Using a VPN while travelling: what the rules actually are

Travelling is where a VPN earns its keep, for a reason that has nothing to do with streaming. You are on hotel networks, airport networks, café networks and occasionally a national network with rules of its own, and none of them are yours.

What it genuinely solves

Untrusted networks. Hotel and airport Wi-Fi is shared with everyone in the building and operated by someone whose interest in your privacy is unknown. A tunnel means all of them see one encrypted stream to one address.

Networks with their own DNS. Many hotel networks intercept lookups. A tunnel carrying its own resolver removes that.

Local network filtering. Some countries filter at the network level, and a tunnel routes around ordinary filtering — subject to the legal question below.

Home-country services that check your connection. A bank that objects to a foreign login, for instance. A server in your own country presents a familiar origin.

What it does not solve

Your streaming catalogue. The catalogue follows your account, not your address. Within the EU, Regulation 2017/1128 already requires portability of paid subscriptions while you are temporarily in another member state, which is the real answer where it applies.

Your account's store region. Set from billing details.

Local law. Covered below and worth taking seriously.

Before you leave

Install and sign in at home. App stores in restricted markets often do not carry VPN clients, and provider websites are frequently blocked. Arriving without the app installed is the most common avoidable problem.

Save a fallback endpoint. Somewhere that blocks UDP will kill WireGuard completely; an OpenVPN endpoint on TCP 443 is the usual way through.

Set auto-connect thoughtfully. A client that connects the instant you join a network will fight the captive portal you have not signed into yet. Some clients distinguish "connect after portal" — use it if yours does.

Download offline content. More reliable than any tunnel on a hotel connection.

On arrival

Captive portals come first. Turn the VPN off, open a plain HTTP page to trigger the sign-in, complete it, confirm you are online, then bring the tunnel up. The order matters and doing it the other way round produces a device that appears to have no internet.

The legal part, which varies

In most countries VPN use is unremarkable. A small number restrict it, generally by requiring providers to be licensed and to cooperate with filtering rather than by prohibiting use outright.

Two things worth separating: a network that blocks a VPN is a technical obstacle, and a country that prohibits its use is a legal one. Only the second carries consequences to you, and only you can weigh them. Check the current position for your destination rather than relying on a general article — this area changes faster than most.

Choosing a server while abroad

For privacy on the local network: the nearest server. Lowest latency, and the network still sees only an encrypted stream.

For home-country services: a server in your home country, accepting the latency.

For general browsing: nearest, unless something specifically needs otherwise.

The server list covers what each country's network environment looks like, which is more useful when travelling than at home — the local filtering situation is genuinely different place to place.

Devices

A phone is the one that matters most, because it joins networks automatically and often without you noticing. Set always-on and a kill switch on it before you travel; the iOS on-demand rules are the mechanism that makes this automatic rather than something you have to remember at every airport.

Roaming, eSIMs and which network you are actually on

A phone roaming on a foreign carrier may route traffic back through its home network or break it out locally, and which one it does changes what any of the above means. Home routing means your traffic appears from your home country already, and often means noticeably higher latency.

A local eSIM breaks out locally, giving better performance and putting you under the local network's filtering and retention rules. That is a meaningful difference in a country with strict controls, and it is worth knowing which arrangement you have before assuming anything about what your connection looks like.

Hotel networks specifically

Beyond captive portals, hotel networks commonly block UDP, force their own resolver, limit sessions to a few hours, and put every guest on one flat network where devices can see each other.

That last point is the one people forget. A laptop with file sharing enabled is visible to everyone else in the building, and a VPN's kill switch that permits local network traffic — which most do by default, so printers keep working — does not change it. Turning off sharing before you travel is worth more than any tunnel setting.

Border and device checks

Some jurisdictions inspect devices at entry. A VPN encrypts traffic in transit and does nothing about a device handed over unlocked.

If that is a realistic concern for your destination, the measures that help are about what is on the device rather than how it connects, and they should be researched specifically rather than assumed to be covered.