Hotel Wi-Fi blocking your VPN? Here's why, and what works

You check in, join the hotel Wi-Fi, turn on your VPN, and it just spins on "Connecting". It's frustrating, but it's rarely a mystery. Hotel, airport and campus networks block VPNs in a handful of predictable ways, and each one has a fix.

Three causes, three symptoms

A fourth case looks similar but isn't a block: the connection works, just painfully slowly, because the hotspot is shared by a hundred rooms. No VPN setting fixes that; mobile data might.

Step 1: the login page

Most hotel and airport networks hold all traffic until you accept their terms or type a room number on a login page, called a captive portal. Networks can announce it to your phone (a standard, RFC 8910, describes how), and Android notices and shows a "Sign in to network" notification.

Until you sign in, no VPN can get through, because nothing can. So:

1. Tap the notification, or tap the network's name in Wi-Fi settings.
2. Accept the terms or enter the code.
3. Go back to the VPN and connect.

If you use Android's Always-on VPN with Block connections without VPN, the login page may not open at all. Turn Always-on off for a moment, sign in, then turn it back on. Our help article on Wi-Fi login pages has the details.

Many hotels sign you out every day, or after a few hours, even mid-session. PryVPN notices when the network starts showing its login page again and asks you to sign in, instead of hopping between servers that can't be reached.

Step 2: when the network blocks UDP

Modern VPNs, WireGuard included, send their traffic over UDP. It's fast and it's what the protocol was designed for. But many hotel, office and school firewalls only let through web traffic (TCP ports 80 and 443) and DNS, and drop everything else. Some go further and recognize VPN protocols by their shape: a WireGuard connection always starts with a handshake message of the same size and layout, which is easy for a filter to spot.

Networks do this for mundane reasons: to keep bandwidth for web browsing, to sell a "premium" connection, because a security policy says so, or simply because the firewall came configured that way.

The fix is to carry the VPN over the one thing these networks never block: encrypted web traffic on TCP port 443.

How stealth mode works

PryVPN's stealth mode puts the WireGuard tunnel inside a real TLS 1.3 connection on TCP port 443, the same protocol and port every HTTPS site uses. To most filters it looks like one more secure website.

• It's real TLS, and it's checked. The app pins our server's certificate, so a network that tries to intercept the connection can't slip in unnoticed. If a network inspects encrypted traffic by replacing certificates, as some company networks and antivirus apps do, PryVPN refuses to connect and tells you, rather than sending anything through it.
• Auto mode does it for you. PryVPN tries UDP first. If the server doesn't answer within about 7 seconds, it switches to stealth and remembers that for this network for a few hours. When a handshake times out, you can also tap Retry over TCP 443 (Stealth).
• It has costs. Stealth is slower than UDP, because it runs the tunnel over TCP. It needs Android 10 or later. And while it's on, the PryVPN app itself stays outside the tunnel so that its TLS connection can reach our server; all your other apps stay protected.
• It isn't invisible. Stealth gets through most networks that block VPNs, but a network with advanced inspection can still detect or block it. We'd rather tell you than promise more.

You can choose it by hand in Settings › Protocol. The protocol help article explains each option.

Step 3: filtered or rewritten DNS

Some hotspots answer your lookups themselves: they send you to their own pages, insert ads, or block categories of sites. Inside PryVPN, lookups travel through the tunnel to our own resolver, so the hotel's DNS never sees them and can't change the answers.

If nothing works

A few networks allow only a short list of services, or inspect every connection in depth. No setting beats that. Your options are then:

• Try another location. Some filters block particular server addresses.
• Use mobile data, or share it from another phone. Mind roaming costs abroad.
• Ask the front desk. Some hotels have a less restricted network for business guests.

Is it allowed?

Using a VPN on hotel Wi-Fi is normal, and the hotel's terms rarely forbid it. VPN use is legal in most countries, but a few restrict or ban it, so check the rules of the country you're visiting before you go; our travel help article covers the basics.

Work and university networks are different: they're governed by rules you agreed to. If the network blocks something you need for legitimate work or study, ask the IT service first. And on a phone your employer or school manages, don't try to work around its settings.

How PryVPN handles all of this

• It detects the Wi-Fi login page and asks you to sign in, instead of failing silently.
• In Auto mode, it moves from UDP to stealth on TCP 443 when UDP is blocked, and remembers it per network.
• It prepares a backup server, in another city when possible, and switches to it in seconds if your server stops responding.
• With Android's Always-on VPN and Block connections without VPN on, Android blocks your apps' traffic whenever the tunnel is down, instead of sending it over the hotel network. The Kill Switch article lists the few exceptions Android itself has.

None of this guarantees a connection on every network in the world. It does mean that on the typical hotel, airport or campus Wi-Fi, you get connected without having to become a network engineer first. For more on sites that are blocked rather than VPNs, see unblocking websites.

Stuck right now? Our free VPN blocked on Wi-Fi troubleshooter asks where you are and what you see, then gives you the steps for your case.

Spotted a mistake? Write to support@pryvpn.com and we'll fix it and update the date.