VPN on Train Wi-Fi: After the Portal, Not a Cabin and Not a Cafe

A cafe has a rude AP and a splash. An airplane has that plus a pipe that was never meant to look like home fiber. A train copies both and adds motion. The radio hands off between cars, between trackside cells, between a station AP and whatever is bolted to the carriage. Latency jumps. Loss jumps. Some stacks block UDP because their CGNAT had a bad decade. Cafe advice still helps: get a real route, then tunnel. Cabin advice still helps: the route is thin, the portal is picky. Train advice adds: the handshake you had in car four can die in car five without you standing up.

The packing list is a before-you-leave article. Install Klox on the phone and the laptop while you still have a normal network. Log into the account. Test WireGuard once. Do not discover at a table for two that you never downloaded the Windows build. This page will not walk your toiletries. It will not walk eSIM activation. If your plan is to ignore the train Wi-Fi and use a phone hotspot, that is allowed. Cellular in a valley can still be a toy. I will not pretend every corridor has a perfect cell.

Seatback screens on some coaches are not your laptop. If the carriage has a screen you do not control, you do not install Klox on it. The habit lives on the phone in your hand and the laptop on the table. Those are two of five. The tablet in the overhead is a third if you turn it on and connect.

Farms will rank best VPN for train Wi-Fi until the affiliate cookie expires. I am not competing on city counts. I am competing on whether you get a handshake after the splash without deadlocking the kill switch. That is a smaller claim. It is also the one that matches the product. I will not name the vendor printed on the splash. Operators change. The garden physics do not.

Train Wi-Fi often wants a click-through, an email, a ticket number, a voucher on a reservation, or an 'I agree' before you have a real route. Same garden as a hotel, worse radio. If Smart Connect or a kill switch fires before the splash, you get no internet and no page. Disconnect. Pause fail-closed if traffic is bricked. Complete the garden. Confirm a boring site. Then connect Klox. WireGuard first. You will be naked on that LAN for a minute. That is the cost of the splash. I will not claim zero exposure.

Some rides keep a cookie so you skip the splash until you change trains. Some re-auth at every major station. If you already have a route, waiting is how mail fetches on their DNS. Connect. Do not perform a portal ritual that is not there. If you are not sure, load a plain site. If it hangs on a login, you are still in the garden.

If the portal or the operator page forbids a VPN, that is their contract. Read it. I will not write a second paragraph that walks around that sentence. Cellular exists. Offline exists. The seven-day window exists if you bought a year for a ride that does not want the hop.

Staff in the buffet car cannot reset your Klox password. They may not even reset the Wi-Fi. Ask for the SSID printed on the tent or the screen. A fake Guest in a carriage full of laptops is still an evil twin. Encryption is not authentication of the train. A tunnel on a twin is still a tunnel to a stranger.

Onboard Wi-Fi is a shared backhaul. Dozens of phones, a few laptops, someone running a call, someone else trying a video. Your tunnel adds overhead. It does not add spectrum. If the pipe was already a toy, Klox will not make it fiber. Farms that promise smooth 4K on a regional service are selling a cookie. I will not.

Use the tunnel for mail, docs, a call you cannot skip. Do not treat the carriage as a download window. If the session is throwaway, skip the SSID and stay on cellular, or stay offline. Skip is allowed. Pretending the VPN is the reason the page crawled is how people protocol-hop for an hour and miss the station.

Speed tests on train Wi-Fi are theater. The path changes while the test runs. A number you got in a station is not the number in a cutting. If you needed an honest speed essay, that URL exists. Here the sentence is: a thin pipe plus a tunnel is still a thin pipe. OpenVPN on TCP will feel worse. It may still be the only handshake that lives.

Battery on a laptop will drain faster if the radio retries and the VPN retries with it. That is physics, not a billing trick. Lower the screen. Kill the test tabs. Cellular hotspot from a phone can be kinder than the ceiling AP. It can also be worse in a tunnel under rock. Try once. Stop if both are toys.

Klox ships WireGuard, OpenVPN, OpenConnect, and Shadowsocks. WireGuard is the default I want on a normal cafe: fast handshake, light on battery. Train stacks are not a normal cafe. Some hate UDP. Some drop it after a handoff. Handshake hangs, or connects and dies when you leave the station. Then OpenVPN, often TCP, is the spare tire. You will feel it. You will also get a route.

Do not protocol-hop as a personality. One change, test a site, stop. If both fail, it is the portal, the kill switch, or a network that does not want you. Cellular is still a valid train strategy. I use it when the ceiling Wi-Fi is a toy.

DNS through the tunnel still matters on whichever protocol actually connected. IPv6 leak protection still matters if the service hands you a v6 address and your tunnel is v4-only without a block. WebRTC in the browser can still embarrass you to a page you opened. Those are Features-page sentences. They are not a reason to skip WireGuard on the first try. They are a reason to connect, then optionally leak-test if you have the patience, then look out the window.

I will not publish a list of which operators block which ports. That list would be wrong by next season. If WireGuard fails after a real route exists, try OpenVPN. If the client labels TCP, try that. Document the SSID in a ticket if you write in. Do not invent a vendor name so the ticket looks precise.

You walk to the buffet. The laptop stays on the table, or it comes with you. Either way the radio may associate to a different AP. Some services keep one SSID down the train. Some do not. A new AP can mean a new garden. The splash returns. Kill switch looks like a broken internet. Pause, finish the page again, restore the tunnel. Do not assume the VPN forgot how to handshake. The LAN forgot you.

Roaming while seated still happens. Trackside cells, tunnels, station stops. Fail-closed will cut you more often than at home. That is not a defect in WireGuard. It is a moving building with a shared backhaul. If you cannot live with cuts, skip kill switch on rail days and accept a leak window on drop. That is an adult trade.

Smart Connect, if the row exists, will try to start the tunnel every time the SSID looks new. That races the splash after a car change. Turn it off for the ride if this keeps happening. Use the button after a site loads. Ugly. Works. Turn it back on when you are in a hotel that you understand.

I will not tell you to MAC-spoof, to cling to one AP, or to disable roaming in the OS as a rail hack. That is how you get a stuck association and a worse day. Join, splash, tunnel. When it dies, repeat. Cellular when the repeat is the whole trip.

A train table is usually two gadgets. Phone already on cellular or already tunneled. Laptop joining the carriage SSID. That is two simultaneous seats if both tunnels are up. Klox is five. You can install in more places. Only five can be connected at once.

The tablet you left at home on auto-connect still counts if it is holding a session. Ghost phones count. A router at home holding a tunnel counts as one seat and then covers a house, which is a different article. For the ride: disconnect what is not in the bag, or live with an error when the sixth handshake tries.

I travel with phone plus laptop. That is the kit. I do not need a family seating chart to know two is two. If a partner's phone also joins, you are at three. Still fine. If a work laptop is a third machine in the same bag, you are at three or four depending on the phone. Count before you sit down, not after the error.

Remove retired devices in the portal. Sleep is not disconnect. A laptop lid can keep a peer. Open the app and look. Do not assume the train is why you hit the cap. The cap is often a tablet on the couch.

The farm copy still talks as if 2012 HTTP is the default web. It is not. Your bank, your mail web UI, your work chat: TLS. RFC 8446 is how a lot of that encryption works. Contents of the page are not a gift to the person across the aisle running Wireshark for fun.

What the carriage still gets, without a VPN, is the fact of a hop. Destination IP. Often the name in SNI. DNS if your queries are not inside some other encryption. That is a map of who you talked to, not the password you typed into the form. People mash those together because both sound like they can see me. Split them.

A VPN hides that map from the train LAN by making the interesting hop a VPN server. The operator sees encrypted traffic to that server. Ticket logs, cameras in the vestibule: those are not VPN problems. If your threat is a person in the seat, sit differently. If your threat is the LAN, tunnel. If your threat is the site, that is the site.

Klox routes DNS through the tunnel. Features also lists IPv6 leak protection and WebRTC leak blocking. Those matter after you are connected. They are not a reason to skip the splash-page sequence. They are why a connected session is more than HTTPS was on anyway. If you want to verify the session, use a leak-test after connect on a network that is not moving. A train is a poor lab.

If you bought Klox only for a week of trains and stations, the consumer window is seven days on first purchase. Live page: /refund. Renewals are not that window. Processing is typically several business days to the original method. Store purchases follow the store.

I would rather you keep the year if you will travel again. Yearly from $2.83 a month is not a buffet-car sandwich. If you will not, refund inside the clock instead of leaving a subscription you resent. Resentment is how chargebacks happen. Chargebacks are a different mess.

Do not buy a month of a farm brand because a best VPN for train list told you to, then also buy Klox, then refund neither. Pick one tunnel. Five devices is enough for a trip kit. WireGuard, OpenVPN, OpenConnect, and Shadowsocks are enough protocols. You do not need a city count to sit in a carriage. You do not need a streaming fairy tale.

If the apps will not handshake on that service even after the splash, try OpenVPN. If they still will not, that is what the seven days are for. Document the SSID in the ticket if you write in. Do not invent an operator name you saw on a sticker. Cellular remains a valid train strategy when the ceiling Wi-Fi is a toy.