corporate firewall

VPN Behind a Corporate Firewall: What It Can and Can't Do

On a corporate firewall, hotel or campus network, a VPN can protect your traffic but cannot hide what a managed device records. Here is what to expect.

By ZoltVPN TeamPublished Updated
A laptop on a hotel desk connecting through a firewall icon, with some paths open and others closed.

On a strict network, such as an office, a campus, a hotel or a conference venue that blocks ports and inspects traffic, a VPN can encrypt your traffic so the local network cannot read it, and it can keep you connected when a restrictive Wi-Fi network breaks the apps you are allowed to use. What it cannot do is hide your activity from monitoring software on a device your employer manages, override the rules of a network you have agreed to, or get through a network that only allows an approved list of destinations. On a work device or a work network, your organisation's IT policy comes first.

What makes a network "strict"

Networks restrict traffic in several ways, often several at once. Knowing which one you are facing tells you what to expect.

RestrictionWhere you find itEffect on a VPN
Only web ports openOffices, schools, hotelsMany classic VPN protocols cannot connect
UDP traffic blockedOffices, some public Wi-FiProtocols that rely on UDP fail
Category filteringSchools, offices, public Wi-FiVPN websites and downloads may be blocked
Traffic inspectionManaged corporate networksVPN connections can be detected and blocked
Captive portalHotels, airports, trainsNothing connects until you accept the terms
Device managementCompany laptops and phonesSoftware on the device sees what you do

The last row is different from the others. The first five are about the network. Device management is about the computer or phone in your hand, and a VPN does not change it.

What a VPN can do on a strict network

Protect you on networks you do not control

Hotel rooms, conference halls, co-working spaces and trains all offer shared networks run by people you do not know. A VPN encrypts your traffic between your device and the VPN server, so the network owner and other guests cannot read it.

Keep everyday apps working

Restrictive public networks sometimes block more than they mean to. Messaging calls, email apps or cloud sync can fail simply because the network only allows web browsing. A VPN that can adapt to the network often restores the services you are entitled to use.

Keep your browsing private on guest Wi-Fi

On a personal device connected to guest Wi-Fi, a VPN stops the network operator from seeing which sites you visit. Our guide to VPN privacy basics explains what is and is not hidden.

Give you a steadier connection while travelling

Moving between airport, hotel and client-site networks in one day means moving between very different rules. A VPN that adapts per network saves you from troubleshooting each one.

What a VPN cannot do

Hide activity from software on a managed device

If your employer manages your laptop or phone, monitoring and security software can see activity on the device itself, before it ever reaches the VPN. Encryption on the network does nothing about that.

Make a policy breach acceptable

If your organisation's rules forbid personal VPNs on its network or devices, using one anyway is a policy problem, whatever the technology. Read the rules and ask IT if you are unsure.

Get through every network

Some highly controlled networks only allow connections to an approved list of destinations. No VPN should be expected to get through those, and you should not try to defeat them on a network you have agreed to use.

Protect a compromised device

Malware on your device can send data through the VPN as easily as without it.

Replace your company's own VPN

A company VPN connects you to internal systems such as file shares and business apps. A personal VPN connects you safely to the public internet. They do different jobs.

Personal VPN vs company VPN

Company VPNPersonal VPN
Who controls itYour employer's IT teamYou
What it reachesInternal company systemsThe public internet
Main purposeSecure access to work resourcesPrivacy and reliable access on any network
Who handles your trafficYour employerYour VPN provider
Use on a work deviceAs required by ITOnly if policy allows

Running both at once on the same device often causes conflicts. If you need the company VPN for work, use it as IT instructs. A personal VPN belongs on personal devices and personal time.

Captive portals: the most common problem

Hotels, airports and trains often use a captive portal, the page where you accept the terms or enter a room number before you get online. Until you do, nothing works, VPN included.

  1. Disconnect the VPN.
  2. Open a browser and visit any ordinary website. The portal page should appear.
  3. Accept the terms or sign in.
  4. Reconnect the VPN.

If the portal page never appears, try turning Wi-Fi off and on, or opening the browser's private window.

A sensible approach at work and on campus

  • Read the acceptable use policy of any network you rely on.
  • Keep work and personal use apart. Use work devices for work, and personal devices for personal VPN use.
  • Ask IT about blocked work tools. If a service you need for your job is blocked, IT can usually allow it.
  • Do not install unapproved software on company devices.
  • Follow local laws wherever you travel.

How ZoltVPN handles restrictive networks

On your personal devices, ZoltVPN is designed to cope with networks that only let a few kinds of traffic through. Its adaptive engine, CyberPort AI, picks from 10 connection models using your location, your internet provider and how the connection performs in real time. When one model is blocked or slow, it switches automatically, and it remembers what works on each network, so the hotel Wi-Fi you used last month starts with the model that worked there.

We explain how networks recognise VPN traffic in what deep packet inspection is, and the difference between VPNs and proxies, which many workplaces use, in VPN vs proxy. See all the app's features on the features page.

FAQ

Can my employer see that I use a VPN?

On a company network, the IT team can usually see that a VPN connection exists, even if they cannot see what is inside it. On a company-managed device, they may be able to see much more.

Will a VPN work on hotel Wi-Fi that only allows web browsing?

Often, yes, once you have passed the captive portal. An adaptive VPN has a much better chance than one that relies on a single protocol.

At work it is usually a question of company policy rather than law. Follow your organisation's rules and the laws of the country you are in.

Does a VPN hide my activity from monitoring software on a work laptop?

No. Software running on the device sees activity before it is encrypted.

Need a VPN for your personal devices on the road? Download ZoltVPN and try it free for 7 days, no card needed.

Tagscorporate firewallremote workrestricted networkwi-fi
ShareTelegramX

Stay connected with ZoltVPN

7-day free trial, no card needed. Apps for iPhone, iPad, Mac, Android, Android TV and Windows.