Why Does School Wifi Block VPNs and Discord?

Because the filter isn't reading what you do. It is reading what your traffic looks like. School networks sort connections into categories such as proxy/anonymiser, gaming and streaming, then block whole categories at once. A VPN lands in the anonymiser bucket by its handshake, and Discord voice usually dies to a UDP block.

If you only want something that connects, Pangea's VPN for school wifi page covers what we built for it. The rest of this post is about why the block happens.

Schools are told to block VPNs

This isn't an IT department being difficult. In the US, the Children's Internet Protection Act makes web filtering a condition of E-rate funding for school internet access, as the FCC's CIPA guide explains. In England, the Department for Education's filtering and monitoring standards go further and tell schools to block "technologies and techniques that allow users to get around the filtering, such as VPNs, proxy services and end-to-end encryption methods".

So the VPN block is usually on purpose. Discord is often collateral damage.

Category filtering catches things it was never aimed at

The products schools buy, Lightspeed, GoGuardian, Securly and Smoothwall among them, don't keep a hand-made list of banned websites. They classify traffic into categories and block a category in one go. Anything that shares a tag with something the filter was built to stop gets swept in with it, even if nobody at the school ever looked at it.

That is why a VPN gets flagged under "proxy/anonymiser" whatever you are using it for. The filter isn't judging intent. It is matching a label.

What the network actually sees

A normal VPN connection has a shape. Even encrypted, its handshake, packet sizes and timing can mark it as VPN traffic before any of your browsing is visible. Deep packet inspection doesn't need to decrypt anything. It only needs to recognise the pattern, the same way it recognises a video call or a torrent client by behaviour rather than by name. OpenVPN has a recognisable handshake, and WireGuard's packets are structurally predictable even when encrypted.

The second mechanism is SNI filtering. Every HTTPS connection announces the hostname it wants in plain text, in the first packet of the TLS handshake. A filter reading that one field can block a site, or a VPN provider's domain, without decrypting anything else. Cloudflare's write-up on Encrypted Client Hello explains why that field is visible and what closing it involves.

How far this reaches on school-issued devices is documented in the EFF's report on school-issued devices and student privacy. The filtering stack sees far more than a blocklist suggests.

Why Discord chat works but voice doesn't

Discord's text chat is ordinary HTTPS over TCP port 443, which almost every network allows. Its voice traffic runs over UDP, and plenty of school and campus networks block outbound UDP apart from a short allowlist such as DNS. So messages arrive and calls never connect. That is a port rule, not anything Discord-specific.

What actually gets through

Traffic that doesn't look unusual: ordinary HTTPS to an ordinary site. Pangea ships five transports and tries them in order until one connects:

• VLESS + REALITY borrows a real website's TLS handshake, so a filter reading the SNI field sees a genuine site, not a VPN.
• Cloak wraps the connection in what looks like a visit to a decoy cover site.
• Shadowsocks skips TLS altogether, so a filter hunting for TLS-shaped VPN traffic has nothing to match.
• Hysteria2 runs over QUIC on UDP, for networks that kill TCP-based VPN protocols but leave UDP alone.
• NaiveProxy mimics Chromium's TLS and HTTP/2, matching an ordinary browser's fingerprint.

Five exist because different filtering products look for different fingerprints, and what gets caught on one network goes straight through on another. The client is GPLv3 and on GitHub, so what it sends is something you can check.

What it won't fix

A network that blocks the VPN server's address outright, or one that only allows a fixed list of destinations, can still stop a connection. Stealth transports change what a filter sees. They don't make you invisible.

A captive portal that wants your student login before any traffic leaves the building is a gate you pass, not a filter you route around. And on a laptop or Chromebook the school owns, monitoring software sits on the device itself, so it sees what you do whatever the network sees.

Whether you should is a separate question. Most schools' acceptable use policies forbid getting around the filter, and a VPN doesn't change what happens if you break that policy.

Pangea runs on Windows and macOS, with iPhone through Shadowrocket. The school wifi page has the details, and the first card payment comes with a 30-day money-back guarantee if your network turns out to be the exception.