Start with the hotspot sign-in
If a VPN will not connect on public Wi-Fi, first check whether the Wi-Fi network itself has finished connecting you to the internet. Hotels, airports, cafés, libraries, and conference venues often use a captive portal: a sign-in page, terms-of-use screen, room-number form, or access code that appears before normal internet access is allowed. Until that step is complete, the VPN app may be unable to reach its server, even though your device shows that it is connected to Wi-Fi.
Temporarily disconnect the VPN, open a browser, and visit a plain HTTP page or the venue’s Wi-Fi sign-in page if one is provided. Follow only the instructions displayed by the network operator. If the portal asks you to accept terms, enter a room number, or use a venue-issued code, complete that step and wait for the confirmation page. Then open a few ordinary websites to check that the underlying connection works before starting the VPN again.
A browser may keep displaying a previously loaded page, so a familiar tab is not a reliable test. Refresh it, or open a new tab and load a site you have not recently visited. If the portal never appears, try forgetting and rejoining the Wi-Fi network, or ask venue staff whether a separate login is required. Do not enter payment details or personal information into a portal unless you have verified that it belongs to the venue.
Check what the error is telling you
Before changing settings, note the exact message shown by the client and when it appears. “Authentication failed,” “server unavailable,” and “connecting” followed by a timeout point to different parts of the connection process. A password or subscription problem is not fixed by changing Wi-Fi networks, while a portal block is unlikely to be fixed by repeatedly entering account credentials.
Check whether other apps and websites work with the VPN turned off. If they do not, the underlying Wi-Fi may still require sign-in, may have lost its internet connection, or may restrict access. If websites work without the VPN but the VPN cannot connect, focus on the VPN app, its permissions, the selected server, and whether the network permits that connection type.
Write down the network name, device type, operating system version, VPN client version, selected server or region, connection protocol if the app displays it, and the time of the failure. This information makes it easier to compare a failed attempt with a later successful one. Avoid posting account credentials, subscription links, or private network details in a public forum.
Bottom line: Establish whether the problem is the Wi-Fi itself or the VPN tunnel before changing multiple settings. One controlled change at a time makes the cause easier to identify.
Review app permissions and device settings
A VPN client needs permission to create or manage a VPN connection on the device. If a permission prompt was dismissed, the operating system may prevent the app from starting a tunnel. Open the device’s settings and look for its VPN, network, or connection controls. Confirm that the client is allowed to add a VPN configuration and that the operating system has not disabled it through a restriction, work profile, parental control, or device-management policy.
On phones, check whether the operating system has enabled an always-on VPN, a lockdown option, or a separate VPN profile that conflicts with the client you are trying to use. On computers, look for another VPN client, security product, or proxy setting that may be taking control of network traffic. Do not remove a work or school profile without checking with its administrator; it may enforce settings that are required for that device.
Close and reopen the VPN app after reviewing permissions. If it still does not connect, restart the device when practical, then try again on the same Wi-Fi. Restarting clears some temporary network and app state, but it does not fix a captive portal that has not been completed or a network policy that blocks the connection.
Also check the device’s date and time. Incorrect system time can interfere with certificate validation and secure connection setup. Set the clock automatically if that option is available, then retry. If the device displays a certificate warning, do not bypass it simply to make the connection proceed. A warning can indicate a configuration or security problem that needs investigation.
- ✅ Allow the VPN client to add or use a VPN configuration.
- ✅ Check for another VPN, proxy, or managed network profile that may conflict.
- ✅ Confirm the device date and time are correct.
- ❌ Do not disable security warnings or install an unknown configuration to get online.
Try a different connection protocol
Some public networks permit ordinary web browsing but restrict particular types of VPN traffic. They may block certain ports, limit unfamiliar encrypted connections, or require traffic to pass through a web sign-in before other connections are allowed. If the captive portal is complete and the app still cannot connect, a different protocol offered by the official client may work better on that network.
Protocol names describe connection methods, not a guarantee that one option will work everywhere. A network may permit one transport and interfere with another. If your client offers an automatic setting, try it first. Otherwise, change one protocol option, reconnect, and note the result. If the client offers several choices, return to the original setting before trying another so you can tell which change mattered.
Do not copy protocol settings from an unrelated guide without checking that they match your service and client. Shadowsocks, VMess, Trojan, Hysteria2, and WireGuard are not interchangeable labels for the same configuration; support depends on the provider and the particular client profile. A third-party client such as Clash Verge, sing-box, or Shadowrocket can also expose different modes and options. Import a subscription using the provider’s documented method, and avoid manually editing server details unless you know exactly what each field does.
Some clients can use a system proxy, while others can route traffic through a virtual network interface such as TUN. Those modes cover traffic differently. A system-proxy setup may route supported applications but leave other apps outside the tunnel. TUN mode can route a broader range of device traffic, but it also depends on operating-system permissions and may interact with other network tools. When troubleshooting, use the mode recommended by the client’s documentation rather than enabling several routing methods at once.
| What you observe | What to check first | A reasonable next step |
|---|---|---|
| Wi-Fi connects, but websites do not load | Captive portal, access code, or venue internet outage | Disconnect the VPN, complete the venue sign-in, and test browsing again |
| Websites work, but the VPN times out | VPN permissions, selected server, and network restrictions | Try an available alternate protocol or a different server |
| The client reports an authorization error | Account status, imported profile, or sign-in details | Refresh the official configuration or contact the provider |
| Only some apps use the VPN | System proxy, rule-based routing, or TUN mode | Check the client’s routing mode and the affected app’s network settings |
Switch servers and test the network
If the app is configured correctly but one server will not connect, try another server or region that is available in your subscription. A particular route may be undergoing maintenance, may be temporarily unreachable from that hotspot, or may be affected by congestion. Switching servers is a useful test, but it cannot prove that the original server is broken or that the new one will always work better.
Make only one change at a time: select another server while keeping the protocol and client mode unchanged, then attempt a connection. If that works, record the server and the network where it worked. If it does not, return to the previous selection before changing another setting. Repeatedly switching servers, protocols, and routing modes together makes it difficult to identify which part of the setup is responsible.
Compare the same device on another network when possible, such as a mobile data connection or a trusted home network. If the VPN connects elsewhere but not on the public hotspot, that points toward the hotspot’s sign-in process or network restrictions. If it fails on multiple networks, check the account, app version, subscription configuration, and service status instead. If the hotspot is managed by an employer, school, or venue, its administrator may intentionally restrict VPN connections.
For travel planning, identify the local network’s access rules before relying on a VPN as your only way to get online. The VPN for China Travel home page can be one starting point for reviewing the service, but no provider or route can guarantee compatibility with every hotel, airport, or public hotspot. Keep a separate way to access essential travel details, such as offline copies of reservations and maps.
Public Wi-Fi can also impose a session limit or disconnect idle devices. If the VPN drops after working, reconnect to the hotspot first and check whether its portal has expired. A client’s kill switch may block internet traffic while the VPN is disconnected; that behavior is intended to prevent traffic from leaving outside the tunnel, but it can make a portal difficult to open. If the client documentation provides a safe way to pause the kill switch for captive-portal sign-in, follow those instructions and re-enable protection immediately afterward. Do not leave the device unprotected on an untrusted network longer than necessary.
Protect yourself while troubleshooting
Getting the VPN connected is only one part of using public Wi-Fi safely. Confirm that websites handling passwords or payments use HTTPS and pay attention to browser security warnings. A VPN does not make a fake login page legitimate, remove tracking from a signed-in account, or protect a device that has been compromised. Check the address before entering credentials, and avoid installing software or certificates offered by an unfamiliar pop-up.
Do not use a venue’s portal through a VPN connection if the portal cannot complete the sign-in, then assume the network is ready. Some portals need an initial direct connection to associate the device with an access session. After completing that step, reconnect the VPN and verify that the VPN client reports a successful connection. If the client shows connected but a browser behaves unexpectedly, check whether the browser is using its own proxy, secure DNS, or another network extension.
When using a shared computer, avoid saving passwords or leaving sensitive sessions open. On your own phone or laptop, keep the operating system and VPN client updated through their official update mechanisms. If the device belongs to an organization, follow its security guidance rather than bypassing managed controls. Public network troubleshooting should not involve disabling endpoint protection or accepting unknown certificates.
For a reliable test, choose a low-risk website first, then check the public IP or DNS behavior using a service you trust. Remember that a browser test only describes the browser’s route. A terminal, game, messaging app, or other program may use different proxy settings or be excluded by rule-based routing. If the affected app matters, test it directly after confirming the browser connection.
Know when to contact support
Contact the VPN provider if the official client continues to fail across more than one network, if the app reports an account or subscription error, or if an imported configuration appears incomplete. Contact the hotspot operator if ordinary browsing is unavailable even after completing the portal, if the access code is rejected, or if the network states that VPN connections are prohibited. These are different responsibilities, so describing the tests you have already performed helps route the issue to the right party.
Include the device and operating system, client name and version, the exact error text, whether the hotspot portal was completed, the selected server or region, the protocol if visible, and whether the same setup works on another network. Provide the time of the attempt and the steps that reproduced the problem. Do not send your account password, payment details, or a full subscription URL through an unsecured public channel. If support needs diagnostic logs, use the provider’s official support process and review the logs for sensitive information before sharing them.
Before reinstalling, check whether the client can refresh its configuration or whether the provider documents a repair procedure. Reinstallation can remove local settings without fixing a hotspot restriction, and an outdated subscription profile may need to be updated through the official account or client workflow. Keep a note of any settings you intentionally changed so you can restore the working setup after troubleshooting.
Bottom line: Complete hotspot sign-in first, verify app permissions, then test one protocol or server change at a time. If the issue follows one network, ask its operator; if it follows your account or client across networks, contact VPN support with reproducible details.
Frequently asked questions
Why does the VPN work after I open a browser?
The Wi-Fi may have required a captive-portal sign-in before allowing general internet traffic. Opening a browser brought up the portal or let you complete its terms or access-code step. Once the hotspot authorized the device, the VPN could reach its server. If the portal session expires, you may need to repeat the sign-in.
Should I turn off the kill switch?
Do not disable it as a general troubleshooting shortcut. A kill switch may block traffic when the VPN is disconnected to prevent it from leaving outside the tunnel. If a captive portal requires direct access, follow the client’s documented process for completing sign-in, then restore the protection setting as soon as the portal is complete.
What if the VPN connects on mobile data but not on public Wi-Fi?
That comparison suggests the public network may require a portal step or restrict the connection method. Complete the hotspot sign-in, check whether its rules permit VPN use, and try an alternate protocol supported by your client. If the network explicitly blocks VPN traffic, contact its operator rather than repeatedly changing unrelated device settings.
Is a connected icon enough to confirm every app is protected?
No. The icon reports the client’s connection state, but system-proxy mode, rule-based routing, and TUN mode can send different traffic through the tunnel. Check the client’s routing configuration and test the specific app you intend to use. A browser’s successful IP check does not necessarily describe the route used by every other program.