Key takeaways
- A VPN that connects on mobile data but not on one specific Wi-Fi is being blocked by that network. The service itself is fine.
- On hotel and airport Wi-Fi, accept the captive portal page in a browser first. Half of “blocked VPN” cases are just this.
- The durable fix is a stealth protocol (VLESS Reality or Hysteria2) that looks like ordinary web traffic instead of a VPN.
Your VPN connects in two seconds on mobile data, then spins forever on the hotel Wi-Fi. That pattern is the diagnosis. The service is not down, the network is blocking it. Hotels, campuses, airports and cafés all do it: some to save bandwidth, some to enforce content filters, some because the firewall shipped that way and nobody has looked at it since.
Check the captive portal first. On hotel and airport Wi-Fi you must open a browser and click through the network's login page before any VPN can connect. Disconnect the VPN, load a plain http site (neverssl.com exists for exactly this), accept the portal, then reconnect. This one step resolves half of the "Wi-Fi blocks my VPN" complaints we see.
How networks block VPNs
Three tiers, in escalating order of effort:
| Tier | How it works | What it kills |
|---|---|---|
| 1. Port blocking | Drops the well-known VPN ports: UDP 500/4500 for IKEv2, WireGuard’s UDP ports, OpenVPN’s 1194 | Every app left on default settings |
| 2. Deep packet inspection | Fingerprints the protocol itself, whatever port it runs on | Anything recognisably VPN-shaped, port tricks included |
| 3. UDP lockdown | Blocks all UDP except DNS | WireGuard and IKEv2 entirely |
Tier 1 is beaten by moving to another port. Tiers 2 and 3 are not, and that is where the usual “just change your port to 443” advice stops working.
Blocks escalate. A network that bothers to filter VPN ports tends to add deep packet inspection later, and campus and corporate networks increasingly run the full UDP lockdown. A fix that works by dodging ports buys you weeks, not years. Plan for tiers 2 and 3 from the start.
The fix ladder
Work through it in order. Each step beats a bigger tier of blocking than the last.
- Complete the captive portal. Browser first, VPN second. Costs nothing, fixes half the cases.
- Switch to a TCP-443-shaped protocol in your app. OpenVPN over TCP 443, or whatever “TCP” toggle your app offers. The network cannot drop port 443 without killing the web, so this beats tier-1 port blocking. It does not beat DPI, which recognises OpenVPN inside the TLS wrapper.
- Use a stealth protocol. VLESS Reality borrows the TLS handshake of a real website, so its traffic is indistinguishable from ordinary HTTPS. Hysteria2 rides QUIC, the transport behind HTTP/3. Neither looks like a VPN to deep packet inspection. One nuance: a tier-3 UDP lockdown takes Hysteria2 down with it, while Reality runs over TCP 443 and survives. Carrying both covers everything.
- Let the app run the ladder for you. VPNBaron’s Pathfinder tries routes and protocols automatically until one connects, which is what you want at midnight in a hotel lobby instead of toggling settings by hand.
A word about office Wi-Fi
If your employer blocks VPNs on the company network, that is their network and their policy. On a work laptop the right move is to follow workplace rules, not to tunnel around them. Everything above is aimed at hotel, airport, campus and café Wi-Fi, where you are a paying guest with a legitimate interest in a private connection.
What we use
VPNBaron ships VLESS Reality, Hysteria2 and IKEv2 and builds its apps around Pathfinder’s automatic fallback, which is why it handles hostile Wi-Fi better than the mainstream brands (our review rates it 9.7, currently our #1). It costs $8.99/mo month-to-month or $3.49/mo effective on the yearly plan, and the renewal price is identical. No provider connects on every hostile network every time, so use the 7-day money-back window to test it on the exact Wi-Fi that is blocking you now.
If the network blocking you is a country rather than a hotel, the China guide covers the national-scale version of the same fight, and the protocols guide has the detail behind every protocol named here.