it gets so little attention. It is still the step everything else rests on. A weak protocol or a weak cipher agreed here leaves an opening a third party can use later, long after the connection looks established and healthy.
Identity is settled by the server’s public key, presented to the client inside a certificate issued by a trusted Certificate Authority such as DigiCert. Without that certificate, a client has agreed strong encryption with a server it cannot prove anything about.
The handshake, in order
- The client opens the connection and asks what the server supports.
- The server answers with its cipher suites and its certificate.
- The client verifies that certificate against a trusted authority.
- Both sides settle on the strongest protocol and cipher they share.
Key exchange creates a shared secret
The risk in sending anything across the Internet is that parties in the middle, an ISP or an attacker on the same network, can watch the traffic and read the packets if the session is not encrypted. So before the first packet moves, the client and the VPN server need a secret key that only the two of them hold.
Which brings back the original problem: how do you send a key without it being intercepted?
You do not send it. ApexGuard uses IKEv2, the second version of the Internet Key Exchange protocol, which relies on Diffie-Hellman. Each side generates a private value and exchanges the corresponding public one. The values are mathematically related, so both sides independently arrive at the same shared secret without that secret ever crossing the network, and IKEv2 uses it to derive the keys that protect everything after. Working backwards from the public values to the private ones is computationally infeasible, which is what makes the arrangement hold.
Perfect Forward Secrecy is the layer on top. A new shared key is generated for every connection, so a key that leaks opens exactly one session and nothing else, including nothing recorded earlier.
Two ideas doing the work
- Diffie-Hellman Both sides derive the same secret from public values. The secret itself is never transmitted.
- Perfect Forward Secrecy A fresh key per session, so one leaked key cannot reopen yesterday’s traffic.
Symmetric encryption protects the traffic
Encryption is expensive. Your device runs a mathematical algorithm to turn plaintext into ciphertext and the same work again in reverse, and the cost climbs with key size. RSA public-key encryption commonly uses keys up to 4096-bit.
| Asymmetric encryption | Symmetric encryption | |
|---|---|---|
| Keys | A public key and a private key | One shared key, both directions |
| Size in play here | Up to 4096-bit with RSA | 256-bit with AES |
| Cost per packet | Heavy enough to be felt | Light enough to run continuously |
| Job | Agreeing the shared secret at setup | Carrying everything sent afterwards |
That cost is acceptable for establishing a shared secret once. It is not acceptable for the traffic itself, where packets have to arrive quickly and the device has to keep encrypting and decrypting without falling behind. So once both sides hold the same secret, they switch to symmetric encryption, a single key used in both directions. ApexGuard uses AES-256, which is about as close to a default as modern computing has.
A 256-bit key allows so many combinations that brute-forcing it is beyond the reach of any computer that exists. The number is not a marketing flourish, it is the reason nobody attacks the cipher and everybody attacks the implementation around it.
Encapsulation builds the actual tunnel
Every packet carries its source and destination in the header. Hiding that is the second problem a VPN has to solve, and encapsulation is how it does it: anyone intercepting the packet learns neither where it came from nor where it is going.
So the VPN does not only encrypt. It puts each packet inside another packet, and the outer one carries routing information to the VPN server. This is the “tunneling” half of the name, and every major protocol supports it, IPsec, OpenVPN and WireGuard included.
At the far end the server unwraps the outer packet and forwards the real one to its destination. The response comes back the same way in reverse.
Put simply: encryption hides the message, encapsulation hides the address on the envelope.
What happens to a packet inside the tunnel
- An application creates an outgoing packet: an email client, a browser, anything.
- The packet is encrypted with the session key.
- The packet is encapsulated inside another packet.
- The client sends it across the Internet to the VPN server.
- The VPN server receives it and unwraps it.
- With the original packet revealed, the server forwards it to its destination.
- The response is encrypted and wrapped by the server, then routed back to the client.
What changes along the network path
With the VPN running, the same journey looks different to everybody watching it. The ISP, whose job is to carry your traffic to the VPN server, sees one server’s IP address and a stream of encrypted, encapsulated packets. Nothing about the sites behind them.
Because the VPN server makes the request for you, the websites you visit see its IP address instead of yours. Your real address is not withheld from them so much as never introduced.
That side effect is why VPNs became a streaming tool. Masking the IP address lets you appear to be somewhere else, which is enough for a service that gates content by region. ApexGuard runs servers in more than 125 countries and lets you move between them at will, which is also how it gets around local censorship.
What each party can see during a VPN connection
| Observer | What it can see | What it cannot see |
|---|---|---|
| Local Wi-Fi or network operator | Encrypted traffic to and from one server, plus timestamps and volume. | The contents of any of it. |
| Internet service provider | That you are connected to a VPN server, its public IP address, and how much data you moved. | The messages inside the packets, or which sites you are visiting. |
| Intermediate routers | The source address (you) and the destination address (the VPN server). | The packet contents, or the real destination. |
| VPN server | The inner packet, your IP address and the destination IP address. | Very little. Anything already protected by HTTPS, such as a password, stays closed to it. |
| Destination website or service | A request arriving from the VPN server. | Your real IP address or your real location. |
DNS requests need protection too
The Domain Name System is how devices find each other. Behind a readable name like google.com sits a string of numbers that is the site’s actual public address, and looking up the right one when you type a name is called DNS resolution.
Left unprotected, that lookup gives away the list of sites you are asking for, even when everything else is encrypted and tunneled. The traffic is unreadable and the index of it is not.
Where a DNS request ends up
- No VPN Your ISP’s resolver sees every domain you look up.
- Leaky VPN The traffic goes through the tunnel and the lookups quietly do not.
- Configured properly The VPN resolves names on its own servers, so the ISP’s resolver is never asked.
Resolution is normally handled by a DNS server the ISP nominates. A properly configured VPN routes those requests through its own resolvers instead, so your device never talks to the ISP’s.
Which moves the question rather than answering it, because the VPN can now log every request you make. This is where the provider has to be worth trusting. ApexGuard is built to Swiss privacy standards: a no-logs architecture, a privacy policy written to be read, and an independent audit behind both. The infrastructure is privately owned and runs on RAM-only servers, so there is little for a law enforcement request to collect.
Why stability depends on the protocol
Protocols are the backbone of the connection. One outdated protocol or one weak cipher is enough to cancel the security benefit of everything else in the chain.
| Protocol | Built for | Where that shows |
|---|---|---|
| WireGuard | Speed | A newer design that handles persistent connections with less overhead. |
| IKEv2/IPsec | Stability | Resumes a session after a Wi-Fi to mobile handover instead of rebuilding the tunnel. |
| OpenVPN | Reach | Open-source, and runs over TCP port 443, so firewalls read it as ordinary HTTPS. |
The three trusted names are IKEv2/IPsec, WireGuard and OpenVPN, and they are trusted for different reasons. WireGuard is the newer one, built around speed and the way it holds persistent connections. IKEv2/IPsec is the more reliable choice when network conditions change, because it can resume a session after a switch from Wi-Fi to mobile data without rebuilding the tunnel from scratch. OpenVPN has the advantage of an open codebase, and it slips past firewalls more easily because it can run over TCP port 443, the port HTTPS already uses.
ApexGuard runs a native IKEv2/IPsec implementation, which is the trade it has made: the least performance overhead and the steadiest connection when the network underneath keeps changing.
The practical takeaway
There are dozens of VPN services and all of them say they protect your privacy. Knowing how the thing works is what lets you read past “military-grade encryption” and “100% anonymity” to whatever is underneath.
A VPN is not one feature. It is a sequence of stages, each of which has to be implemented properly, and a weakness in any one of them compromises the chain. So the next time you go looking for a trusted VPN service, ask the questions that separate them: which protocols it uses, whether it protects against DNS and IP leaks, whether perfect forward secrecy is in play, whether the zero-logs claim is certified, and which jurisdiction the company answers to.
ApexGuard answers yes to all five. It also owns and controls its server infrastructure, which keeps your data out of reach of a government request and lets the performance be tuned for one stack rather than a rented one.
Five questions worth asking
- Which protocols does it support, and which one is the default?
- Does it protect against DNS and IP leaks?
- Is perfect forward secrecy in use?
- Has the no-logs claim been certified by somebody outside the company?
- Which jurisdiction does the provider answer to?
Where to check the claims yourself
What is checkable, and what is not
- Cipher A published standard. You can read the specification.
- Protocol Public guidance already says what a good one looks like.
- Leaks Testable from a browser in about a minute.
- No-logs Only ever as good as the audit behind it.
- Jurisdiction A legal fact, not a product feature.
Two of those five answers do not require taking anybody’s word. AES-256 is not a marketing phrase, it is a published federal standard: NIST’s FIPS 197 specification defines the cipher itself, which means a provider naming it is naming something you can go and read.
Protocol choice is just as checkable. The UK National Cyber Security Centre’s guidance on virtual private networks sets out what a properly configured tunnel should be negotiating, which turns a vendor’s protocol list into something you can hold against an independent baseline. The other three, leak protection, forward secrecy and jurisdiction, come down to the provider’s own documentation and whether anyone independent has been through it.
