How to use a VPN on a school or work network, responsibly

Every school and workplace network has an acceptable use policy, usually accepted when you sign in to the Wi-Fi or when you enrol or join. Read it before you connect a VPN. Policies tend to fall into three groups.

• VPNs allowed. Many universities and offices are fine with personal VPNs on personal devices, especially on guest Wi-Fi. Some even recommend them.
• VPNs allowed with limits. A policy may allow VPNs for privacy but forbid using them to reach blocked content, to avoid monitoring on managed devices, or during exams.
• VPNs forbidden. Schools with young students, exam centres, secure workplaces and networks that must meet regulations often ban them completely.

If the policy is unclear, ask. A short email to IT is better than a warning later.

• Privacy on an open campus or guest network shared with hundreds of strangers, for the same reasons as on public Wi-Fi.
• Keeping personal browsing private from a network you do not control, on your own device, where the policy allows it.
• Protecting yourself on shared housing Wi-Fi, such as student residences, where many people you do not know share one network.
• Work VPNs: if your employer gives you a company VPN, use that one for work. It exists so you can reach internal systems safely.

Notice what is not on the list: getting past a content filter, hiding activity from an employer on a work device, or playing games that the network blocks during lessons. Those are questions of policy, not technology, and a VPN is the wrong answer to them.

• Content filtering. A VPN hides traffic from the filter, so a school could not meet its safeguarding duties.
• Security monitoring. Companies inspect traffic for malware and data leaks, and encrypted tunnels to unknown servers are a blind spot.
• Bandwidth. On busy networks, administrators need to give priority to teaching, calls and business systems.
• Compliance. Regulated industries must be able to show where their data goes.

They use a few techniques. Some block the ports VPN protocols normally use, such as UDP port 51820, which WireGuard commonly uses, or 1194 for OpenVPN. Some block known VPN server addresses. The most thorough use deep packet inspection, which recognises VPN protocols by the shape of their traffic, whatever the port.

BoltVeil's firewall mode is OpenVPN running over TCP on port 8080, a web port that many networks leave open. Some guest, hotel and train networks block the ports VPNs normally use, often by accident rather than by policy. In those places, firewall mode lets a VPN connect when WireGuard cannot.

Be clear about its limits. It is not a stealth or disguise technology. A network that uses deep packet inspection can still recognise OpenVPN, and administrators can see that your device keeps a steady encrypted connection to a VPN server. If a network forbids VPNs, firewall mode does not make using one allowed, and it may not work at all.

To use it, open Setup in your dashboard, choose a location and pick the OpenVPN firewall mode (TCP) file. Import it into the official OpenVPN Connect app on Windows, macOS, iOS or Android, or into any OpenVPN client, and sign in with the VPN username and password shown in your dashboard.

# Linux: connect with a firewall-mode profile
sudo apt install openvpn
sudo openvpn --config boltveil-de-frankfurt-tcp.ovpn

A device that belongs to your employer or school is a different situation from your own phone on guest Wi-Fi.

• The owner makes the rules. Company and school devices are usually managed remotely. Installing a VPN on them without permission typically breaks policy, and on many devices it is blocked anyway.
• Monitoring can happen on the device itself. Management software and security agents can see activity before it ever enters a VPN tunnel. A personal VPN does not make a managed device private.
• Company VPNs come first. If your employer requires its own VPN, a second one can break it or send work data through a third party, which may breach data protection rules.
• Keep personal and work separate. Use your own device, on guest Wi-Fi or mobile data, for personal browsing.

If you have a real need, for example privacy on shared residence Wi-Fi or a research task that requires a secure connection to an outside service, ask. IT teams approve reasonable requests more often than people expect.

1. 1Explain what you need to do, not only that you want a VPN.
2. 2Say which device it is for, whether it is personal or managed, and which network.
3. 3Mention the protocol and port you would use, for example WireGuard over UDP or OpenVPN over TCP port 8080.
4. 4Offer limits, such as only on the guest network or only outside lessons or working hours.
5. 5Keep the reply, so you can show that you had permission if the policy changes later.

1. 1Read the network's acceptable use policy, or ask IT.
2. 2Use your own device, never a managed one without written permission.
3. 3Start with WireGuard: it is faster and easier on the battery. See the WireGuard setup guide.
4. 4Switch to firewall mode (OpenVPN over TCP) only if WireGuard cannot connect and VPNs are allowed on that network.
5. 5Turn the VPN off whenever a policy says so, for example during exams or on a work system.

The official apps are linked from the download page, plans are on the pricing page, and you can also earn premium days for free.