Public Wi-Fi VPN: Portal, Coverage, Drop Policy
A VPN changes who can observe your traffic, not whether a hotel portal blocks it. Compare portal handling, app coverage and kill-switch behaviour.
Public Wi-Fi is not a single threat, so a VPN is not a single answer. It hides your traffic from the local network and moves trust to the operator, while HTTPS still protects the browser-to-site leg. The practical failures on hotel and cafe networks are the sign-in page, partial coverage and what happens during a drop. Compare those three before deciding the tunnel is working.
What the Tunnel Adds on an Untrusted Network
On an open network, a nearby observer can see which endpoint you contact and how much traffic flows. A tunnel replaces that view with an encrypted stream to the VPN server and makes the operator a new party to trust. It does not improve the website's own security posture.
HTTPS remains the protection between browser and site, and it must stay on. An HTTP form does not become confidential because one segment crosses a tunnel. A certificate validation warning is a stop sign, not an obstacle to click through.
| Layer | What it protects | What remains visible |
|---|---|---|
| HTTPS | Browser-to-site content | Server name, sizes, timing |
| VPN tunnel | Traffic to the VPN endpoint | VPN use, volume, timing |
| Portal login | Nothing by itself | Details you type at admission |
Finish the Captive Portal First
Hotels and cafes often block ordinary traffic until a portal step completes. The VPN endpoint is ordinary traffic, so the client cannot connect until that step is done. Use the device's own sign-in prompt and confirm the operator matches the venue.
If several similar SSIDs appear, ask staff which one is real. An official-looking name is not identity, and a VPN cannot retract a password typed into a fake page. Some clients intercept portals themselves; if an always-on policy blocks sign-in, follow the client's documented pause procedure and re-enable the tunnel afterwards.
Coverage Depends on the Tunnel, Not the Label
A system VPN can carry most applications, while a browser extension carries only that browser. If public-network coverage is the reason you connected, read the split-tunnel exclusions before assuming everything is inside. The hotspot still sees your device on its network and the traffic to the VPN endpoint. Timing, volume and the details you gave at admission remain visible.
That trade is the point of the tunnel: fewer observers for content, not invisibility. Write down which apps are actually covered.
Decide What Happens When the Tunnel Drops
Roaming between access points or waking the device can interrupt the connection. Automatic reconnection tries to restore the tunnel; a kill switch decides whether direct traffic is allowed in the gap. Manual disconnect, quitting the app and an unexpected failure can follow different rules.
Test those transitions with harmless traffic, and confirm the behaviour you expect rather than the one a marketing page implies. Keep the operating system updated, disable file sharing you do not need, and use the host firewall where it helps.
When the trip ends, delete guest networks you do not want joined automatically. Save a working profile before travelling, because a setup page is useless when the network is the thing that cannot connect.