Using a VPN on office Wi-Fi

Office Wi-Fi is the most tightly managed network most people use. Everything on it passes through equipment the company owns, the firewall is configured by people whose job is to inspect traffic, and you agreed to an acceptable-use policy when you started. A personal VPN on your own phone hides the contents and destinations of your traffic from that network, and a well-built app connects there even when the firewall filters ports. Whether you should is a question about your employer's rules, not about the technology, so read the policy before the rest of this post.

Whose phone, whose network

The answer changes depending on two things: who owns the phone, and which network it is on.

Your phone on the guest Wi-Fi. This is the simplest case. The guest network is usually separated from the internal one, treated like a café, and covered by a light policy. A personal VPN here is ordinary and usually fine.

Your phone on the internal Wi-Fi. If you were given a login to the staff network, your traffic is inside the company's perimeter, its firewall inspects it, and the policy you signed almost certainly has something to say about it. Some companies allow personal VPNs; some block them at the firewall; some prohibit them in writing.

A company phone on any network. A managed phone may already run the company's own VPN, may be enrolled in device management that installs profiles and reads the app list, and is not really yours to configure. Installing a second VPN can conflict with the first, and Android allows only one VPN at a time. Ask IT before doing anything.

What IT can see

With no VPN, the office firewall sees the name of every server your phone talks to, because DNS lookups and TLS server names travel in the clear, and it can inspect anything sent over plain HTTP. Many corporate networks go further on managed devices and install their own certificate so the firewall can open HTTPS as well. That last step is possible only on a device that trusts the company's certificate, which a personal phone does not.

With a VPN connected, the firewall sees one encrypted stream from your phone to one address. It will almost certainly recognise that as a VPN, because the pattern is obvious and enterprise firewalls categorise traffic for a living. It still knows the phone is yours, since you signed in to the Wi-Fi, and it still sees when you connected and how much data moved. The employer and school post sets out the detail.

So the practical effect is privacy of contents and destinations, not invisibility. If you are hoping a VPN makes it impossible for IT to know you were using one, it does not.

Why the office firewall may not let it connect

Corporate firewalls are typically configured to allow a short list of things and refuse everything else. UDP is often dropped apart from DNS, because most business applications do not need it. Ports other than 80 and 443 are often closed. Some firewalls identify a WireGuard or OpenVPN handshake by its shape and drop it as policy.

A VPN app that tries only one method will sit at "connecting" on such a network. An app built for filtered networks tries several in order and keeps the one that works: WireGuard over UDP on more than one port, then a TLS-wrapped transport on TCP port 443 that the firewall handles like any HTTPS connection, then IKEv2 as a last attempt. On an office network the TCP 443 transport is usually the one that carries traffic. The post on Wi-Fi that blocks VPN connections covers what to check when even that does not connect.

If the firewall is configured to block VPNs and the policy says the same, take that as the answer. Mobile data is the right place for personal traffic in an office that has chosen not to carry it.

Work apps and the local network

Several things at the office assume you are on the office network: printers, an intranet, a file server, a video system that pairs with the meeting-room screen. With a personal VPN connected, your traffic leaves from the VPN server, and those services either cannot be reached or refuse you as an outside address.

The fix is an exclude list. Android lets a VPN app leave chosen apps outside the tunnel, so the printing app or the intranet browser talks to the local network directly while everything else stays inside. The post on split tunnelling on Android explains how the exclude list works and why an exclude list is safer than an allow list.

A simple rule for the office

Culvert VPN keeps the exclude list simple, so a printer or intranet app can stay on the office network while the rest of the phone stays inside the tunnel, and it connects on filtered networks by trying several methods in order, on Google Play.