A VPN server is an ordinary computer in a data center that does one job: it accepts encrypted connections from your device, unwraps them, and sends the traffic on to the internet under its own address.
Everything a VPN does for you happens because that machine sits between you and the sites you open. Understanding it is the fastest way to understand what a VPN can and can't do, because almost every limit comes from the fact that some specific box, in some specific country, run by some specific company, is doing the forwarding.
you → your ISP → VPN server → the site └─ encrypted ──┘ └─ plain, from the server onward
How a VPN server works
Four things, in order, for every packet you send.
It terminates the tunnel. Your device and the server agreed on keys when you connected. The server uses them to decrypt what arrives, which means the traffic exists in readable form inside that machine for the moment it's being forwarded. There's no way around this: something has to put your request onto the public internet, and that something has to know where it's going.
It rewrites the source address. Your packet leaves the server carrying the server's address, not yours. This is why sites see a different country. It's also why many customers share one address: the server keeps a table of who asked for what so replies come back to the right person.
It resolves domain names, if your client is set up properly. When you open a site, something has to turn the name into an address. A correctly configured tunnel does that lookup on the server side, so your own network never sees the list of names. When it doesn't, you get a DNS leak: the tunnel carries your traffic while your provider still collects your browsing list. How to check that is in is my DNS leaking.
It sends the reply back through the same encrypted tunnel.
your real address sees it which sites you open sees it timing and volume sees it contents under HTTPS does not your passwords does not
Why VPN server location decides your speed
Every packet makes a detour through the server. That detour is physical distance, and distance is time.
direct you ────────► site tunnelled you ──► server ──► site └─ if the server is far and the site is near, you pay twice
A server in your own country adds a few milliseconds. A server on another continent can add a hundred or more, and that shows up as pages pausing before they load rather than as a lower speed number. The distinction matters because the two are fixed differently, and does a VPN slow down your internet walks through which is which.
same country || neighboring country |||| another continent ||||||||||
Shared vs dedicated VPN servers
Most servers carry many customers behind one address. That's usually what you want: your traffic is one stream among many, and nothing about it stands out. The cost is that one abusive customer can get the address blocked for everyone on it, which is why a service sometimes works everywhere except the one site you needed.
A dedicated address solves the blocking problem and creates a different one: that address is yours alone, so it identifies you as reliably as your home address would. Dedicated versus shared IP covers the trade in full.
shared blends into a crowd
a neighbor's abuse can block it
dedicated never blocked by others
but always, unmistakably youWho runs the server matters more than what it runs
The software isn't the interesting part. WireGuard, VLESS and the rest are public, documented and largely interchangeable from the user's side. What differs between services is who operates the machine, under which country's law, and what they write down.
That isn't a technicality. The server sees your real address and your list of destinations because it has to. Whether that gets stored, for how long, and who can compel its disclosure are decisions made by people, not by the protocol. What "no logs" actually means is about exactly this gap between what a machine can see and what a company chooses to keep.
no tunnel your ISP holds the list tunnel the server operator does
Running your own VPN server
You can rent a small machine and be your own operator. The appeal is obvious: nobody else holds the list. The costs are just as real. You become responsible for updates, for the firewall, for fixing it when it breaks at an inconvenient hour, and you get an address used by exactly one person, which is easier to notice, not harder. Your own server versus a service does the honest arithmetic.
If you're weighing it, describe your actual situation rather than reading a general comparison.
Help me decide whether to run my own VPN server.
Why I want a tunnel: (privacy on untrusted
networks / reaching a work network / getting
around filtering / all of it).
My experience: (I use Linux and SSH / I have read
about it / none).
How many devices: (how many).
Time I will spend maintaining it: (none / a couple
of hours a month / I would enjoy it).
Where I need the exit to be: (country).
Work out honestly what I gain and lose either way
with those answers.
Do not talk me into self-hosting if my answers say
I would not maintain it.Treat the answer as a starting point, not a verdict: the model can't know how much an outage on a Sunday would actually cost you.
How to tell which server you're on
[ ] the address check shows its country [ ] DNS resolves inside the tunnel [ ] latency roughly matches that distance [ ] switching servers changes the address
If the country is wrong, the client picked a different server than you think. If DNS still shows your own provider, the tunnel is carrying traffic but not names. Both are common and both are fixable.
What a VPN server can't do
It changes where your traffic appears to come from, and who can watch it on the way. It doesn't log you out of anything, doesn't clear your cookies, and doesn't change your browser's fingerprint. Sites that knew you before still know you, because they recognize the account and the browser rather than the address. That boundary is the same one described in what is a VPN, and it's worth keeping in mind before blaming a server for something no server handles.
