Figure 2. BorderManager VPN encrypts a packet, encrypts the key used to encrypt the packet, places the encrypted key in front of this packet, places a new IP header in front of the entire packet, and then sends this packet through the tunnel.