Networks block sites in three main ways: they refuse to look up the site's name (DNS), they read the name at the start of the secure connection (SNI), or they drop traffic to the site's address (IP). A VPN carries all three inside one encrypted tunnel, so the network only sees a connection to the VPN server. When a network blocks VPNs too, PryVPN's Stealth mode travels like ordinary HTTPS on port 443.
A news site opens at home but not on the office Wi-Fi. A messaging app works on mobile data and stalls on the airport network. A page that loaded yesterday now shows "This site can't be reached". In 2026 most of these cases have the same explanation: the network in the middle decided not to carry that traffic.
Blocking sounds technical, but it only works in a few ways. Once you know which one you're facing, you know what gets through it.
First: is it blocked, or is it down?
Before blaming the network, rule out the site itself. Our free Is it down? tool checks the address from our server and from your connection at the same time:
- Down from both: the site has a problem. Nothing on your side will open it; wait a little.
- Up from our server, failing from yours: something between you and the site is in the way. That's a block, a filter or a Wi-Fi login page.
A quicker test on a phone: switch from Wi-Fi to mobile data, or the other way round. If the site opens on one and not the other, the network you were on is the one blocking it.
Who blocks sites, and why
Blocking is everywhere, and most of it is routine:
- Schools, universities and workplaces filter categories such as games, social networks or video to save bandwidth or enforce their own rules. Our article on why campus and work Wi-Fi blocks VPNs covers that case.
- Hotels, cafés and airports often buy a router with a "safe browsing" filter switched on, and it catches more than it should.
- Mobile operators and internet providers apply parental filters, block sites a court has ordered them to block, and in some countries follow government blocklists.
- Live sport has become a common reason. Some broadcasters obtain court orders that block server addresses during matches. Because many unrelated websites share the same addresses on large hosting networks, those blocks have also knocked ordinary, legal sites offline for hours.
That last point is the real problem with blocking in 2026: it's blunt. The method chosen decides how much innocent traffic gets caught.
Method 1: DNS blocking
Every time you open a site, your phone first asks a DNS server for the site's address. By default that's the DNS server of the network you're on, and the question travels unencrypted.
A network that wants to block a site simply answers wrongly: "no such site", or the address of its own warning page.
What you see: "This site can't be reached", DNS_PROBE_FINISHED_NXDOMAIN, or a page from your operator or school saying the site is blocked.
DNS blocking is the cheapest method, so it's the most common one. Encrypted DNS (DNS over HTTPS or over TLS, Android's Private DNS) hides those questions from the network, which gets you past many DNS blocks. It doesn't help with the next two methods.
Method 2: SNI filtering
When your browser starts a secure HTTPS connection, the first message it sends includes the name of the site, in plain text. That field is called SNI (Server Name Indication). It exists so one server can host many sites, and it means the network can read which site you're opening even when the rest is encrypted.
A filter that reads SNI lets the connection start, sees the name and cuts it.
What you see: the page starts loading and fails with "connection reset" or a timeout, while other HTTPS sites work fine.
A newer standard, Encrypted Client Hello (ECH), hides that name too. Browsers and large hosting networks are adopting it, but in 2026 many sites and networks still don't use it, so SNI remains readable on a large share of connections.
Method 3: IP blocking
The bluntest method drops every packet sent to a given address. It doesn't matter what you ask for or how: if the site lives at that address, the network won't deliver your traffic.
What you see: a long timeout, often on every network the same provider runs.
IP blocking is the one that causes the most collateral damage, because a single address can host thousands of unrelated sites.
The three methods side by side
| Method | What the network uses | Typical symptom | What gets through |
|---|---|---|---|
| DNS | Your unencrypted name lookup | "Can't be reached" or a warning page | Encrypted DNS, or a VPN |
| SNI | The site name at the start of HTTPS | Starts loading, then resets | A VPN (ECH where both sides support it) |
| IP | The site's server address | Long timeout | A VPN |
A VPN is the one answer in every row because it changes what the network sees. Instead of your lookups, the site name and the site's address, the network sees one encrypted connection to the VPN server. There's nothing in it to filter.
When the network blocks the VPN too
Some networks go one step further and block VPNs themselves, usually by dropping UDP traffic or by recognizing VPN handshakes. WireGuard, the protocol PryVPN uses, starts every connection with a message of a fixed size and layout, which a filter can learn to spot.
That's what PryVPN's Stealth mode is for. It carries WireGuard inside a real TLS 1.3 connection on TCP port 443, the same protocol and port every HTTPS website uses. To most filters it looks like one more secure website, and the app pins our server's certificate, so a network that tries to intercept the connection is detected instead of trusted.
You don't have to pick it yourself: in Auto mode, PryVPN tries UDP first and, if the server doesn't answer within about 7 seconds, switches to Stealth and remembers that choice for this network for a few hours. If you're stuck right now, the VPN blocked on Wi-Fi troubleshooter asks two questions and gives you the steps for your network. Hotel networks have their own quirks, covered in hotel Wi-Fi blocking your VPN.
How PryVPN gets you through
- Your lookups stay inside the tunnel. While you're connected, DNS questions go to the resolver on your PryVPN server, which checks DNSSEC and keeps no query logs. The network's DNS never sees them, so it can't answer wrongly.
- The site name and address are hidden. SNI and the destination address travel inside the encrypted tunnel. The network only sees the PryVPN server.
- Stealth on port 443, chosen automatically. Auto mode moves to Stealth when a network blocks VPN traffic and remembers it per network.
- Another route if one is blocked. Smart Location picks a server by latency, load and stability, and you can choose another city in Locations. Every connection also has a backup server, in another city when possible, ready within seconds.
- Nothing slips out while it connects. With Android's Always-on VPN and Block connections without VPN, apps only go online through the tunnel, so a blocked network can't push them back onto the filtered connection.
To see what a network can read about your browsing before and after connecting, try what your network sees, or read what the Wi-Fi owner can see.
Use it legally and responsibly
Using a VPN is legal in most countries, and getting around an over-broad filter to read the news, reach your work tools or message your family is exactly what VPNs are for. A few points keep it that way:
- The law of the country you're in still applies. Some countries restrict or ban VPNs; check before you travel. Our travel help article covers the basics.
- A VPN doesn't change what's legal. Pirated streams and other unlawful content stay unlawful with or without a tunnel. Use it for what you're entitled to see.
- Networks you've agreed to have rules. At work or school, ask the IT service when something you need is blocked, and never work around the settings of a device your employer or school manages.
Frequently asked questions
Why does a site open on mobile data but not on Wi-Fi?
Because the Wi-Fi network is the one filtering it, usually by DNS, or it's waiting for you to sign in on its login page. With a VPN, both networks see the same thing: an encrypted connection to the VPN server.
Does changing my DNS unblock sites?
It gets you past DNS blocking, which is the most common kind. It doesn't help when the network reads SNI or blocks the site's address. A VPN covers all three at once.
Can the network see that I'm using a VPN?
It can see a connection to a VPN server. In Stealth mode that connection looks like ordinary HTTPS on port 443, which is what most networks expect to carry all day.
Which sites can PryVPN open?
Sites that work on the open internet but are blocked by the network you're on. If a site is down for everyone, the Is it down? check will show it, and no VPN can bring it back.
PryVPN is a free WireGuard VPN for Android with no activity logs. Join the beta and we'll email you when there's room; it installs from Google Play.
Sources
Spotted a mistake? Write to support@pryvpn.com and we'll fix it and update the date.
