Step 1: finish the captive portal with protection off
NordVPN's steps: turn off Auto-connect, turn off Kill Switch, disconnect, join the Wi-Fi, and complete the login in a browser. If the page does not appear, open a plain http:// address rather than https://, or forget and rejoin the network. Reconnect and re-enable both afterwards. [1]
On a GL.iNet travel router, the equivalent is to disable VPN connections and AdGuard Home during the login, and on firmware v4.6 and later you can enable Auto-Enable Login Mode for Public Hotspots. If the portal still will not load, GL.iNet suggests turning off DNS Rebinding Attack Protection, setting DNS to Automatic, cloning your phone's MAC address, or asking staff to whitelist the router. [8]
Step 2: change the protocol
If the login worked but the VPN will not connect, the network may be blocking the protocol rather than all VPN traffic. Proton's advice is simple: if you cannot connect using one protocol, try another. Smart Protocol, on by default in supported apps, selects a protocol automatically. [4][5]
Proton notes that standard WireGuard usually runs over a specific UDP port, which makes it easy to block, and that WireGuard TCP and OpenVPN TCP offer anti-censorship benefits. Proton apps offer WireGuard TCP on Windows, macOS, Android, iOS and Android TV, and Proton's manual OpenVPN TCP configuration files use port 443. [7][4][6]
| Try in this order | Proton VPN | NordVPN |
|---|---|---|
| Automatic selection | Smart Protocol (default) | Protocol set to Auto |
| Disguised VPN traffic | Stealth (Windows, macOS, Android, iOS, Android TV) | NordWhisper with Obfuscated servers |
| TCP fallback | WireGuard TCP; OpenVPN TCP on port 443 for manual configs | OpenVPN (TCP) |
| Other | Proton Protocols beta | Manual IKEv2 setup |
Step 3: use the anti-blocking features
Proton says Stealth is designed to bypass internet blocks by hiding your VPN connection and can be particularly effective if someone is actively trying to block VPN connections. [4][5]
NordVPN's steps for restrictive networks start with switching to NordWhisper, then connecting to the Obfuscated server category, which only appears when the protocol is set to Auto or NordWhisper. Next come OpenVPN TCP, a network reset, and a manual IKEv2 connection. NordVPN also says to keep the app updated because server and protocol support improves with newer versions. [2][3]
These features live in the apps. Proton lists Stealth as not available for router configurations, and NordVPN's obfuscated-server instructions cover only its apps. If your travel router tunnel is blocked, run the app on a laptop or phone instead. [9][3]
Step 4: check the clock, firewall and proxy
- Clock: Proton says a wrong system time can stop you signing in. Set time and time zone automatically after landing. [5]
- Firewall or antivirus: Proton suggests turning the firewall off briefly to test, then turning it back on and allowing the app both incoming and outgoing connections. [5]
- Plan status: Proton says an expired paid plan moves the account to Free, which only includes free servers; check your account if premium servers stop connecting. [5]
- Server: Proton notes servers sometimes go offline for maintenance, so try a different server or country before giving up on a protocol. [5]
Symptom to next step
Use this table when you are standing in a lobby with a laptop that will not connect.
| Symptom | Likely cause | Next step |
|---|---|---|
| No internet at all, VPN on | Portal not completed, kill switch blocking | Step 1 with VPN, Auto-connect and kill switch off [1] |
| Internet works, VPN times out | UDP or VPN port blocked | Switch to TCP or Stealth or NordWhisper [2][4] |
| Sign-in error in the app | Device clock wrong or plan expired | Fix the clock, check the account [5] |
| Router tunnel fails, phone app works | Network blocks the router protocol | Use the app with Stealth or obfuscation [3][9] |
| Everything fails, every protocol | Network blocks VPN traffic outright | Use mobile data or tethering for sensitive work |
When the network blocks VPNs outright
Proton cautions that deep packet inspection can distinguish VPN packets from ordinary HTTPS, so even TCP variants are not guaranteed to pass. If every protocol fails after the portal is complete, the network is probably blocking VPN traffic. [7]
At that point, do sensitive work over mobile data, through phone tethering, or wait for another network. Respect the venue terms; some networks block VPNs on purpose, and these steps are for getting a legitimate connection working, not for evading a policy you agreed to.
Questions before you decide
Which protocol should I try when hotel Wi-Fi blocks my VPN?
Proton says to try another protocol and that Stealth can be particularly effective when someone is actively blocking VPN connections. NordVPN suggests switching to NordWhisper and its obfuscated servers, then OpenVPN TCP, which it calls more resilient against blocks than UDP.
Can a wrong clock stop a VPN from connecting?
Proton says that if your system time is not set correctly you might be unable to sign in to Proton VPN, and lists where to correct the clock on Windows, macOS, Linux and Chromebook.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- NordVPN Help Center: How to log in to a captive portal Wi-Fi network while using NordVPN Accessed 30 Oct 2026
- NordVPN Help Center: Troubleshooting VPN connection in a country with internet restrictions Accessed 30 Oct 2026
- NordVPN Help Center: How to connect and disconnect from obfuscated servers Accessed 30 Oct 2026
- Proton VPN: Change your VPN protocol Accessed 30 Oct 2026
- Proton VPN: How to fix common VPN connection problems Accessed 30 Oct 2026
- Proton VPN: How to download OpenVPN configuration files Accessed 30 Oct 2026
- Proton VPN blog: What is WireGuard? Accessed 30 Oct 2026
- GL.iNet Router Docs 4: Connect to public hotspot with Captive Portal Accessed 30 Oct 2026
- Proton VPN: Product lifecycle stages (feature availability by platform) Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.