Holiday rental Wi-Fi: using a VPN on a router the host controls

A home router gives each device its network address and, on many home networks, answers its name lookups as well. Its administration page lists the devices that have joined, usually with the name each device announces and its hardware address.

Every packet between your devices and the internet passes through the router, so it is in a position to see which devices are present, when they join and leave, which names they look up through it and which addresses they connect to. For an HTTPS connection it can usually also read the site's name in the handshake, though not the page that follows. What a particular router records depends on its model and settings.

Many routers sold for homes are set up and managed through a phone app tied to an online account, which lets the owner open the device list from anywhere. Some models add a history of the sites each device has reached, as part of parental-control or security features.

That visibility comes with owning the equipment and is not evidence of monitoring. The list that tells the host the connection is working can also show your laptop and phone by name.

With WrapVPN connected, the router's view of your device's internet traffic narrows to one encrypted connection to the exit server's address, with its timing and volume. On iPhone, iPad and Mac, a connection that an app opened before the tunnel started can continue outside it until that connection closes. The app sets the DNS server inside the tunnel, so your lookups go through the tunnel instead of to the router, and the names of the sites you visit stay inside it. Those names and destinations are not hidden from WrapVPN's exit server, which has to see each destination to forward the traffic; the privacy policy sets out what WrapVPN records. The router still lists the device, its name and its hardware address, because those belong to the local network rather than to your internet traffic.

The network name and password usually arrive in a welcome message or on a card beside the router, and the same details went to every guest before you. Unless the host changes the password between bookings, any of those guests can still join from within range.

On a router that uses WPA2 with a shared password, the password also lets someone who records your device joining the network work out the keys for that device's session. Anything sent outside a tunnel is then as readable to them as it would be on an open network. WPA3 closes that gap, but a guest cannot choose the standard the router runs.

Many home routers also carry an administration password on a label underneath. In a rental that label is within reach of every guest, and whoever signs in with it can change the router's settings, including the DNS server the router hands to devices.

WrapVPN limits what such a change can do. While the tunnel is up, the app sends your lookups through it to the resolver it has set rather than to the server the router announces, so a changed router setting does not redirect them. That protection lasts only while the tunnel is up: before it starts, during a pause and after you disconnect, your lookups go to the server the router announces and your traffic crosses the router outside the tunnel.

A rental's own network is a home network, so it usually carries the host's equipment as well as yours: a smart television, a streaming stick, speakers, a thermostat, and sometimes a smart lock or a video doorbell. Each is usually managed through its maker's app and online service under the host's account, and each sits on the same local network as your laptop and phone.

Devices on a home network find one another through discovery protocols such as mDNS and SSDP. That is how a phone finds a television to cast to, and it also means the other devices on the network can receive the announcements your laptop makes about shared folders, a media library or screen sharing.

The host's devices run software you cannot inspect, from companies you did not choose, and they receive those announcements like any other device. A VPN tunnel is built for traffic to the internet, while what a device offers to the local network is set in its operating system. Turning off sharing and discovery, as the next section describes, is therefore the dependable step whether or not a VPN is connected.

These are operating-system settings, so they can be changed before you leave home. Start with laptops, which are the devices that commonly run file sharing, a media library or a development server.

On Windows, open the Wi-Fi network's properties in Settings and set its network profile to Public. With that profile, the default settings turn off network discovery and file and printer sharing for the network.

On recent versions of macOS, open System Settings > General > Sharing and turn off each service you will not use during the stay, such as File Sharing, Screen Sharing and Remote Login. The firewall, in System Settings > Network > Firewall, can also refuse incoming connections.

Development tools need their own check. A local web server or database started for work may listen on every network interface, and on a rental network it can then be reached by the host's devices and anyone else who has joined.

The television in a rental belongs to the host and is often signed in to the host's own accounts. Anything watched on the host's profile joins that profile's viewing history, which the host can see.

If you sign in with your own account, sign out before you leave. Our hotel Wi-Fi guide covers the rest: signing a television out after you have gone, and casting from your phone instead of signing in.

Not every rental has its own line. Some apartment buildings run one network for every flat, managed by the building or by a contracted provider, and some hosts leave a mobile broadband router with a SIM card in place of a fixed connection.

On a shared building network the other residents are on the same network as you, and whether one flat's devices can reach another's depends on settings you cannot see. Treat it as a public network, with sharing off and the tunnel on for the whole stay. If a sign-in page opens when you join, complete it first: WrapVPN cannot complete its handshake until the network lets traffic out.

A mobile broadband router runs on the host's mobile plan. The host's operator carries its traffic as a fixed-line provider would, and the host can often check the data used in the operator's app. With WrapVPN connected, the operator sees your devices' traffic as encrypted connections to the exit server rather than the sites behind them.

Plans for these routers often carry a data allowance, and the allowance is the host's. Video calls and cloud backups use it quickly, and a VPN adds a small header to every packet, so the same activity uses slightly more data with the tunnel running. Ask the host about the allowance before a long video call or a large backup.

A stay measured in weeks changes the arithmetic. The weekly plan costs $1.99 and the monthly plan $3.99, and both renew until you cancel them in your App Store or Google Play subscription settings. Four weeks on the weekly plan would cost $7.96, against $3.99 for the month.

Cancelling does not cut a paid month short: access continues until the end of the period already paid for. The free plan does not stretch to a working week, because it provides three one-hour sessions a week, shared by every device on the account, and each hour runs from the moment the session starts.

For video calls, choose a server location close to where you are staying, because a distant exit server adds its distance to every round trip. The iPhone, iPad, Android and Windows apps show a response time for each location, measured by the app itself; it is a rough comparison, not a ping.

A work laptop often runs the employer's own VPN, and the employer's policy decides what else may run on it. On Windows, WrapVPN checks for known VPN software before connecting and offers to close what it finds, with the choices 'Close & Connect' and 'Cancel'. On Android, one VPN runs at a time, and WrapVPN asks before it turns another app's VPN off. Keep the employer's VPN on the work laptop and use WrapVPN on your own devices.

Over several weeks, Auto-Connect reduces how often you need to connect by hand. On iPhone and iPad it brings the tunnel up whenever the device joins a Wi-Fi network. On Android it connects whenever the device has a connection and the VPN is down, unless you disconnected or paused it yourself. On Windows it connects each time the app starts. All three apps leave it off until you turn it on.