Understanding VPN Tunnels
A tunnel is a virtual path or route between two end points through the internet. When you’re making a site-to-site or site to remote user VPN connection, then this is where you are creating a tunnel or a secure tunnel from one gateway to another. Data packets are transmitted securely within the tunnel connection through the internet, that are encapsulated inside Encapsulated Security Paylod (ESP) headers and trailers and inside a new IP header to ensure they are secure.
However do not take the word "tunnel" literally, it is just a metaphor. What actually happens between two gateway devices is that all traffic is encapsulated using security algorithms, and when travelling through the internet cloud, they would be secure. The individual packets have been manipulated with encryption and integrity algorithms and additional security headers have been added to them, to provide security when travelling across an in-secure network.
See VPN Tutorial Guide which further explains the concept of VPN technology.
Further Reading
Wikipedia's guide to VPN