Why does university wifi block my VPN, and what actually gets through?

If your VPN connects fine at home and stalls, loops or refuses to connect on university wifi, the network is almost certainly not "down". It is recognising the VPN's traffic pattern, or the VPN provider's address, and dropping it. That is a deliberate filter, and it is usually one of three kinds. Knowing which one you are facing decides what will work.

This is written for adult students on a campus or residence network that filters what you can reach. The short pitch is on the school wifi page. Here is the mechanism.

The filters you are probably hitting

1. Port blocking. The oldest and dumbest filter. The network allows web traffic on ports 80 and 443 and drops almost everything else. OpenVPN on its default port and WireGuard's default UDP port both die here. Fix: a VPN that can run over port 443.

2. IP-list blocking. The network keeps a list of addresses that belong to known VPN providers and drops them. Your handshake never gets an answer. Popular providers get on these lists first because list vendors scrape their server addresses. Fix: a transport that does not look like a VPN at the address it talks to.

3. Deep packet inspection (DPI). The network looks at the shape of the traffic itself. WireGuard's handshake starts with a recognisable fixed-format message, and OpenVPN's opening exchange is also distinctive. A DPI box can match that and cut the connection, which is why a VPN may connect and then die ten minutes in. The WireGuard protocol page documents the handshake messages if you want to see what is on the wire.

4. SNI filtering. When your browser opens an HTTPS connection, the name of the site you want is sent in the clear in the first message, in a field called the Server Name Indication (Cloudflare explains it well). A network can read that field and block by name without decrypting anything. A VPN that hides inside a connection to a different, innocent-looking site gets past it.

A quick way to tell which one you have

Connects, then stalls after a few minutes: likely DPI.
Never connects at all, on any server of that provider: likely IP-list or port blocking.
Works on mobile data, not on campus wifi: it is the network, not your app.
Some sites fail by name while others load: likely SNI filtering.

What tends to work

Ordinary VPN protocols are what these filters are built to catch. What gets through is traffic that looks like something else. Pangea ships five such transports and tries them in order: VLESS + Reality (borrows a real site's TLS handshake), Cloak (TLS aimed at a decoy site), Shadowsocks (no TLS at all, so a TLS-only block misses it), Hysteria2 (UDP and QUIC, useful when TCP is being killed), and NaiveProxy (real Chromium TLS and HTTP/2). The app moves down the list when one is blocked.

The honest limits: a captive portal that wants a login before anything works still needs that login first, a full network shutdown stops everything, and a network that blocks the exact address of the Pangea hub will stop a connection until another route is found. No VPN can promise it beats every filter forever.

The connection is 256-bit encrypted, the desktop app (Windows and macOS) generates your keys on your device, and the client is GPLv3, so you can read what it does instead of trusting us. We are not third-party audited. The warrant canary is how you can watch for us going quiet.

Price and trial

£5.49 a month or £27.99 a year, with a 30-day money-back guarantee. The five-day free trial needs a card and auto-renews unless you switch it off in Billing, so set a reminder.

To try it on the network that has been blocking you, see pricing.