What Is a VPN Server and How Does It Work?

A VPN server is an ordinary computer in a datacentre that does one job: it accepts encrypted connections from your device, unwraps them, and sends the traffic on to the internet under its own address.

Everything a VPN does for you happens because that machine sits between you and the sites you open. Understanding it is the fastest way to understand what a VPN can and cannot do, because almost every limit comes from the fact that some specific box, in some specific country, run by some specific company, is doing the forwarding.

  WHERE THE SERVER SITS

  you → your ISP → VPN server → the site
    └─ encrypted ──┘
                   └─ plain, from the
                      server onward

What the server actually does

Four things, in order, for every packet you send.

It terminates the tunnel. Your device and the server agreed on keys when you connected. The server uses them to decrypt what arrives, which means the traffic exists in readable form inside that machine for the moment it is being forwarded. There is no way around this: something has to put your request onto the public internet, and that something has to know where it is going.

It rewrites the source address. Your packet leaves the server carrying the server's address, not yours. This is why sites see a different country. It is also why many customers share one address: the server keeps a table of who asked for what so replies come back to the right person.

It resolves domain names, if your client is set up properly. When you open a site, something has to turn the name into an address. A correctly configured tunnel does that lookup on the server side, so your own network never sees the list of names. When it does not, you get a DNS leak: the tunnel carries your traffic while your provider still collects your browsing list. How to check that is in is my DNS leaking.

It sends the reply back through the same encrypted tunnel.

  WHAT THE SERVER NECESSARILY SEES

  your real address        sees it
  which sites you open     sees it
  timing and volume        sees it
  contents under HTTPS     does not
  your passwords           does not

Why its location decides your speed

Every packet makes a detour through the server. That detour is physical distance, and distance is time.

  THE DETOUR YOU PAY FOR

  direct     you ────────► site
  tunnelled  you ──► server ──► site
     └─ if the server is far and the
        site is near, you pay twice

A server in your own country adds a few milliseconds. A server on another continent can add a hundred or more, and that shows up as pages pausing before they load rather than as a lower speed number. The distinction matters because the two are fixed differently, and does a VPN slow down your internet walks through which is which.

  WHAT THE DISTANCE COSTS

  server in your country   ||
  neighbouring country     ||||
  another continent        ||||||||||

  bars are latency, not bandwidth

Shared servers and dedicated ones

Most servers carry many customers behind one address. That is usually what you want: your traffic is one stream among many, and nothing about it stands out. The cost is that one abusive customer can get the address blocked for everyone on it, which is why a service sometimes works everywhere except the one site you needed.

A dedicated address solves the blocking problem and creates a different one: that address is yours alone, so it identifies you as reliably as your home address would. Dedicated versus shared IP covers the trade in full.

  SHARED OR DEDICATED

  shared     you blend into a crowd
             the crowd can get you blocked
  dedicated  never blocked by others
             trivially yours alone

Who runs the server matters more than what it runs

The software is not the interesting part. WireGuard, VLESS and the rest are public, documented and largely interchangeable from the user's side. What differs between services is who operates the machine, under which country's law, and what they write down.

That is not a technicality. The server sees your real address and your list of destinations because it has to. Whether that gets stored, for how long, and who can compel its disclosure are decisions made by people, not by the protocol. What "no logs" actually means is about exactly this gap between what a machine can see and what a company chooses to keep.

  THE TRUST SIMPLY MOVES

  no tunnel   your ISP holds the list
  tunnel      the server operator does

  the question is not whether someone
  can see it, but whom you would rather
  have seeing it

Running your own

You can rent a small machine and be your own operator. The appeal is obvious: nobody else holds the list. The costs are just as real. You become responsible for updates, for the firewall, for fixing it when it breaks at an inconvenient hour, and you get an address used by exactly one person, which is easier to notice, not harder. Your own server versus a service does the honest arithmetic.

If you are weighing it, describe your actual situation rather than reading a general comparison.

Help me decide whether to run my own VPN server.

Why I want a tunnel: (privacy on untrusted
networks / reaching a work network / getting
around filtering / all of it).
My experience: (I use Linux and SSH / I have read
about it / none).
How many devices: (how many).
Time I will spend maintaining it: (none / a couple
of hours a month / I would enjoy it).
Where I need the exit to be: (country).

Work out honestly what I gain and lose either way
with those answers.
Do not talk me into self-hosting if my answers say
I would not maintain it.

Treat the answer as a starting point, not a verdict: the model cannot know how much an outage on a Sunday would actually cost you.

How to tell which server you are on

  CHECKING THE SERVER YOU GOT

  [ ] the address check shows its country
  [ ] DNS resolves inside the tunnel
  [ ] latency matches roughly that distance
  [ ] switching servers changes the address

If the country is wrong, the client picked a different server than you think. If DNS still shows your own provider, the tunnel is carrying traffic but not names. Both are common and both are fixable.

What a server cannot do

It changes where your traffic appears to come from, and who can watch it on the way. It does not log you out of anything, does not clear your cookies, and does not change your browser's fingerprint. Sites that knew you before still know you, because they recognise the account and the browser rather than the address. That boundary is the same one described in what is a VPN, and it is worth keeping in mind before blaming a server for something no server handles.