Why your VPN gets blocked at school

You install NordVPN, it works for a day, then it stops. You try Proton, same thing. A free one from the app store doesn't connect at all. This isn't bad luck — school networks are specifically built to find and block VPNs, and most VPNs make themselves easy to find.

How school filters actually work

Your school doesn't block VPNs by magic. It runs a filtering appliance — Securly, Lightspeed, Smoothwall, Cisco Umbrella, or something similar — sitting between every device and the internet. That box uses four main techniques, roughly in order of how easy they are to beat.

1. Domain and DNS blocking

The simplest layer. The filter keeps a list of known VPN provider domains and refuses to resolve them. This is why you sometimes can't even load nordvpn.com on school WiFi, let alone connect. Commercial filters buy these lists as a subscription and they update constantly, so a new provider gets added within days of becoming popular.

2. IP address blocking

Every big VPN publishes its server IP addresses, or they're easy to collect by signing up and looking. Filter vendors maintain lists of these ranges and block them wholesale. A provider with 5,000 servers looks impressive on the marketing page, but it also means 5,000 known addresses sitting on a blocklist.

3. Port and protocol blocking

OpenVPN and WireGuard have recognisable fingerprints. WireGuard uses UDP and has a distinctive handshake. OpenVPN has a header pattern you can match on. Many schools also simply block all outbound traffic except ports 80 and 443 (normal web traffic), which kills any VPN that needs a different port.

4. Deep packet inspection (DPI)

The serious one. DPI looks inside the connection rather than just at where it's going. Even though your traffic is encrypted, the way a connection starts — the TLS handshake — is not fully hidden. The filter can read the SNI field, which is the domain name your device announces before encryption kicks in, and it can fingerprint the shape and timing of the handshake itself.

This is why "it's encrypted so they can't see it" is only half true. They can't read your messages, but they can often tell what kind of thing you're doing, and that's all a filter needs.

Why big-name VPNs lose this fight

Nord, Express, Surfshark and Proton are genuinely good products. They're built to stop your internet provider selling your browsing history and to let you watch a different country's Netflix. That's a completely different problem from getting past a filter that is actively hunting for them.

Three structural reasons they struggle on school networks:

• They're famous. Being a household name is a marketing win and a filtering disaster. You are the first thing on every blocklist.
• Their infrastructure is public. Server lists, IP ranges and domains are all published or easily harvested.
• Their protocols are standard. WireGuard and OpenVPN are excellent protocols that were never designed to hide the fact they exist. Some providers bolt on an "obfuscated" or "stealth" mode, which helps, but it's an add-on to a design that wasn't built for it.

Free VPNs fail even harder, and for worse reasons. They're on every blocklist, they're overloaded, and the ones that do work often pay for themselves by logging and selling exactly the data you installed them to protect. If a VPN costs nothing, your data is usually the product.

What traffic actually gets through

Work backwards from how the filter decides. It's looking for traffic that doesn't look like normal browsing. So the traffic that survives is traffic that is indistinguishable from normal browsing.

That's the idea behind newer protocols like Reality, which is what HyperTunnel uses. Rather than announcing itself and hoping the filter doesn't care, it borrows the TLS handshake of a genuinely large website. To the filter, the connection looks like an ordinary HTTPS session to a major domain — the same thing thousands of devices on that network are doing every minute.

The practical differences that matter:

• No recognisable handshake. There's no VPN fingerprint to match, because the handshake is a real TLS 1.3 handshake.
• No VPN domain to block. The connection goes to a plain IP address, not to a domain sitting on a subscription blocklist.
• Not a famous target. A small provider's server isn't on a vendor blocklist the way a household name's entire IP range is.
• Ordinary ports. It runs where normal web traffic runs, so blocking it means blocking the web.

None of this is magic, and no honest provider will tell you it's permanent. A network administrator who specifically notices one address getting a lot of traffic can block that address. The difference is that this is manual work targeting one server, rather than a checkbox that blocks an entire well-known provider.

Things that won't fix it

Before you spend money, some approaches that get recommended constantly and mostly don't work:

• Web proxy sites. The ones that let you paste a URL into a box. They're on every blocklist, they break on most modern sites, and the sketchy ones inject ads or harvest whatever you type. They also do nothing for apps.
• Browser extension "VPNs". Most are just proxies that cover browser tabs and nothing else. Managed devices frequently block extension installs anyway.
• Switching to mobile data. This genuinely works, because you've left the school network entirely — but it burns your data allowance and does nothing for a laptop.
• Changing your DNS to 8.8.8.8. Occasionally beats the laziest possible filter. Any filter doing DPI, or intercepting DNS at the gateway, ignores it completely.
• Tor. Extremely detectable, blocked nearly everywhere, and slow enough to be unusable for video.

The part nobody tells you

A VPN encrypts your connection and hides your browsing from the network. It does not make you invisible or immune to consequences.

If you're using a school-managed device — a laptop or Chromebook they issued you — that device may have monitoring software installed directly on it. Software running on the device itself sees what you do before it ever reaches the network, so no VPN can help with that. On a managed device, the honest answer is that a VPN doesn't give you the privacy you might assume it does. We wrote about Chromebooks specifically here.

Separately: using a VPN will often breach your school's acceptable-use policy, even where it isn't illegal. That's a real risk and it's between you and your school. We're not going to pretend otherwise, and we'd rather you decide with the facts than find out later. Most people buying this are using it on their own phone on the school's WiFi, which is a different situation from a school-issued laptop — but check your own policy.