I'm at a cafe where all but a couple of websites like Youtube are blocked. I'm typing this from my hotspot.

Whenever I connect my VPN (PIA), it automatically disconnects me from the wifi. After I disconnect the VPN, my wifi connection is established again.

How does this work and how do I bypass it? I've never seen this happen before.

  • Which VPN service are you using? OpenVPN project offers lot of vpn servers to connect so if one of them is blocked you can connect with another. – defalt Jul 1 '17 at 4:35
  • Did you test this setup with another Wi-Fi network? It could just be that the VPN client you're using has a bug or is misconfigured and causes your wireless connection to drop when you enable it. – André Borie Jul 1 '17 at 14:19
  • @AndréBorie Yeah, I always use my VPN and I've never had this problem. I wrote this question on another network while using VPN. – WhiteFlameAB Jul 1 '17 at 21:07
  • @defalt Private Internet Access – WhiteFlameAB Jul 1 '17 at 21:07
  • You should rule out possibilities that problem is not your VPN. Try openVPN or Softether. – defalt Jul 2 '17 at 5:21
up vote 5 down vote accepted

How does this work

Your VPN uses a server in Private Internet Access public network to be able to work. The fact that those addresses are used by PIA is well known (it's probably registered in the public WHOIS database too). It is probably known to whoever designed that WiFi security.

As soon as whatever routes packets in that café sees a packet directed to any of a largish number of uncool address pools, the originating device is disconnected for security reasons.

One way to do it is with a Linux router box with iptables, fail2ban, and a custom script to send the disconnect command to a compatible router (I think I know how to do that with a D-Link access point, as it has a Web interface that could be scripted via curl; but most APs are probably scriptable that way). Set a limit of, say, 20 packet attempts in a minute to trigger disconnect, and Bob's your uncle.

and how do I bypass it?

You need to find a service that offers VPN or proxy services, and yet is not blacklisted. Whether one exists, is more than I could say.

If the network uses a whitelist for allowed sites, and a blacklist for sites that trigger disconnection, you might find such a service and yet it will not work - you'll remain connected to the WiFi (not being blacklisted) but unable to navigate (not being whitelisted).

Frankly, moving your custom elsewhere or procuring a cellphone data plan with WiFi tethering both look more promising than trying to bruteforce access.

  • 1
    I understand now, thanks! I wonder why a cafe would go to such lengths to secure the wifi... – WhiteFlameAB Jul 1 '17 at 0:39
  • @WhiteFlameAB It's not "securing" the wifi—in fact, it's quite the opposite, since a VPN is practically required for public wifi to be secure (to an extent, but that's a discussion that doesn't belong in a comment). Chances are either the proprietors of the cafe want to discourage "malicious" users by prohibiting VPN use, or they mine your traffic for data to sell (which you agree to when you connect, and which is sort of difficult for them to do when you use a VPN). – demize Jul 1 '17 at 2:29
  • 2
    Ah, I just noticed the "all but a couple sites are blocked" part of the question... That presents a third theory that they don't want the wifi using a lot of their bandwidth, and if you can use a VPN then you can bypass any of their filters that stop you from doing things like torrenting Ubuntu to /dev/null. In this case that's more likely than the other two theories. – demize Jul 1 '17 at 2:32
  • Hmm I see. I think you're probably right about them mining data. Although, it wouldn't be too useful cause most of the popular sites are blocked (reddit, stack exchange, facebook). I couldn't even ping Google or run speedtest CLI. Only YouTube worked for me. This has gotten me really curious haha – WhiteFlameAB Jul 1 '17 at 2:35
  • Possibly a manually configured router with custom firmware such as DD-WRT. There is really no 'permanent' solution to this unless you have access to the router. – user633551 Jul 1 '17 at 13:45

The fact that you mention the AP blocking several protocols, including VPN just most probably is due to the AP owner using a firewall and only allowing a few protocols/services out, at limit HTTP and HTTPS (only web browsing).

You mentioning you are only to use youtube and not much more, it probably means either they are using a proxy which only allows a few sites OR you are using a wifi with a captive portal which only allows a couple of services until you authenticate.

For instance, you have thousands of FON hotpots here in Portugal, and in the past they allowed some limited google services, like google search and gmail before authenticating.

You might be using a random wifi service at a coffee shop from a neighbour.

It seems very unlikely they are blacklisting VPN addresses in the Internet at large.

Another hypothesis is that they have it highly firewalled and only the minimum protocolos for web browsing to curb abuse from freeloaders just going there to torrent, or using other network intensive protocolos.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.