Definition
A VPN tunnel is the encrypted channel established between client and server through which all protected traffic flows. The 'tunnel' metaphor is precise: data enters one end, travels through the public internet inside an opaque encrypted wrapper, and exits at the other end. Anything outside the tunnel is exposed normally; anything inside is hidden from observers along the way. The tunnel persists until either side disconnects, at which point ephemeral keys are discarded and any new connection starts a fresh tunnel.
What the Tunnel Carries
Most consumer VPNs carry IP packets in the tunnel: every packet your device wants to send goes in, gets encrypted and forwarded by the server, and the response comes back the same way. Some configurations only tunnel specific traffic (split tunneling). Site-to-site VPNs tunnel between routers, with all the traffic of the networks behind them flowing through. The unifying property is encapsulation: original packets wrapped in encrypted packets.
Tunnel Failure Modes
Tunnels can fail in obvious ways (server unreachable, authentication rejected) or in subtle ways (intermittent packet loss, MTU mismatches, slow handshake reconnects). Each failure mode is a window of potential leak: if the kill switch is not active, traffic that was supposed to use the tunnel may flow over the open ISP connection during the gap. Robust clients monitor tunnel health continuously and either reconnect automatically or block all traffic until reconnection succeeds.