Why the VPN won't connect until you accept the Wi-Fi terms

A captive portal is the sign-in page a hotel, airport, café or campus puts in front of its Wi-Fi. Until you accept it, the network blocks every connection to the internet and answers web requests with that page instead. A VPN's first packet is one of the connections being blocked, so no VPN can connect before the portal is accepted. On Android there is one extra wrinkle: the "Block connections without VPN" setting can stop the portal page from loading at all, so it may need to be switched off for a moment.

How a captive portal works

When your phone joins the network, it gets an address and a DNS server like normal. What it does not get is a route to the internet. The network's gateway holds a list of devices that have accepted the terms, and for everything else it does two things: it drops most traffic, and it redirects web requests to the sign-in page.

Android checks for this automatically. Shortly after joining, it fetches a known small page from a Google server and looks at the response. If it gets the page back, the network is open. If it gets something else, usually the portal's own page, Android marks the network as needing sign-in and shows a "sign in to network" notification. Tapping it opens the portal in a small browser window.

The portal itself is an ordinary web page. It may ask for a room number, an email, a tick in a box, or nothing but a button. When you accept, the gateway adds your phone's address to its list and starts passing traffic.

Why the VPN cannot go first

A VPN connects by sending a handshake to its server: a UDP packet for WireGuard, or a TCP connection for a TLS-wrapped transport. On a network waiting for portal sign-in, that packet goes to the gateway and is dropped. There is no error, just silence, and the app sits at "connecting" until its attempt times out.

The VPN cannot answer the portal on your behalf either. The page is controlled by the network operator, it changes from venue to venue, and it exists to record a human agreeing to terms. An app pretending to be that human would be both unreliable and the wrong thing to do.

So the order is fixed: join, accept the portal, then connect the VPN. The hotel Wi-Fi post shows what this looks like in the most common setting.

The Always-on VPN complication

Android's Always-on VPN has a second option, "Block connections without VPN", which is Android's built-in kill switch. When it is on, any connection that does not go through the VPN tunnel is refused. That is exactly what you want on a shared network, and it is exactly what stops the captive portal from loading, because the portal page is a connection outside the tunnel to a server the network chose.

The symptom is a "sign in to network" notification that opens a blank page, or a browser that says the site cannot be reached, while the VPN itself stays at "connecting" because the portal has not been accepted. Each side is waiting for the other.

The fix is short:

1. Open Android Settings, go to Network & internet, then VPN, and tap the settings icon next to your VPN app.
2. Turn off "Block connections without VPN". Leave "Always-on VPN" as it is if you like.
3. Tap the "sign in to network" notification, or open a browser and load any plain http page, and accept the portal.
4. Turn "Block connections without VPN" back on.
5. Connect the VPN, or let Always-on do it.

Between steps two and four, traffic is outside the tunnel on a network you do not control, which is why the window should be short and should contain nothing but the portal. Do not open email or a banking app until step five is done. The Block connections without VPN post covers what the setting does the rest of the time.

When the portal does not appear at all

Sometimes Android does not show the notification, usually because the portal's redirect only catches plain http and every page you try is https. Open a browser and type a plain address such as http://example.com. That request cannot be encrypted, so the gateway can redirect it to the sign-in page.

If even that does not bring up the portal, check the basics: the network name matches what the venue says, the phone has an IP address (visible under the network's details in Wi-Fi settings), and the venue's connection is actually up. A portal that never loads is more often a broken network than a VPN problem.

Portals expire

Most portals grant access for a set period, or until your phone has been away from the network long enough to be forgotten. A VPN that worked all afternoon and refuses to connect the next morning is nearly always a lapsed portal. The tell is that nothing else loads either. Reopen the portal, accept it again, and the VPN will connect.

The VPN not connecting checklist puts this in order with the other causes, but on any network with a sign-in page it is the first thing to try.

Culvert VPN uses Android's own "Block connections without VPN" rather than an in-app switch, so its Settings screen shows you the real state of that setting and links straight to it, which makes the brief toggle for a captive portal a two-tap job, on Google Play.