Who this guide is for
You’re on a school, office, hotel or airport network whose filter blocks legitimate sites such as news, webmail or health information.
Who it’s not for
A VPN won’t help with blocks on a managed device, in your browser or by the website itself, and it isn’t a way around rules that apply to you.
In short
- Most network filters block by site name or address. With a VPN, the network sees an encrypted connection to a VPN server instead of each site you visit.
- Some networks and countries block VPN connections too, and we can’t promise DarkMatter will connect.
- A VPN won’t help with blocks on a managed device, in your browser, or set by the website itself.
- The rules you’ve agreed to still apply. Read your school’s or employer’s policy, and check local law when you travel.
On this page
School and university networks, office guest Wi-Fi, hotel portals and airport hotspots often filter much more than they need to. A news site, a webmail service, a health information page or a tool you rely on for work gets caught by a category list somebody set up years ago. You’re not trying to do anything wrong; the filter simply can’t tell.
A VPN encrypts your traffic and sends it to a VPN server before it goes anywhere else, so the local network sees a connection to that server rather than each site you visit. On many over-cautious networks, that gives you an ordinary connection back. It doesn’t always, and this guide explains why, along with the rules worth checking before you connect.
How network filters work
It helps to know what you’re dealing with. Most public and organisational networks block sites in one or more of these ways:
- DNS filtering. When your device looks up a site’s name, the network’s resolver refuses to answer or points you to a warning page. It’s cheap and common, and it’s why whole categories of site disappear at once.
- Address blocking. The network’s firewall drops connections to particular IP addresses, often from a list supplied by a filtering company.
- Reading connection details. Some filters read the site name that’s visible when an encrypted connection starts, and block on that.
- Blocking ports and protocols. Stricter networks only allow ordinary web traffic and refuse anything else, which can include VPN connections.
- Rules on the device itself. Work and school laptops often carry management software or browser policies that block sites wherever the device is connected.
The first three happen on the network, and they’re where a VPN changes the picture. The last two are where a VPN is likely to struggle.
What a VPN changes
- The filter sees one encrypted connection. With your traffic inside the tunnel, the network sees a connection to a VPN server rather than the names and addresses of the sites you reach.
- Your lookups go through the tunnel. DNS leak protection is designed to keep the lookups that reveal which sites you visit away from the local network’s resolver.
- Your traffic leaves from the VPN server. Websites see the server’s IP address and location instead of the network you’re sitting on. What a website then shows you is up to that website.
- Gaps around the tunnel are covered by design. IPv6 leak protection is designed to stop traffic slipping around the tunnel, and the kill switch in our Windows app is designed to block traffic if the tunnel drops.
- A choice of protocols. WireGuard is the default, with OpenVPN, IKEv2 and IPSec available. If you can’t connect, try a different protocol; some networks block VPNs and we can’t promise it will connect.
| On a filtered network | Without a VPN | With DarkMatter |
|---|---|---|
| Sites the network sees you visit | Each site, by name or address | An encrypted connection to a VPN server |
| DNS lookups | Answered, or refused, by the network | Designed to go through the tunnel |
| IP address websites see | The network’s address | The VPN server’s address |
| Filters on your device or browser | Apply | Still apply |
| Networks that block VPN connections | Not relevant | May stop the VPN connecting |
Every feature on every plan
Encrypt your connection on up to 5 devices at once
- Apps for Windows, macOS, iOS, Android and Fire TV
- Kill switch (Windows app)
- Split tunnelling (not on iPhone, iPad or Mac)
- DNS and IPv6 leak protection
- 30-day money-back guarantee on your first purchase (14 days on monthly plans)
Where people run into blocks
- School, college and university Wi-Fi. Campus filters are blunt and can catch legitimate study material. Your institution’s acceptable-use policy still applies, so read it first. Our students guide covers this in more detail.
- Work and guest networks. Office guest Wi-Fi and shared workspaces often block whole categories of site. On a work device or a managed network your employer’s rules come first, and our remote work guide explains how a personal VPN sits alongside a company one.
- Hotels, airports and cafés. Guest networks can block services you rely on while you’re away from home, sometimes only because a category list is out of date.
- Travelling abroad. A network in another country may filter sites you use at home, and some countries regulate or restrict VPN use. Check the local rules before you go; our travel guide has more.
Before you connect
- Read the rules you’ve agreed to. School, employer and hotel terms often say what’s allowed. If a VPN isn’t permitted on a network, don’t use one there.
- Ask whether the block is a mistake. IT teams and hotel front desks can often lift a block on a legitimate site if you ask.
- Try your mobile data. If the site loads over mobile data, the block is on the Wi-Fi rather than the site.
- Sign in to the network first. Complete any sign-in page, then connect DarkMatter.
- If it won’t connect, try a different protocol. If none of them connect, the network is probably blocking VPN connections, and there’s nothing more a VPN can do there.
The honest bit
An honest note on what we can’t promise
Some networks and countries block VPN connections, and we can’t promise DarkMatter will connect. A network set up to detect and block VPN traffic can often do so whichever protocol you choose, and we don’t offer tools designed to disguise VPN traffic. Nor can we promise that a particular website or service will work while you’re connected: many detect VPN addresses and respond in their own way, from extra verification to refusing the connection.
A VPN also won’t help with blocks enforced on a managed device, in your browser or by the website itself.
A VPN is a privacy and security tool, not a way around the rules that apply to you. Many networks block sites under policies you have agreed to, and some countries regulate or restrict VPN use. You’re responsible for knowing the rules and laws where you are, and we ask you to respect them.