My current mental model
- An application interacts with the operating system to produce an OSI model stack-based packet process - subsequent layers of encapsulation
- Somewhere along the line before the packet is encapsulated in an ethernet frame, but assuming after it has been given an IP header, the VPN software hijacks it and adds another encapsulation layer to it (AH header and encrypts payload) for VPN tunnel routing
- new packet with (probably) ESP and AH headers and an encrypted payload is passed to the network interface driver which gives it an ethernet frame and transmits on the wire
What I don't understand is actually how the VPN software hijacks the interprocess communication pipes like this - how it knows which applications to hijack, and how it can do this selectively without modifying all network communication from the host.