In-flight Wi-Fi and a VPN: satellite delay, onboard packages and server choice

In-flight Wi-Fi reaches the ground in one of two ways. An air-to-ground system links the aircraft to a network of towers below it, much as a phone links to a mast, so it works only within range of those towers. A satellite system links the aircraft to a satellite, which relays the traffic to a ground station, and it can also serve routes over the sea.

A geostationary satellite orbits 35,786 km above the equator, the height at which one orbit takes as long as one turn of the Earth, so it stays above the same point. A request climbs to the satellite and descends to the ground station, and the reply makes both journeys again in the opposite direction. The four legs add up to at least 143,000 km, which radio crosses in about 480 ms, so a geostationary link spends almost half a second of every round trip in space before any equipment or distance on the ground is counted.

Satellites in low Earth orbit fly below 2,000 km, a small fraction of that height. The climb to the satellite and back therefore adds far less delay, and the route on the ground accounts for a larger part of what remains.

A geostationary satellite sits above the equator, so it sinks towards the horizon as an aircraft flies towards either pole. On routes that pass close to a pole, the service can stop for part of the flight.

Access is sold on a purchase page that the aircraft's network shows to any device that joins it. Until a package has been bought, or a free offer accepted, the network holds back ordinary traffic to the internet. WrapVPN cannot connect before that point: the app cannot reach WrapVPN's servers to collect its configuration, and the tunnel's handshake has no route to the exit server.

Packages are commonly sold per device, and the system remembers which device paid. A laptop used alongside a phone therefore usually needs a package of its own. WrapVPN has no device limit on any plan, so one account can run the tunnel on both, but that does not change what the aircraft's network charges for access.

On iPhone and iPad with Auto-Connect on, the tunnel starts when the device joins the aircraft's Wi-Fi, and the purchase page may not load while it is running. Press and hold the switch, choose a pause of 15 or 30 minutes and complete the purchase. During the pause, iOS still shows the VPN as on while traffic uses the aircraft's network directly, and WrapVPN reconnects when the time is up. On other devices, complete the purchase before connecting.

The purchase page belongs to the onboard network and runs before any tunnel exists. Enter card details only if the browser shows a secure connection, and give the page nothing beyond what the purchase requires.

Some in-flight networks offer a free or low-cost package that carries messaging apps and nothing else. Such a package lets through traffic to the services it covers and holds back the rest, which works only while the network can tell which service each connection belongs to.

A VPN tunnel removes that information. The network sees one encrypted stream to an address that is not on its list, so some messaging-only packages may not carry a VPN at all. While the tunnel is trying to connect, the messaging apps the package was meant for may stop working as well, because their traffic is routed into the tunnel.

The package's terms decide what it carries, and a VPN is not a way around them. When a package excludes VPN traffic, the choice is between buying a package that carries the tunnel and using this one without it, protected only by whatever encryption each messaging app applies to its own traffic.

The WrapVPN tunnel runs over UDP, with no TCP fallback, so a network that carries only TCP traffic cannot carry it, whichever server location you choose.

Every connected passenger shares the capacity of the aircraft's link to the satellite or to the ground. When much of the cabin is online at once, each device receives a smaller share, and a VPN cannot enlarge it, because encrypting traffic adds nothing to the link.

Some packages also cap the data or the speed available to each device. Those limits apply to the device whether or not its traffic is in a tunnel.

A phone or laptop that joins Wi-Fi in the air can also resume the background work it could not do while offline: photo backups, app updates and cloud synchronisation. With the VPN on, all of it travels through the tunnel and competes for the same share. Pause automatic backups and updates before take-off if the connection is for messages and reading.

The apps measure their own response time to each server location, mostly when they start or load the server list, so figures taken on the ground describe the airport's network rather than the aircraft's.

Figures taken at the gate therefore describe the airport's network, not the aircraft's. Once the aircraft is connected, every route to every exit server begins with the link to the satellite or the towers, and on a geostationary link that link adds roughly half a second to all of them. To measure from the aircraft, disconnect first; then close the app fully and reopen it on a phone or tablet, or select 'Refresh' on Windows.

The apps measure in different ways. The Android app times a short web request to each server and displays half of the result, the Windows app shows the full time of a web request, and the iPhone and iPad apps time how long a connection to each server takes to open. None of these is a ping, so compare a figure only with other figures on the same device.

Each measurement also runs against a timeout of a second or two. Over a geostationary link a measurement needs one or two round trips of about half a second each, so a busy link can run out of time. On Android, a location whose test fails is shown in red and cannot be chosen until the app measures again.

The aircraft's position says little about which exit server is nearest in network terms. A satellite system hands traffic to the internet at its ground station, which can be far from the aircraft and sometimes in another country. Without a VPN, websites see an address belonging to the in-flight network's operator, which geolocation services can place in a country unrelated to the route. An air-to-ground system enters the internet through the ground network it belongs to.

On a geostationary link, the time spent in space is the same for every exit server, so the differences between locations come from the path on the ground, from the ground station onwards. If the ground station is near London, for example, choosing London rather than Cedar Knolls removes about 5,600 km from the path and a round-trip floor of about 56 ms. On an office connection that is a large share of the delay; on a link that already spends half a second in space, it is a modest one.

Measure from the aircraft, then choose the lowest figure among the server locations you are willing to use, or use 'Fastest' on Android and 'Automatic' on Windows. On iPhone and iPad, the app selects the lowest figure by itself after measuring, unless you have already picked a location since it opened. Keep that location for the rest of the flight: changing location replaces the connection, and each new connection over a satellite link takes longer to set up.

On the free plan, the iPhone and iPad apps do not move a running session to another server. Disconnect first, then choose the new location; connecting again within the hour continues the same session.

The free plan gives each account three one-hour sessions a week, shared by all of its devices, with every server location available. Each hour runs from the moment the session starts and keeps running after you disconnect, so one week's allowance covers at most three hours of a long flight, and only if none of it has been used.

A session starts when WrapVPN's server issues the app its configuration, which happens before the tunnel itself has to work. On a package that lets the app reach WrapVPN but does not carry the tunnel, a free hour can therefore start without a working connection.

A phone and a laptop on the same account can share one session: a device that connects while the account's hour is running joins that hour instead of starting another. The weekly count resets every Monday at 00:00 UTC, a moment that does not move with the time zones a flight crosses.

The tunnel's own battery cost is small. Encryption is light work for a current phone or laptop, and WireGuard was designed to do little work for each packet. The configuration WrapVPN issues sets a keepalive of 25 seconds, which the iPhone, iPad and Android apps apply, so an idle tunnel on those devices still transmits a small packet at that interval. On a long flight without power at the seat, disconnect once you have finished with the Wi-Fi.

For flights that need more than the free plan, the weekly plan costs $1.99 and the monthly plan $3.99, and there is no annual plan. Both renew until cancelled in the App Store or Google Play subscription settings, and a cancelled plan keeps working until the end of the period already paid for.