A tunnel carries packets of one logical network inside packets of another network. The inner packet becomes payload of an outer encapsulation used to cross the underlying path.

Suppose two private networks are separated by the public Internet. A tunnel endpoint can encapsulate a private IP packet inside an outer packet addressed to the remote tunnel endpoint. The remote endpoint removes the outer header and forwards the original packet.

This creates an overlay network whose logical topology differs from the physical underlay. Virtual private networks, data-center overlays and many mobility mechanisms use this principle.

Encapsulation adds header overhead, which reduces the effective MTU available to the inner packet and can interact with Path MTU Discovery.

The important abstraction is composition: one network service can itself be transported across another network, creating virtual links and topologies without changing the underlying routers.