Definition
Tunneling is the practice of encapsulating one network protocol inside another. In the VPN context, your normal IP packets are wrapped inside a second layer of IP packets that are encrypted and addressed to the VPN server. The original packet — including its true destination — is hidden inside the outer packet, which is what crosses the public internet. The VPN server unwraps the outer layer, exposes the inner packet, and forwards it to its real destination.
Why the Metaphor Fits
The 'tunnel' image conveys two ideas. The traffic enters at one end and exits at the other, with no exposure in between — the packet contents are hidden from anything along the way. And the tunnel has explicit endpoints: it does not extend beyond the VPN server, so anything past that point flows on the open internet. Both properties matter for understanding what a VPN does and does not protect.
Tunneling Protocols
Many tunneling protocols exist, with different design choices. PPTP (obsolete) tunnels PPP frames over GRE. L2TP tunnels Layer 2 frames and is paired with IPSec for encryption. IPSec ESP in tunnel mode is itself a tunneling protocol. OpenVPN runs its own tunnel over UDP or TCP. WireGuard tunnels IP directly over UDP with its built-in encryption. Each represents a different trade-off between simplicity, security, and compatibility.