← Back to the library
Networks

What does a VPN protect—and where does it stop?

A protected connection has an endpoint.

Prepared November 7, 2026 · Educational explainer · Illustrative example

Dash-Squared editorial · Last reviewed November 7, 2026

A protected connection has an endpoint.
Illustrative model / Networks
Look inside the idea

The tunnel has an endpoint.

VPN / one protected leg does not describe the whole journey.

The tunnel has an endpoint.VPN / one protected leg does not describe the whole journey. Ask what enters the tunnel, where it ends and what protects the next leg.DASH-SQUARED / THE VISUAL FIELD GUIDEThe tunnel has an endpoint.VPN / one protected leg does not describe the whole journey.Work deviceVPN gatewayPrivate appVPN ENCRYPTED LEGTunnel endsat the gateway.Inside the tunnelWhich routes enter it? Full-tunnel andsplit-tunnel configurations differ.After the endpointApp permissions still apply. HTTPS/TLSmay protect the next connection.Ask what enters the tunnel, where it ends and what protects the next leg.Illustrative model · Read the explanation, limits and sources alongside it.
An encrypted VPN connection covers the leg from the work device to the VPN gateway. A visible endpoint boundary separates it from the onward application connection, which can have independent TLS and access checks. Open full graphic ↗

Follow the idea

  1. The device establishes a VPN connection to the gateway.
  2. Only traffic routed into that tunnel uses this protected leg.
  3. The VPN leg ends at the gateway; the next connection needs its own protections.

Keep the limit visible

Illustrative remote-access VPN. A VPN does not repair a compromised endpoint or automatically make a user anonymous.

Where does this VPN’s encrypted leg end?

At the VPN gateway shown here. HTTPS/TLS and the application’s permission checks are separate protections.

A common assumption

“Connected to a VPN means every part of the journey is protected.”

Identify the endpoint, which routes enter the tunnel and the controls on the next leg.

Source for this graphic: www.cloudflare.com ↗ · Checked November 7, 2026 · Illustrative example.

In this explanation01Start with the tunnel02Follow one request03Keep the boundary visible04The next smart question

Start with the tunnel

A virtual private network creates an encrypted connection between endpoints. A common enterprise example connects a remote device to a company access point so work traffic can travel through that tunnel.

Follow one request

Illustrative example: a remote worker connects to a company VPN gateway before opening a private application. The tunnel and the application’s own permission checks solve different problems.

Keep the boundary visible

A VPN does not make every activity anonymous or make a compromised device safe. What happens beyond its endpoint, which traffic enters the tunnel and who operates it all matter.

The next smart question

Where does the tunnel end, and what happens to the traffic after that?

Source notes · checked November 7, 2026www.cloudflare.com · original source ↗

Independent explanation. No sponsorship or endorsement implied. Product features and policies can change; check the exact product and configuration.

Published .