Why a VPN won't connect on some Wi-Fi networks, explained

A website is something your browser visits. A VPN is more like a phone call that stays open: your device and one exit server keep a two-way conversation going for as long as you're connected, and everything you do online travels inside it.

That conversation starts with a handshake: one message from your device and one reply from the server. If the network holds back either of them, there's no tunnel. Once the tunnel is up, its messages have to keep getting through, or it goes quiet.

So a VPN asks three things of a network: let me out, carry my kind of traffic, and deliver it reliably enough to talk. Each obstacle below breaks one of those. We'll take them from the easiest to the hardest, following one day away from home: a hotel, a conference venue, a client's office and a café garden.

Morning, in the hotel. You join the guest Wi-Fi, tap Connect, and nothing happens. The hotel hasn't let you out yet.

Many hotel, café and airport networks hold back all traffic until you've completed a sign-in page, whether that means accepting terms, entering a room number or watching an advert. It works like a front desk that won't hand over a key until you've checked in, and until then the network answers everything with that page.

Here's the catch. With the VPN on, your phone sends everything into the tunnel, including the request that would have shown you the sign-in page. The network is waiting for you to sign in, your phone is waiting for the network to let the tunnel through, and neither side moves.

The fix is to take things in order: complete the sign-in page first, then connect. Your phone usually opens the page by itself when you join. If it doesn't, open a browser and visit any ordinary website, and the network will send you to its page instead.

If you've turned on Auto-Connect and it starts WrapVPN before you've signed in, pause WrapVPN, complete the page, and carry on; it resumes by itself after a few minutes. Some networks ask you to sign in again every so often, and the same routine applies.

Lunchtime, at a conference venue. The guest Wi-Fi has no sign-in page and websites load normally, but WrapVPN still can't connect.

Some networks are set up to carry web browsing and very little else. It keeps a shared network simple and stops a few heavy users from taking all of it. The trouble is that a VPN tunnel isn't web browsing, so the network quietly drops its first message, and the reply your device is waiting for never comes.

That's also why the app can look as if it's getting somewhere. Before the tunnel starts, WrapVPN fetches the configuration for your location from our server, and that request is ordinary web traffic, so it gets through. It's only the tunnel that's turned away at the door.

This is the most confusing obstacle, because everything else looks healthy. The quickest test is mobile data: turn off Wi-Fi on your phone and connect again. If WrapVPN connects straight away, the Wi-Fi was the problem. On a laptop, use your phone's hotspot and connect WrapVPN on the laptop itself, because a VPN on your phone protects only your phone.

Afternoon, in a client's office. Their guest network works for everything except VPNs, and that's deliberate.

Schools, universities and employers often block VPNs on purpose. They may filter what can be reached, watch for security threats, or simply have a policy that everything on their network stays visible to them. A network can recognise a VPN by where its traffic is going or by what that traffic looks like, and turn it away. Sometimes it does so silently, which looks exactly like the previous obstacle; sometimes a page explains the policy.

It's their network, so it's their call. Rather than trying to get around the rules, use mobile data if that's allowed, or ask the IT team. If your employer gives you a VPN of its own for work devices, that's the one to use at work.

Evening, at the far end of a café garden. The Wi-Fi icon shows one bar, and the VPN connects and then stalls.

A weak signal loses messages. A web page copes by asking again and loading slowly. A tunnel copes too, but when too many messages go missing in a row, the conversation inside it stalls and pages stop loading even though the tunnel is technically up. A café connection shared by a crowd in the evening can feel similar, although there everything is slow rather than stuck.

You can usually tell this one apart: websites are slow with the VPN off as well, and things improve as you walk back indoors. The fix is physical: move closer to the router, or switch to mobile data if its signal is stronger. On phones, moving between Wi-Fi and mobile data doesn't stop the tunnel, so you can make the switch without starting over.

When WrapVPN won't connect, look for a sign-in page first, move closer if the signal is weak, and then try mobile data. If WrapVPN connects there, the Wi-Fi is either limited to web traffic or blocking VPNs on purpose, and the network's rules decide what comes next. Once you're through, our guide to checking that your VPN is working shows how to confirm it.