Culvert VPNPublic Wi-Fi risks in plain English
Public Wi-Fi is run by someone else and shared with strangers. Here is what that actually exposes, what HTTPS already covers, and where a VPN helps.
Public and restrictive Wi-Fi
Public Wi-Fi is where a VPN earns its keep, and also where it most often fails to connect. These guides cover the real risks of shared networks, captive portals, and what a well-built app does when a hotel or campus network filters ports or blocks common VPN protocols.
12 guides · RSS
Using a VPN on hotel Wi-Fi: what goes wrong and what to do
Hotel Wi-Fi puts a sign-in page in front of everything and often filters ports. Here is why a VPN struggles there, and the order to fix it in.
VPN on university and campus Wi-Fi
Campus Wi-Fi is a managed network that often filters ports and sometimes blocks VPN protocols. What the university can see, and how a VPN connects there.
Using a VPN on office Wi-Fi
Office Wi-Fi is monitored, filtered and covered by a policy you signed. What IT can see, when a personal VPN is appropriate, and how it connects there.
Airport and café Wi-Fi: is a VPN enough?
A VPN covers most of what airport and café Wi-Fi exposes, but not the sign-in page, a fake hotspot or a phishing screen. What it does and does not do.
Why the VPN won't connect until you accept the Wi-Fi terms
A captive portal holds all traffic until its sign-in page is accepted, so no VPN can connect first. How to get the page to load, even with Always-on VPN.
The Wi-Fi blocks VPN connections. What now?
First tell a filtered network from a sign-in page or a dead connection. Then let the app try its other methods, and know when mobile data is the answer.
Why VPN apps try port 443
Port 443 is where HTTPS lives, so nearly every network allows it. That is why VPN apps try it, over UDP first and then wrapped in TLS over TCP.
When a network drops UDP, and what a VPN can do about it
Many guest networks drop UDP, and WireGuard runs on UDP, so the handshake goes unanswered. A good app falls back to a TLS transport on TCP 443 by itself.
Fake hotspots, and how a VPN helps
An evil twin is a hotspot named like the real one so phones join it. What its owner can see, what a VPN protects once connected, and what it cannot.
Online banking on public Wi-Fi: VPN or not?
Banking apps already encrypt the session, so a VPN adds privacy from the network, not security. When to use one, and when to exclude the bank app.
Phone hotspot or public Wi-Fi: which is safer?
A phone hotspot is usually safer than public Wi-Fi: you control it and the carrier link is encrypted per device. When to use each, and where a VPN fits.