How does a VPN extend a perimeter over a shared public network?

Question

Accepted Answer

Two VPN routers build an encrypted channel (a tunnel) through the shared network. For the participants at both ends the two private networks look directly routed, and the public area is locked out.

* Two VPN routers carry the private traffic encrypted across the internet, so both subnets act as one network. *
The VPN is a virtual network overlay: a logical network laid on top of a physical one. The most widespread kind is the VPN on Layer 3. Without it, two subnets that share the internet as their medium are just two networks on the internet. With it, packets between them are encrypted and wrapped at one VPN router, carried across the internet, and unwrapped at the other. The result is one extended perimeter with two private parts and an encrypted link between them, and outsiders on the shared medium can neither read nor join that link.
Go deeper:

Virtual private network — Wikipedia — tunnelling, encryption and the main VPN types.
 Overlay network — Wikipedia — logical networks laid over a physical one.
 NIST SP 800-77 Rev. 1 — Guide to IPsec VPNs — how site-to-site and remote-access IPsec VPNs are designed.