A VPN tunnel is the encrypted path your data takes between your device and a VPN server. See how encryption, protocols, and VPN Super's setup fit together.
A VPN tunnel is the encrypted connection your device builds with a VPN server the moment you connect. Every request you send after that (a page load, an app sync, a video stream) travels through it before reaching the open internet. The rest of this article covers what's actually happening inside that tunnel, which protocols build it, and how VPN Super handles the details so you don't have to.
Key facts
A VPN tunnel isn't a physical thing. There's no separate lane carved into the internet. It's a name for what happens when your device and a server agree on an encryption method, then wrap every packet you send in that encryption before it leaves your device. Anyone watching the connection from outside, whether that's your ISP, the Wi-Fi network at a coffee shop, or someone on the same router, sees scrambled data going to one IP address. They can't read what's inside it.
Here's what happens, in order, when you tap Connect:
This repeats for every packet, for as long as you're connected. A useful way to picture it: it's less like a fixed pipe running underground and more like an armored car that gets a brand-new, sealed route assigned every time it makes a trip. The route isn't reused, and nobody outside the car can see what's inside it.
Here's what that protects. On hotel or airport Wi-Fi, anyone else on the network with the right tools can potentially watch unencrypted traffic, a technique called packet sniffing. Log into your email or bank on that network without a VPN, and someone nearby could capture your login details. With the tunnel active, they see encrypted noise instead. The same mechanism protects you whether you're checking email at a gate or settling in with VPN Super's streaming VPN in a hotel room. The tunnel is what's doing the protecting, wherever you're connecting from.
The "protocol" is the specific method your device and the server use to encrypt and manage the tunnel. Different protocols trade off speed, battery use, and how well they hold up on restrictive networks. This is also the part where a lot of VPN explainers get vague, or worse, imply their app uses one universal protocol everywhere. VPN Super doesn't work that way. The protocol available to you depends on which device you're using.
| Platform | Protocols available | How it's chosen |
|---|---|---|
| iOS | Auto, Super (VPN Super's own protocol), IKEv2, OpenVPN, V2Ray | Auto mode picks for you; you can also select manually |
| Android | Auto, Super, IKEv2, OpenVPN, V2Ray | Auto mode picks for you; you can also select manually |
| Windows | Auto, OpenVPN, WireGuard | Auto mode chooses between OpenVPN and WireGuard |
| Mac | WireGuard | Fixed, no protocol picker |
| Apple TV | IKEv2 | Fixed, no protocol picker |
| Android TV | OpenVPN, IKEv2 | Manual selection |
A quick read on each protocol:
So does VPN Super use WireGuard? On Windows and Mac, yes. On iOS and Android, no: those two run on Auto, Super, IKEv2, OpenVPN, or V2Ray instead. Neither answer is more correct than the other. The right protocol depends on what you're running the app on, and VPN Super's Auto mode, where it's available, handles that decision for you.
Recommended setup
No, and the names cause confusion. A VPN tunnel is the encrypted connection itself. Split tunneling is a setting that decides which apps use that tunnel and which don't. For example, routing your browser through the VPN while your local printer app talks directly to your home network.
On VPN Super, Split Tunneling is available on Android and Android TV, where you can choose which apps go through the tunnel and which bypass it. iOS and Apple TV only support DNS-based split tunneling, a narrower version limited by how Apple lets VPN apps work on those platforms. That's not the full app-by-app control the Android side has. Windows and Mac don't offer split tunneling right now.
If your connection drops mid-session, whether the Wi-Fi cuts out, you walk out of range, or the network changes, the tunnel closes. For a moment, your device may fall back to sending traffic outside the tunnel, unencrypted, before it reconnects. That's the exact gap a Kill Switch closes: it blocks all internet traffic the instant the tunnel drops, until the VPN reconnects, so nothing leaks out in between.
On VPN Super, Kill Switch is available on iOS and Android, off by default. You turn it on in settings if you want that extra layer. It's not yet available on Windows, Mac, Apple TV, or Android TV. What is a VPN kill switch covers exactly how it behaves on each platform and how to turn it on.
The tunnel itself, the encryption between your device and the server, is not something an attacker on your network can just read. What actually causes leaks in practice is usually one of two things: the tunnel drops and traffic briefly goes around it (which a Kill Switch prevents), or a DNS request slips outside the tunnel and reveals which sites you're visiting even though your traffic itself stayed encrypted.
DNS and IPv6 leak protection close that second gap. On VPN Super, that's confirmed live on Windows and Mac. VPN Super hasn't confirmed DNS and IPv6 leak protection status on iOS and Android yet, so this article isn't claiming it there. Check the app's current feature list on your device if that matters for your use case. And to be clear about the third kind of leak: WebRTC leak protection isn't available on any VPN Super platform today.
You don't build one by hand. If you've seen instructions for setting up a VPN manually, entering a server address and protocol into your phone or computer's built-in VPN settings, that's not how VPN Super works on any platform. Open the app, tap Connect, and the app builds the tunnel and picks the protocol for you (or lets you choose one, where that's available). That's the whole setup.
Yes. A proxy reroutes your traffic through another server, which changes the IP address that websites see, but it typically doesn't encrypt the traffic along the way. A VPN tunnel does both: it reroutes your traffic and encrypts it end to end. If your ISP or someone on your network is the concern, a proxy alone doesn't close that gap. The encryption is what does.
This also clears up a common mix-up. "VPN tunnel" describes what any VPN does, not a specific app. If you're looking for a particular tool with "tunnel" in the name, that's a different product entirely, so double-check you're looking at the right thing before you compare features.
Overselling a security tool is how people end up making risky assumptions, so here are the limits:
Worth knowing before you pick a plan
VPN Super's app has 250K+ ratings on the iOS App Store and 500K+ ratings on Google Play. That's independent of anything VPN Super says about itself, and it's a signal of how the tunnel and the app actually perform day to day for the people using them.
Server footprint, if you're weighing free vs. Premium: on iOS, the free tier reaches 20 countries and 42 locations, and Premium extends that to 64 countries and 104 locations. On Android, free reaches 15 countries and 26 locations, Premium reaches 58 countries and 78 locations. Windows and Mac are Premium-only, at 64 countries and 104 locations.
Once you're connected, confirm the tunnel is doing its job rather than assuming it. Search "what is my IP" before and after connecting; the address should change. A dedicated DNS leak test site will show whether your DNS requests are routed through the tunnel or leaking to your ISP's servers. If every server listed traces back to your VPN provider rather than your ISP, the tunnel is handling DNS correctly. If you ever see your real IP or your ISP's DNS servers listed while connected, reconnect. If it keeps happening, switch protocols. Some networks interfere more with one protocol than another.
It encrypts and reroutes the connection between your device and a VPN server, so your traffic is unreadable to anyone else on the network and appears to come from the server's IP address instead of yours.
Your device and the server agree on an encryption method, then every packet you send gets wrapped in that encryption before it leaves your device. The server decrypts it, forwards your request, and encrypts the response on the way back. See "How does a VPN tunnel work, step by step?" above for the full walkthrough.
On VPN Super, you don't configure one manually on any platform. Open the app and tap Connect, and the app builds the tunnel and handles the protocol.
No. The tunnel is the encrypted connection itself; split tunneling decides which apps use it. On VPN Super, Split Tunneling is available on Android (app-based). iOS only supports a narrower DNS-based version due to an Apple platform limit.
The encryption itself isn't something an outside attacker can just read. Leaks in practice usually come from a dropped connection (a Kill Switch prevents this) or an unprotected DNS request. The "What happens if my VPN tunnel drops?" section above covers how VPN Super handles drops on each platform.
On Windows and Mac, yes. On iOS and Android, VPN Super uses Auto, Super, IKEv2, OpenVPN, or V2Ray instead, with no WireGuard on those two. Apple TV uses IKEv2, and Android TV uses OpenVPN and IKEv2. Which protocol you get depends on your device, not a single company-wide default.
Yes. A proxy changes the IP address websites see but usually doesn't encrypt your traffic. A VPN tunnel does both: it reroutes your connection and encrypts it, which is what actually protects you on an untrusted network.
