Using a VPN on hotel Wi-Fi: what goes wrong and what to do

Hotel Wi-Fi is the network most likely to make a VPN look broken, for reasons that have nothing to do with the app. A sign-in page sits in front of everything until you accept it, the network is often set up to allow only web traffic, and it is shared with every other guest. A VPN is worth using there, but it has to be connected in the right order: accept the hotel's page first, then connect, and let the app work through its connection methods if the first one does not answer.

The sign-in page comes first

Almost every hotel uses a captive portal: a web page asking for your room number and surname, or just a tick box, before it lets any traffic through. Until you accept it, the network answers every request with that page, and a VPN cannot connect to anything.

Android usually notices and shows a "sign in to network" notification. Tap it, accept the page, and only then connect the VPN. If you are using Android's "Block connections without VPN" setting, it can stop the portal from loading at all, because the portal is exactly the kind of outside-the-tunnel connection that setting exists to block; switch it off for a moment, accept the page, and switch it back on. The captive portal post explains this in detail.

Hotels also expire the sign-in after a day, or after the phone has been asleep for a while. If a VPN that was working stops the next morning, the portal is the first thing to check.

Why hotels filter traffic

Hotel networks are built to keep a lot of guests online with as little support as possible. The common way to do that is to allow the traffic a web browser needs, mainly TCP on ports 80 and 443, and to drop or rate-limit the rest. That policy is aimed at load and abuse, not at you, but it lands on a VPN hard, because the quickest VPN protocol, WireGuard, runs over UDP.

The result is a familiar pattern. The app says connecting, the handshake goes out on UDP and never gets an answer, and after a while it either gives up or looks connected while nothing loads. Which of those you see depends entirely on how the app is built.

What a well-built app does

The useful behaviour is to try several connection methods in order and keep the one that carries traffic:

1. WireGuard over UDP, on more than one port, because some networks allow UDP on port 443 while dropping it elsewhere.
2. A TLS-wrapped transport on TCP port 443, which to the hotel's equipment looks like an ordinary HTTPS connection to a web server.
3. IKEv2, as a final attempt on networks where the earlier methods failed for an unusual reason.

Each attempt has a short budget so that a method that cannot work on this network fails quickly. On a hotel that only allows web traffic, the second method is usually the one that sticks. It is slower than WireGuard, because a TCP transport has to handle packet loss more carefully, but on hotel bandwidth that difference is rarely the bottleneck. The post on networks that drop UDP covers what changes.

What the hotel can see, with and without a VPN

The third row is worth remembering. Nothing a VPN does can hide the fact that your phone joined the hotel network and accepted its terms. What it hides is everything after that.

A short order of operations

1. Join the network the hotel names on its card or at reception.
2. Accept the sign-in page in a browser or from the Android notification.
3. If "Block connections without VPN" is on and the page will not load, turn it off briefly, accept the page, turn it back on.
4. Connect the VPN and give it a minute; if the first method does not answer, the app should move on by itself.
5. If nothing connects at all, check that a plain web page loads without the VPN. If it does not, the portal has expired or the hotel's connection is down, and no VPN setting will help.

If a plain page loads and the VPN still cannot connect after working through its methods, the hotel has chosen to carry no VPN traffic on its network. The post on Wi-Fi that blocks VPN connections covers what is left, which is mainly mobile data.

Should you bother

Yes, for the same reasons as any shared network. A hotel network is used by hundreds of strangers, run by a contractor you will never meet, and kept for years without much maintenance. A VPN turns your traffic into one stream that neither the equipment nor the other guests can read. It also means the sites you use see the VPN server's address rather than the hotel's, which stops them from treating you as a new device in an unfamiliar place every night.

Culvert VPN handles hotel networks by trying WireGuard first and then a TLS transport on port 443 automatically, so a network that only allows web traffic still connects without you changing a setting, and it is on Google Play.