How does a VPN extend a perimeter over a shared public network?

Two VPN routers build an encrypted channel (a tunnel) through the shared network. For the participants at both ends the two private networks look directly routed, and the public area is locked out.

The VPN is a virtual network overlay: a logical network laid on top of a physical one. The most widespread kind is the VPN on Layer 3. Without it, two subnets that share the internet as their medium are just two networks on the internet. With it, packets between them are encrypted and wrapped at one VPN router, carried across the internet, and unwrapped at the other. The result is one extended perimeter with two private parts and an encrypted link between them, and outsiders on the shared medium can neither read nor join that link.