You connect to the hotel Wi-Fi, flip on your VPN — and nothing. The app spins on “connecting” forever, or connects and immediately drops. Airport lounges, university campuses, some airlines’ in-flight Wi-Fi, and plenty of corporate guest networks do the same thing. The network isn’t broken; it’s actively identifying and blocking VPN traffic. Here’s why that happens and how obfuscation gets you through.
Why networks can see your VPN at all
Standard VPN protocols — OpenVPN, WireGuard, IKEv2 — encrypt your data, but the traffic itself has a recognizable shape. Networks running deep packet inspection (DPI) can fingerprint that shape and drop the connection, no decryption needed. This is common enough that VPN providers build entire features around it. Proton’s team put it plainly when launching their Stealth protocol:
“Most VPN protocols produce traffic that’s identifiable as VPN traffic. Networks running deep packet inspection can spot it and block or throttle the connection, which is why VPNs stop working on some school and workplace networks.” — Proton VPN team, official community post. A separate August 2026 thread on r/VPN: “My uni has banned all VPNs — even browser extensions don’t work.”
The fix: make VPN traffic look like ordinary HTTPS
Obfuscation wraps your VPN tunnel so it resembles a normal secure web session — the same kind of traffic every hotel guest generates constantly. DPI sees “someone browsing a website,” not “someone on a VPN.” Each provider names it differently:
| Provider | Feature name | Where to find it |
|---|---|---|
| NordVPN | Obfuscated Servers | Settings → Connection → VPN protocol: OpenVPN (TCP) → “Obfuscated Servers” appears in the server list |
| Surfshark | Camouflage Mode | Automatic whenever protocol is set to OpenVPN |
| Proton VPN | Stealth | Settings → Protocol → Stealth |
Step-by-step (NordVPN example)
- Open the app and tap the gear icon (Settings) in the bottom-right (mobile) or left sidebar (desktop).
- Go to Connection → VPN protocol and select OpenVPN (TCP) — obfuscated servers only run on this protocol.
- Return to the main screen: a new “Obfuscated Servers” category now appears in the specialty server list. Connect to one.
- If it still fails, try port 443 in advanced settings — that’s the standard HTTPS port, which networks can’t block without breaking all web browsing.
What to expect: the speed trade-off
Obfuscation costs speed — it adds a disguise layer on top of encryption. As Proton’s engineers describe it: “For everyday use where nothing is being blocked, WireGuard will still be faster, while Stealth trades some speed for undetectability.” With typical VPN overhead already around 15–20%, expect obfuscated connections to land somewhat below that. On hotel Wi-Fi that’s usually irrelevant — the venue’s bandwidth is the bottleneck anyway.
So the practical rule: run WireGuard by default, switch to obfuscation only when a network blocks you. For choosing servers once you’re through, see how to choose a VPN server.
💡 Before you pay — obfuscation support varies by platform (some providers ship it on desktop but not iOS). If bypassing restrictive networks is your main use case, verify it on your device inside the 30-day money-back window: connect from a coffee shop or workplace guest network that previously blocked you. If it can’t get through, refund and try the next provider. Pricing structures are compared in our 2026 price comparison.
Related reading
For the security case for using a VPN on shared networks in the first place, see public Wi-Fi & travel VPN guide. If your VPN connects but drops repeatedly, that’s a different failure mode — start with VPN keeps disconnecting.
This guide aggregates publicly available vendor documentation and user reports from global IT communities. Some networks prohibit VPN use in their acceptable-use policies; using obfuscation does not exempt you from rules you’ve agreed to. Check local laws and network policies where applicable.