Campus and company networks filter traffic for policy and security reasons: they block ports and protocols (often the UDP that WireGuard uses), block known VPN servers or filter DNS. A VPN that travels over TCP port 443, like ordinary web traffic, usually gets through. But using one can break rules you agreed to, so read them first, and never try it on a device your organization manages.
The campus Wi-Fi works fine for everything except the one app you want: the VPN spins on "Connecting" and times out. Or it's your office network, which lets you browse but seems allergic to anything that looks like a tunnel. Neither is a bug. These networks are built to block some traffic, and VPNs are a common casualty.
This article is for university students and adults at work. School networks for minors are a different matter, and we don't cover them.
How campus and office networks block VPNs
Network teams rarely block "VPNs" as such. They block the things VPNs are made of:
| Method | What it does | What you see |
|---|---|---|
| Port and protocol rules | Only web traffic (TCP 80 and 443), DNS and a few services are allowed; other UDP is dropped | WireGuard never completes its handshake |
| Protocol fingerprinting | The firewall recognizes VPN handshakes by their size and shape | Connects for a moment, then stalls, or never starts |
| Blocklists of VPN servers | Known VPN addresses are refused | Some locations fail, others work |
| DNS filtering | The network's resolver refuses or rewrites some names | The app can't find its servers, or sites land on a block page |
| TLS inspection | On managed devices, a company certificate lets the firewall open encrypted traffic | Security warnings, or apps that refuse to connect |
Why bother? Bandwidth, security policies, licensing rules, and sometimes just a firewall that came configured that way. Blocking VPNs also keeps the network's own filters (for malware, for example) in the loop.
eduroam is a network of networks
Many universities use eduroam, the roaming Wi-Fi for research and education. It gives you one login across institutions, but each institution still runs its own network and firewall. So a VPN that works at one campus may fail at another, and there's no single "eduroam rule" to look up.
Many universities also offer their own VPN, for reaching the library or internal systems from home. That's a different tool: it connects you into the university network rather than hiding your traffic from it. Research on how people use VPNs (USENIX Security 2022) found that most users learned about VPNs in high school or college, use free ones, and feel safer with VPNs provided by their institutions.
First, check whether you should
A VPN is legal in most countries, but a campus or company network is private property with its own rules. Before trying to get around a block:
- Read the acceptable use policy you accepted when you got your account. Some forbid tunneling or "circumventing security controls" outright.
- Don't use a VPN on a device your organization manages. A work phone or a work profile can be set to forbid VPNs; Android then won't let the app start, and only the administrator can change that. Our help article on work profiles and other VPNs explains what you'll see.
- Exams, labs and restricted systems often have rules of their own. Follow them.
If something you legitimately need is blocked, ask the IT service. A short, specific message works best: which network, which app or site, what you need it for, and the error you see. It's the fastest route, and it's the one that won't cause trouble later.
When it's allowed: what gets through
If the rules allow it, the reliable way through is to carry the VPN inside something the network already accepts: encrypted web traffic on TCP port 443. That's what a stealth or obfuscation mode does.
- Try the automatic mode first. A good app tries the fast protocol (UDP) and falls back by itself.
- Switch to stealth by hand if Auto takes too long on a network you use every day.
- Try another location. Some networks block specific server addresses.
- Accept that some networks won't allow it. If the network only lets through a short list of services, or inspects every connection in depth, no setting may help, and that is also an answer.
Our free VPN blocked on Wi-Fi troubleshooter asks what you see and gives you the steps for your case. The same causes appear on hotel networks; our article on hotel Wi-Fi blocking VPNs walks through the login-page side of it.
What the network can see with and without a VPN
Without a VPN, the campus or office network can usually see which sites you visit (from DNS lookups and the site name at the start of each encrypted connection), when, and how much data you use, but not the pages or what you type on HTTPS sites. With a VPN, it sees an encrypted connection to a VPN server and its size. In stealth mode that connection looks like HTTPS, but a network with advanced inspection can still tell it's a VPN. Our guide on what a Wi-Fi owner can see has the full table.
How PryVPN behaves on these networks
- Auto tries WireGuard over UDP. If the server doesn't answer within about 7 seconds, it switches to Stealth (WireGuard inside TLS 1.3 on TCP port 443) and remembers that for this network for a few hours.
- Stealth is slower than UDP and needs Android 10 or later. While it's on, the PryVPN app itself stays outside the tunnel so its TLS connection can reach our server; your other apps stay protected. The protocol help article explains each option.
- If the network inspects encrypted traffic by replacing certificates, PryVPN notices, refuses to connect and tells you, instead of sending anything through it.
- On a managed device that forbids VPNs, PryVPN can't start, and it won't try to get around that.
None of this promises a connection on every network. It does mean that on networks that simply block UDP, you don't need to become a network engineer to get connected, and that you'll be told honestly when a network won't allow it.
Frequently asked questions
Can my university see that I use a VPN?
Usually, yes. It sees a connection to a VPN server, or in stealth mode a long HTTPS-like connection, and how much data it carries. It can't see the sites or content inside.
Is using a VPN on campus Wi-Fi illegal?
In most countries a VPN is legal. Campus rules are a separate question: breaking an acceptable use policy can have consequences even when nothing illegal happened. Read the rules, and ask IT when in doubt.
Why does the VPN work on mobile data but not on the Wi-Fi?
Because the block is in the Wi-Fi network's firewall, not in your phone or the VPN. Your mobile operator's network has its own, different rules.
If PryVPN sounds like the right tool for the networks you're allowed to use it on, join the beta.
Sources
Spotted a mistake? Write to support@pryvpn.com and we'll fix it and update the date.
