Everyday Privacy

VPN Blocked on Wi-Fi? Why It Happens and What Works

Your VPN connects fine at home, then refuses to work on hotel, school, or office Wi-Fi. That is not a bug. Some networks are built to stop VPNs. Here is how they do it and what you can try.

Last updated October 18, 2026 · By Harbor Privacy

Why Networks Block VPNs

Schools, offices, hotels, airports, and some countries block VPNs for different reasons: to enforce content filters, to keep users on monitored connections, or to follow local rules. A VPN hides your traffic from the network, which is exactly what these networks do not want.

How They Detect and Block a VPN

Blocking ports. The easy way. Standard WireGuard uses UDP 51820 and OpenVPN uses 1194. A firewall that drops those ports stops the VPN cold.
Blocking all UDP. Many networks only allow web traffic over TCP, which breaks WireGuard and IKEv2.
Deep packet inspection. The network looks at the shape of the traffic, not just the port. WireGuard and OpenVPN handshakes have recognizable patterns, so they get cut even on unusual ports.
Blocking VPN server addresses. Lists of known VPN provider IPs are widely shared.

What to Try, In Order

Switch protocolIf WireGuard fails, try OpenVPN or IKEv2. Some networks block one and miss another.

Use a port the network cannot blockPort 443 is the HTTPS port every website uses. Blocking it breaks the web, so networks almost never do.

Use an obfuscated protocolAmneziaWG changes the WireGuard handshake so it no longer matches known patterns.

Use a stealth modeStealth modes wrap the VPN inside what looks like a normal secure website connection, so there is no VPN signature to match.

What a Stealth VPN Mode Is

Stealth modes, such as the Xray protocol with Reality, do not try to look like a VPN at all. They look like an ordinary HTTPS visit to a real website. To a network watching, there is nothing to tell the connection apart from someone reading a page.

Harbor VPN Stealth uses this approach, runs on port 443, and gives every device its own key. It is in beta for Harbor VPN customers. It needs a free third-party app (Streisand or Shadowrocket on iPhone, v2rayNG on Android, Hiddify on desktop). It can work on networks that block standard VPN protocols, but no method works on every network, and we do not promise it will.

Limits: Stealth carries TCP only, so UDP is blocked. Online gaming, game consoles, and apps that depend on UDP for voice or video calls may not work, and WireGuard is the better choice for those. Each device is capped at 30 Mbps.

Use plain DNS, not DoH. DoH servers such as Quad9 and Cloudflare advertise HTTP/3, which runs over UDP. Stealth drops UDP, so a DoH lookup that switches to HTTP/3 hangs and pages stop loading. Leave the app's DNS on plain DNS, which Harbor's filtering resolver answers, or use DoT (port 853), which runs over TCP. If pages still stall, turn off HTTP/3 or QUIC in Safari (Settings, Safari, Advanced, Feature Flags) or in your VPN app.

Check the Rules First

If you are on a school or work network, the block is usually policy. Using a VPN there may break the acceptable-use rules you agreed to, so check before you try to get around it. Public places like hotels and airports are generally fine.

Common Questions

Why does my VPN work at home but not on hotel Wi-Fi?

Hotels often filter ports and block UDP. WireGuard and IKEv2 depend on UDP, so they fail. A protocol that uses TCP on port 443 usually connects.

Can a network tell I am using a VPN?

Often yes. Standard protocols have recognizable handshakes and ports. Stealth modes that imitate normal HTTPS are much harder to pick out.

What is the best VPN protocol for blocked networks?

One that looks like normal web traffic on port 443. Obfuscated options like AmneziaWG and Xray Reality are built for this.

Can I game or make calls over a stealth VPN?

Often not. Harbor VPN Stealth blocks UDP, which most online games and many calling apps use. Switch that device to WireGuard for gaming and calls.

Why do pages stop loading on my stealth VPN?

Usually HTTP/3 (QUIC), which uses UDP, or a DoH DNS setting that switches to it. Stealth modes carry TCP only, so the UDP packets are dropped and the page hangs. Use plain DNS and turn off HTTP/3 or QUIC in your browser or VPN app.

Does a stealth VPN make me anonymous?

No. It hides that you are using a VPN. The VPN still sees your traffic, so choose a provider with a clear no-logs policy.

Is Harbor VPN Stealth available now?

Yes, in beta for Harbor VPN customers. Sign in at vpn.harborprivacy.com, add a device, and choose Stealth.

TRY HARBOR VPN STEALTH

Looks like normal web traffic, runs on port 443, with its own key per device and threat-blocking DNS. In beta now. See Harbor VPN.