There is a good description HERE that can help but in simple terms its easy to think of a tunnel that is set up between two computers, yours and the internet gateway. Anything that travels through the tunnel is encrypted and can’t be seen.