I have been using these protocols without deep understand how everything works under the hood.

I understand a process of tunneling as follows

  1. When we are using protocols like OpenVPN, IPSec, SSH they operate on the same level of OSI stack or above where the IP protocol is located (3-d level)
  2. When using the mentioned above protocols all traffic (like TCP, IP) is encrypted inside data part of the underlaying protocol like IP.
  3. When traffic reaches a VPN server it is decrypted and redirected according the embodied data.

I can't understand the following case.

In order to even connect to a VPN server we are using at least the IP protocol to reach the server. Because all traffic on the Internet is being routed by IP addresses. Therefore in that case how can we operate on a level that is lower than the IP protocol. How do we reach a VPN server? We cannot reach a server by MAC address only as far as I know.

Could you explain this ?

Thank you so much !

  • Models, like OSI, are just models. What you should take away from the models are the concepts of layering, abstraction, and encapsulation, not the exact model because the real world doesn't fit the ideal of the model.
    – Ron Maupin
    May 30, 2018 at 13:34

1 Answer 1


In real life, you can't stick to the OSI model entirely. It's helpful and necessary as a guide on how to structure the components in a complex network but you can't always say that's layer x.

Tunneling is wrapping packets or frames from one layer and using another transport mechanism to transport them where you need them. At the tunnel end you unwrap the original packet and continue forwarding it natively. From the 'inside' view, the whole tunnel is just a single link. From the 'outside' view, the tunnel connection is just a connection - whatever it's used for doesn't matter.

Tunneling is especially useful when routing IP packets in between networks that use private IP addresses across the Internet. You can't use the private addresses on the Internet, can't change them (NAT) when the far end needs them, so you (simplified) wrap the private IP packet in a public IP packet, route it across the Internet and unwrap the original packet.

So, when looking at a tunneling protocol it's much more helpful to check what it runs on top of and what kind of interface it presents on its own top. E.g. PPTP runs on top of IP and presents a layer 2 PPP interface on top that you in turn use with another layer 3 protocol (IPv4, IPv6, or IPX) on top.

Other protocols like OpenVPN present an Ethernet-like layer 2 on their top, so you use a virtual NIC as logical interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.