Mobile data abroad: roaming, a local SIM or a travel eSIM, and what a VPN changes

Roaming data is commonly carried back to the home operator before it reaches the internet. The foreign network provides the radio connection, the data travels on to a gateway run by the home operator, and websites often see an address in the home country even while the phone is abroad. Some roaming arrangements hand the data to the internet in the visited country instead, so the result depends on the operator.

A local SIM makes the phone a customer of a network in the country it is in. Its traffic leaves locally, and websites see a local address; those that localise by address then show the local language, currency and search results.

Some travel eSIM data plans run over partner networks and give the phone an address that geolocation services place in another country, neither the home country nor the one being visited. Websites that localise by address may then apply that third country's defaults, and a service may ask for extra verification when a sign-in arrives from a country it does not expect.

Whichever operator carries the data stands where an internet service provider stands. It cannot read encrypted content, but it can see which hosts the phone contacts and when, and the phone normally sends its DNS lookups to a resolver that the operator runs. Roaming adds a second operator: the visited network carries the traffic, and commonly the home operator does as well.

With WrapVPN connected, both see a single encrypted stream to the exit server's address. DNS lookups travel inside the tunnel too: to the Clean Web resolver on the exit server when Clean Web is on, and otherwise to a public resolver reached through the tunnel.

The view does not disappear; it moves to the exit server, which forwards the traffic and is therefore placed to see where it goes. WrapVPN records each connection and disconnection with the account, the time, the exit server and the session's length. Each exit server also reports an hourly summary for every tunnel address, covering the data transferred, the external addresses reached over TCP and the domain names associated with them, and that summary can be linked to the account. Other records are described in the privacy policy, and our guide to who can see what compares each party in turn.

Most advice about public Wi-Fi concerns the other people on the network and the venue that runs it. Mobile data has neither: the phone does not share a local network with other customers, no sign-in page stands in front of the connection, and the radio link between the phone and the mast is normally encrypted by the mobile network itself.

The threats a tunnel handles on café Wi-Fi, such as a hotspot imitating a familiar network name or a venue reading every lookup, therefore mostly do not arise. On mobile data a VPN changes two things: the operators see one encrypted stream instead of the hosts you contact, and websites see the exit server's address instead of the one the SIM provides. If neither matters to you, the tunnel adds less on mobile data than on shared Wi-Fi.

A phone on a trip also moves between Wi-Fi and mobile data many times a day, and the move does not end the WrapVPN connection on iPhone, iPad or Android. On iPhone and iPad, Auto-Connect acts only when the device joins Wi-Fi; on mobile data it neither starts nor stops the tunnel. On Android, Auto-Connect, once switched on, also starts the tunnel on mobile data whenever it is down, unless you disconnected or paused it yourself. After the phone restarts, it waits until WrapVPN has been opened once.

The latency figures in the server list are measured over whatever connection the device is using, and on a roaming SIM that path can include a trip home. When roaming data is routed back to the home operator, every request travels to the home country first, then to the exit server, and only then to the website.

An example shows the size of the effect. Tokyo is 7,850 km from Sydney, a round-trip floor of 78.5 ms. If an Australian SIM roaming in Japan is routed home, choosing the Tokyo exit sends each request to Australia and back to Japan before it leaves the tunnel, so the floor to that exit doubles to 157 ms, while an exit near the home gateway adds little to the 78.5 ms the roaming route already costs. The server list's figures measure this path to each exit, not the onward path to a website. On a Japanese local SIM the reverse holds: the traffic enters the internet in Japan, and the Tokyo exit is the near one.

The measured figures show which case applies. After changing SIM or arriving in a new country, disconnect and restart the app, or select 'Refresh' on Windows, then compare an exit near home with one near where you are. Each app measures in its own way, so read the figures as a comparison between locations on one device.

A travel eSIM whose address appears in a third country may route through that country as well, and only a measurement shows it. The city names in the server list come from the location data recorded for each server's address, and they say nothing about the route your data takes to reach it.

WireGuard wraps each packet in new IP and UDP headers, a header of its own and an authentication tag, adding 60 bytes when the tunnel runs over IPv4 and 80 bytes over IPv6. Against a full-size packet of 1,500 bytes, 60 bytes is 4 per cent and 80 bytes a little over 5 per cent, so downloads and video use a few per cent more of an allowance with the tunnel on. Small packets carry a larger share of overhead, so the exact figure depends on what the phone is doing.

An idle tunnel costs little. The configuration WrapVPN issues sets a keepalive of 25 seconds, so a connected iPhone, iPad or Android phone with nothing else to send still exchanges a few small packets a minute with the exit server, which comes to less than 1 MB a day.

Two other effects belong in the same calculation. Some mobile plans do not count certain services against the allowance, and the operator recognises that traffic by where it goes; inside the tunnel it cannot, so the same traffic may then count like any other. Clean Web works in the other direction: the resolver on the exit server refuses lookups for advertising and tracking domains, and a request refused at the lookup is never made.

Clean Web acts only on lookups sent to the resolver on the exit server, and it judges by domain name alone, so a browser or app that uses its own encrypted DNS bypasses it. It starts switched on in a new Android installation and switched off on iPhone, iPad and Mac; on Windows, check the switch. The blocked count in the app includes every lookup answered with no usable address, lookups for names that do not exist among them, so it is not a record of data saved.

A VPN changes neither the allowance nor what happens once it is used up: where a plan slows the connection after the cap, the slower speed applies to tunnelled traffic as well.

A phone hotspot is a small local network you control, protected by your own password, and it puts a laptop or tablet on the phone's mobile connection. WrapVPN on the phone protects the traffic the phone itself sends. Do not rely on it for the devices that join the hotspot: install WrapVPN on each of them and connect it there, so that each device's traffic travels in a tunnel of its own.

The phone, the laptop and the tablet can all share one account: there is no device limit on any plan, the free plan included. Sign in the same way on each of them: with Hide My Email, an Apple sign-in and a later Google sign-in lead to two different accounts unless the email addresses match, and a plan bought on one does not appear on the other.

The free plan's three one-hour sessions a week belong to the account, so all of those devices draw on them; a device that connects during an hour another device has started joins that hour rather than using a new session.

A plan bought in the App Store or on Google Play belongs to the account, so it covers every platform where that account is signed in. On a Windows laptop, the 'Upgrade' and 'Subscribe now' buttons only open WrapVPN's Google Play listing, because the Windows app sells nothing; buy on the phone, then sign in on the laptop with the same account.

WrapVPN is sold by the week and by the month, with no annual plan and no long-term commitment. The weekly plan costs $1.99 and the monthly plan $3.99. Both are bought inside the app, through the App Store on iPhone, iPad and Mac or through Google Play on Android, and there is no web checkout.

Each renews until you cancel it in the store's subscription settings. Cancelling stops the next renewal but keeps access until the end of the period already paid for, so a plan cancelled on the day it is bought still covers that whole period. Two weekly periods cost $3.98, one cent less than the monthly plan, which makes the monthly plan the cheaper choice once a trip runs past two weeks.

The monthly plan may include a seven-day free trial for eligible new subscribers. The store decides who is eligible, and the app shows the offer before you confirm.

The free plan suits a quick check on a new SIM or a hotspot rather than a whole trip: three one-hour sessions a week, each running from its start, with the count reset every Monday at 00:00 UTC.