From what I've understood it's kind of like creating a LAN network through a tunnel in the internet that's protected so only certain people on the network can access it. That's a very flimy and loose definition but that's how I've always understood it.