Train Wi-Fi and a VPN: coverage gaps, handovers and sign-in pages

The router on a train is a mobile-network client, much like a phone with better antennas. When the line enters a railway tunnel, runs through a deep cutting or crosses country with few masts, the router can lose its mobile connection while the Wi-Fi in the carriage stays up with nothing behind it. Devices remain joined to the onboard network and keep their addresses, so a drop shows up as a stalled page rather than a lost network.

Metal carriage bodies, and windows with metallic coatings, weaken mobile signals inside many trains, which is why the router's antennas are often mounted outside. The same shielding means that a phone's own mobile data can be weaker inside the carriage than the onboard Wi-Fi on the same stretch.

On a line with frequent railway tunnels, gaps are part of every journey. Reading, messaging and pages that load in small pieces recover when the train emerges, while a large upload or a video call needs a continuous connection and is exposed to every gap.

A moving train passes from one mast's coverage to the next many times an hour, and the faster it travels, the more often that happens. Each handover is normally brief, but a router that holds on to a fading mast, or moves to a congested one, can interrupt traffic for longer than the switch itself takes.

Some onboard routers hold more than one mobile connection, sometimes with different operators, and move traffic between them as coverage changes. When that happens, the public address the train presents to the internet can change partway through a journey, and connections that were open at the time can break.

With WrapVPN connected, websites see the exit server's address instead. Every user of that exit shares it, and it stays the same for as long as you stay connected to that exit, whatever happens to the train's own address. To websites, your connections come from the exit server, so a change of the train's address does not by itself break them; only the tunnel between the device and the exit server has to follow the change, and WireGuard is designed to do that.

A WireGuard tunnel follows a change of address without a new connection: the exit server records the new address from the first authenticated packet that arrives from it, as our WireGuard guide explains. Under the configuration WrapVPN issues, the iPhone, iPad and Android apps send a keepalive packet after 25 seconds without other traffic, so after the train's address changes, the exit server learns the new one within about 25 seconds, without waiting for you to open a page.

In a railway tunnel the device normally stays joined to the onboard Wi-Fi, so it still has a network even though no packets get through. The list below sets out how the iPhone, iPad, Android and Windows apps react to a change of network and to a longer loss. 'When internet is lost' on Android and Windows applies only when the device has no network connection at all for 30 seconds, for example when a laptop drops off the onboard Wi-Fi. Set it to 'Always keep connected' if you do not want to be asked each time; with 'Always disconnect', the tunnel ends, and traffic can then leave outside it when the network comes back.

On Windows, a running tunnel also blocks traffic outside it, so while the tunnel waits through a gap, the laptop's traffic is blocked rather than sent outside the tunnel. The block lifts when you disconnect or pause, and briefly while the app changes server location or restarts a stalled tunnel.

Many onboard services show a sign-in page before they forward any traffic, and the registration usually lasts for one journey. Changing trains can mean a new network with its own page, and on some services the page returns partway through a journey.

A page that has not been completed blocks the tunnel, and a running tunnel can block the page. Join the onboard network with the VPN off, complete the page, load an ordinary site to confirm that traffic flows, and then connect.

On iPhone and iPad with Auto-Connect on, WrapVPN connects when the device joins the train's Wi-Fi. Pause it for 5, 15 or 30 minutes by pressing and holding the switch, complete the page, and the tunnel returns when the pause ends. Disconnecting leaves Auto-Connect's Wi-Fi rule in place, so iOS can start the tunnel again; turn Auto-Connect off first if you want to stay disconnected.

On Android and Windows, a tunnel still running from the previous train can stand between the device and the new page in the same way, and on Windows the firewall rules of a running tunnel block the page's traffic outside it. Disconnect or pause, complete the page, then connect again.

Station Wi-Fi is a different network again, with its own name, often its own sign-in page and usually a fixed connection to the internet rather than a mobile one. A device that has joined it before can switch to it while the train stands at a platform, which can put the tunnel behind a page that has not been completed. Forget station networks after use, or turn off automatic joining for them, so that the device stays on the network you chose.

Every passenger on the onboard network shares the few mobile connections the router holds, and those connections share each mast with everyone else nearby. A full train at a busy time of day divides that capacity among more devices, and each device's share falls accordingly.

Some onboard services also cap the data each device may use in a journey, or slow a device that uses more than a set amount. Those limits follow the device whether or not its traffic is in a tunnel, and the tunnel adds a small overhead of its own to every packet.

Postpone photo and file backups until you reach a fixed connection, and leave large downloads for the station or the hotel.

A hotspot from your own phone avoids the onboard sign-in page and the train's shared capacity, and on some stretches your own operator covers the line better than the train's. It uses your data allowance and the phone's battery, and inside the carriage the phone's signal can be weaker than the signal reaching the roof antennas.

A laptop on the phone's hotspot sends its traffic through the phone's mobile connection, where the operator can see which hosts it contacts. A VPN on the phone is set up for the phone's own traffic and should not be relied on to cover the laptop. Run WrapVPN on the laptop as well, so that the operator sees an encrypted stream from each device instead.

One account covers both, since no plan has a device limit. On the free plan, if the phone connected first, the laptop joins the hour already running rather than taking another of the week's three sessions.

The onboard router's traffic enters the internet through the mobile networks along the line, so the nearest exit server is usually the one closest to where the train is, not to where it is going. Some lines stay close to one exit from end to end: Gothenburg is 400 km from Stockholm and Malmö 510 km, Manchester is 260 km from London and Edinburgh 530 km, and Seville and Barcelona are 390 km and 510 km from Madrid. Each of those distances gives a round-trip floor of about 5 ms or less.

On a journey that crosses a border, the nearest exit can change on the way. A journey from Madrid to Paris starts beside the Madrid exit, but Paris is 1,050 km from Madrid and 340 km from London. Choose the exit for the stretch where you will use the connection most. If you change, do it at a station stop rather than before a railway tunnel, because changing location replaces the connection and needs a working network to complete.

After a border, the train's router may roam on the next country's networks, and roaming data is commonly routed back to the home operator, so the internet can still see the train in the country it left. Measure rather than assume: with the tunnel disconnected, reopen the app on a phone or tablet or use 'Refresh' on Windows, and compare the exits on either side of the border.