VPN on Airplane Wi-Fi: After the Airline Page, Not Before

A cafe has a rude AP and a splash. An airplane has that plus a pipe that was never meant to look like home fiber. Latency is worse. Loss is worse. Some inflight stacks block UDP because their CGNAT or their satellite modem had a bad decade. Cafe advice still helps: get a real route, then tunnel. Cabin advice adds: the route is expensive, the portal is picky, and the radio will drop when the aircraft hands off.

The packing list is a before-you-fly article. Install Klox on the phone and the laptop while you still have a normal network. Log into the account. Test WireGuard once. Do not discover in row 14C that you never downloaded the Android build. This page will not walk your toiletries. It will not walk eSIM activation. If your plan is to ignore the airline Wi-Fi and use a phone eSIM in the air, check whether that eSIM even has altitude coverage. Many do not. I will not pretend they do.

Seatback screens are not your laptop. The seatback is the airline's computer. You do not install Klox on it. You do not get a tunnel on a screen you do not control. If you plug a cable into the seat USB, that is power, maybe. It is not a VPN seat. The habit lives on the phone in your hand and the laptop on the tray. Those are two of five. The tablet in the overhead is a third if you turn it on and connect.

Surfshark's inflight VPN article is a competitor specimen. Farms will also rank best VPN for airplanes until the affiliate cookie expires. I am not competing on city counts. I am competing on whether you get a handshake after the splash without deadlocking the kill switch. That is a smaller claim. It is also the one that matches the product.

Captive portals want a clear hop. The inflight AP intercepts HTTP, shows accept, pay, voucher, sometimes a loyalty number. Your phone's OS tries to detect that garden. A VPN that starts the instant the radio associates can steal the first hop the portal wanted. Then you have no internet, no splash, and a long flight.

If Smart Connect or a kill switch already fired, disconnect. Pause the switch if traffic is still blocked. Complete the airline page. Confirm a boring site loads. Then connect Klox. WireGuard first. You will be naked on that LAN for a minute. That is the cost of the splash. I will not claim zero exposure. I will claim this is normal, and that leaving the tunnel up during the splash is why people think the app is broken at cruising altitude.

If the portal never appears, you probably already have fail-closed eating the detection traffic. Turn Klox off. Open a plain HTTP site if the OS is shy. Some phones need that. Then the tunnel. Cafe Wi-Fi has the same deadlock. The cabin version is worse because you cannot walk to another AP. There is one radio in the ceiling. Treat it as the only door.

Read the text on the airline page. If they say VPN is not allowed on this service, that is their rule for their network. I am not your lawyer. I am not the airline. I will not invent a policy that says you must tunnel. I will not invent a policy that says you must not. If you choose to connect after you were told not to, you chose it. If you skip the VPN because their page said so, you also chose it. The habit in this article is technical: splash, then handshake. The permission is theirs.

Airlines split the product. Full internet after a card or a pass. A cheaper or free SSID that claims messaging only: iMessage, WhatsApp, maybe a few domains. That second network is not a VPN platform. A tunnel wants a path to a VPN server, not a whitelist of chat hosts. If you connect Klox on a messaging SSID, the handshake often dies. Then you blame WireGuard. The SSID never offered you a general route.

Paid inflight Wi-Fi is still a thin pipe. It can carry a tunnel. It may still hate UDP. It may still captive-portal you again after a handoff. Pay, finish the page, test a boring site, then tunnel. Do not pay, then immediately fail-closed, then open a ticket from the seat. You have not proven the pipe yet.

I will not quote a price for inflight Wi-Fi. I will not name an airline's SKU. Those change. The split does not: garden, then maybe a real route, then maybe a VPN. Messaging-only is a maybe that is usually no. If chat apps work and nothing else does, stay off Klox or buy the full pass if you wanted a tunnel. That is a purchase decision, not a protocol decision.

Cookies on the airline portal are their website. Our cookie page is Klox's site, not the inflight vendor. Do not mix those. Rejecting analytics on klox.app does nothing to the splash in the seat. Completing their portal may set a device cookie so you stay authenticated. If you clear cookies mid-flight you may buy the pass twice. That is their funnel. It is not a leak test.

A kill switch is fail-closed: if the tunnel dies, nothing else leaves. On a laptop at home that is often what you want. Over inflight Wi-Fi it collides with the splash page and with a radio that drops every time the aircraft changes beams. Deadlock looks like this. Auto-connect starts WireGuard. Handshake fails because the portal has not blessed you. Kill switch blocks the HTTP the portal needs. You toggle random settings. You tell the person in 14B the VPN is malware. The product did what you asked. You asked for a brick until the tunnel exists. The tunnel cannot exist until the brick is lifted.

Pause the switch for the garden. Restore it after the tunnel is up if you still want fail-closed on a radio that will drop. Restoring it means you will get cut every handoff. That can be the right call if you care about a leak window. It can be the wrong call if you are trying to keep a work chat alive across the Atlantic. Adult trade. Pretending fail-closed and captive portals are friends is how support tickets get written from 35,000 feet.

Cafe radios are rude. Cabin radios are ruder. They roam, they rate-limit, they reboot the whole aircraft's NAT. Fail-closed will cut you more often than at a shop. That is not a defect in WireGuard. It is a small flying ISP with two hundred phones.

If you cannot live with a pause, skip kill switch on flight days and accept a leak window on drop. Use the Connect button. Smart Connect can wait until you land. I would rather you have a splash and a tunnel than a perfect fail-closed story and no email.

Klox ships WireGuard, OpenVPN, OpenConnect, and Shadowsocks. WireGuard is the default I want on a normal network: fast handshake, light on a phone battery, enough encryption for a LAN you do not run. Inflight Wi-Fi is not a normal network. UDP gets dropped. Handshake hangs. Or it connects and dies. Then OpenVPN, often TCP, is the spare tire. You will feel it. The pipe was already thin. TCP over a high-latency link is not pretty. You will also get a route, which is the actual job.

Do not protocol-hop as a personality. One change, test a site, stop. If both fail, it is the portal, the kill switch, the messaging SSID, or a network that does not want a VPN. Read their page. Cellular is not a cabin strategy unless you have a very specific air-to-ground product, which most people do not. I will not invent one.

DNS through the tunnel still matters on whichever protocol actually connected. IPv6 leak protection still matters if the inflight stack hands you a v6 address and your tunnel is v4-only without a block. WebRTC in the browser can still embarrass you to a page you opened. Those are Features-page sentences. They are not a reason to skip WireGuard on the first try. They are a reason to connect, then optionally leak-test if you are bored in the last hour, then close the laptop and sleep.

I will not publish a speed SLA for inflight plus OpenVPN. I will not publish a city count you should pick. Pick a server that connects. If the app has a default, use it. Fidgeting through a list on a 600ms satellite path is how you spend the whole flight in the server picker. The packing-list article can nag you to test protocols on hotel Wi-Fi. This article says: WireGuard, then OpenVPN, then stop.

A tray table is usually two gadgets. Phone already on airplane mode with Wi-Fi, or still on a dead cellular radio. Laptop joining the inflight SSID. That is two simultaneous seats if both tunnels are up. Klox is five. You can install in more places. Only five can be connected at once.

The tablet you left at home on auto-connect still counts if it is holding a session. Ghost phones count. A router at home holding a tunnel counts as one seat and then covers a house, which is a different article. For the cabin: disconnect what is not in the bag, or live with an error when the sixth handshake tries. I travel with phone plus laptop. That is the kit. I do not need a family seating chart to know two is two. If a partner's phone also joins, you are at three. Still fine. Count before you pay for two passes and then hit a cap.

Seatback is zero Klox seats. Good. USB power is zero seats. Also good. A work laptop plus a personal laptop plus a phone is three. The home tablet on Smart Connect is the one that ruins the math. Smart Connect, if the row exists, is untrusted Wi-Fi. Home Wi-Fi you marked trusted should not hold a tunnel. If you never marked home trusted, the tablet on the couch is still in the five. Open the app at home before you fly, or live with the error in the air.

Remove retired devices in the portal. Sleep is not disconnect. A laptop lid can keep a peer. This is not the stolen-phone remote-logout essay. You still own these gadgets. You just forgot which ones are connected. Look at the list. Do not assume the aircraft is why you hit the cap.

The farm copy still talks as if 2012 HTTP is the default web. It is not. Your bank, your mail web UI, your work chat: TLS. RFC 8446 is how a lot of that encryption works. Contents of the page are not a gift to the person in 14B running Wireshark for fun, if they even could on a client-isolated inflight LAN. Isolation varies. Do not bet your password on it.

What the inflight operator still gets, without a VPN, is the fact of a hop. Destination IP. Often the name in SNI. DNS if your queries are not inside some other encryption. That is a map of who you talked to, not the password you typed into the form. People mash those together because both sound like they can see me. Split them.

A VPN hides that map from the cabin by making the interesting hop a VPN server. The inflight AP sees encrypted traffic to that server. Your ISP at home sees a similar blob if you tunnel at home. Different chair, same idea. Cloudflare's explainer is the generic picture if you want it in someone else's words. Klox routes DNS through the tunnel. Features also lists IPv6 leak protection and WebRTC leak blocking. Those matter after you are connected. They are not a reason to skip the splash sequence. They are why a connected session is more than HTTPS was on anyway.

The cabin still sees that you used their SSID, roughly how much you transferred, and that you spoke to a VPN. Encryption is not authentication of the airline. A VPN cannot make their AP honest. It cannot unlock a streaming catalog I did not promise. Inflight plus a VPN is not a Netflix product. If a farm said otherwise, they were selling a cookie. Klox is a tunnel, five devices, two protocols. Use it as that. It cannot hide that you are on that aircraft. Logs, cameras, the boarding pass: those are not VPN problems.

If you bought Klox only for one long-haul and the inflight Wi-Fi was the whole point, the consumer window is seven days on first purchase. Live page: /refund. Renewals are not that window. Processing is typically several business days to the original method. Store purchases follow the store.

I would rather you keep the year if you will sit in cafes and airports after you land. Yearly from $2.83 a month is not a seatback movie. If you will not, refund inside the clock instead of leaving a subscription you resent. Resentment is how chargebacks happen. Chargebacks are a different mess.

Do not buy a month of a farm brand because a best VPN for airplanes list told you to, then also buy Klox, then refund neither. Pick one tunnel. Five devices is enough for a trip kit. WireGuard, OpenVPN, OpenConnect, and Shadowsocks are enough protocols. You do not need a city count to send mail over a satellite. You do not need a dedicated-IP consumer SKU. We do not sell that as a Klox consumer line item. Do not invent IAP SKUs as a reason the handshake failed. The handshake failed because of the portal, UDP, or the messaging SSID.

If the apps will not handshake even after the splash, try OpenVPN. If they still will not, that is what the seven days are for. Document the airline and the SSID in the ticket if you write in. Do not invent a story about SOC 2. Nobody in the cabin asked. Do not invent an SLA percentage for inflight. We do not publish one. The packing list can still save the next trip. This trip was a thin pipe. Treat it that way.