Campus VPN vs eduroam

Hop one is association and authentication on the campus air. The supplicant talks 802.1X to the access point. The authenticator forwards EAP to RADIUS. Someone in that chain says yes. The station gets an IP on a VLAN ITS designed. The LMS is a hostname on a network you already joined.

Hop two is optional. A VPN starts after you have a path: campus SSID, cellular, a hotel AP. The client builds WireGuard or OpenVPN to an endpoint. Destinations then see an exit IP, not the dorm NAT. That is useful off-campus, or when a publisher allowlists a known egress. It is useless as a way to join Wi-Fi. If you cannot associate, you cannot start the tunnel unless another interface already works.

An RFP slash that treats campus VPN and eduroam as equals will spend August on a poster that lies. Students install the app before they join the SSID. The app fail-closes. Move-in becomes a RADIUS ticket in a VPN costume. You do not have the staff for that costume.

The branded-campus article is who owns the icon and the desk. Here: get the hop order right or every other decision is noise.

eduroam is not encryption for later websites. It is a roaming service on IEEE 802.1X and a RADIUS hierarchy. Wikipedia's eduroam article and RFC 7593 describe the same machine: the visited campus sees a realm (user@home.edu), proxies EAP toward the home institution, and gets a yes or a no. The home IdP authenticates. The visited network authorizes access. That split is why a postdoc from another university can sit in your library without a guest form.

EAP methods you will meet: PEAP and EAP-TTLS with inner passwords, or EAP-TLS with certificates. Those protect credentials on the way to home RADIUS. They are not your campus VPN. They terminate as part of joining the SSID. After that, the station is on a VLAN ITS already filters.

A local campus SSID that is not named eduroam can still be 802.1X. Same hop. Different roaming. WPA-Enterprise is the join. eduroam is the federation on top of that join.

If RADIUS is down, nobody joins. A VPN app does not create a RADIUS. It creates a second ticket category. Fix the join first.

A captive portal is a splash page on an open or PSK network. You associate first, often with little or no 802.1X, then a browser is hijacked until you accept terms. Hotels love this. Some campus guest SSIDs still do. It is a web form pretending to be access control.

eduroam documentation is blunt: splash screens break the EAP story. Credentials should not be typed into a hotel-style page on a network that claims to be eduroam. If your guest SSID is a portal, say guest. If your research SSID is WPA-Enterprise, say that. Mixing the words is how a visiting PI pastes a password into a page that is not their IdP.

A VPN client that fail-closes before the splash loads will never complete the portal. That fight is famous on hotels. It is also how a conference SSID during orientation looks like your branded app broke the internet. The White-Label VPN and Kill Switch Copy article is the string on the toggle. This page is the radio: portal versus Enterprise are different join ceremonies.

PSK-only lab SSIDs still exist. A shared passphrase is not eduroam. Do not put that password in a VPN onboarding PDF.

Once the station has an IP, a tunnel can start. Off-campus that is the usual story: hotel, cafe, cellular, a conference that is hostile in the boring way. On-campus the story is narrower. You already sit on a mutually authenticated SSID. HTTPS already covers most LMS traffic. The tunnel is not what joined you.

Reasons I believe for a VPN after the join: a publisher that allowlists a known egress; staff travel onto a portal SSID; a researcher who needs a path from home to a resource that is not on the public internet. Reasons I do not believe: Wi-Fi feels slow; RADIUS tickets are high; a consumer blog said university Wi-Fi is public so hide.

Library resources are the mash people make. Some journals still key off IP. eduroam does not magically present a library SNAT you registered. The station may NAT out a campus border that is already allowlisted. Or it may not, on a restricted VLAN. A dedicated egress, if you contracted one, is a later hop you register. It is a named IP, not anonymity. Join first. Then tunnel if the vendor needs an egress that is not the dorm NAT.

Do not tell students the VPN is how they get eduroam. That sentence will outlive your job.

The point of eduroam is the visitor. Home credentials, visited air. If you also issue a branded VPN account to every visiting scholar, you will revoke nobody in June. The PI will swear they will remember. They will not.

When a visitor needs a tunnel, write an exception with an end date. Lab allowlist for a three-day workshop. Staff travel profile for a sabbatical month. Calendar the kill. Do not bind the exception to a Gmail the visitor used at registration. Prefer the home-realm identity you already trust for Wi-Fi, or a time-boxed local account ITS can see.

Visitors who cannot join eduroam have an identity problem or a supplicant problem. Wrong EAP method. Expired password at home. Device that never learned the realm. Those are RADIUS tickets. Handing them a VPN QR in the lobby does not authenticate them to the SSID. It asks them to use cellular or a guest portal you may not have meant to offer.

I would rather a visitor complete eduroam and never hear about your tunnel than collect a pile of leftover peers named workshop-2024.

Full tunnel is easy to draw. Every packet leaves through the exit. On a cafe that can be the point. On a campus SSID it is often a self-own. Printers, AirPlay, RFC1918 lab benches, and some SSO appliances expect to see you on the campus net. Hairpinning that traffic out an exit, or dropping it, looks like the VPN broke Wi-Fi. Staff will believe that sentence.

Split tunnel is the adult default for a lot of on-net builds: only prefixes ITS listed, or the reverse, only off-net. There is no universal list. There is a list you walked on the real SSIDs. If you do not have that list, you have a hope. Hope is a ticket category in week two.

DNS has to match the split. Force a public resolver on-net and internal names die. Force campus DNS off-net and you leak queries onto a hotel resolver. Document on-net versus off-net. Test dual-stack. A split that forgets IPv6 is a leak with extra steps.

This is routing, not the LMS-versus-copier packaging from the other campus post. If 10.0.0.0/8 should stay local, the client must leave it local. Protocol religion will not save a wrong allowed-IP list.

Do not deploy a VPN because 802.1X onboarding is ugly. Fix the onboarding. eduroam CAT, geteduroam, a short OS card: those are join tools. A tunnel is not a join tool.

Do not deploy a VPN because the guest portal is embarrassing. Redesign guest. A tunnel on cellular is not a guest SSID.

Do not deploy a VPN because a building failed RADIUS for a week. That week needs a network incident, not a new product. People who connected via a hurried VPN SKU will still be connected in November.

Do not deploy a VPN as the campus network for devices that cannot run your client. Cameras, badges, TVs, lab instruments need VLANs, not a laptop subset wrapped in WireGuard.

If the RFP says replace Wi-Fi authentication with a campus VPN, rewrite it or walk. You will spend the year explaining why the phone has no internet until an app logs in. That is captive-portal energy on a network that should have been Enterprise.

Fail-closed is a privacy mode: no packets unless the tunnel is up. On a cafe, maybe. On move-in, it is a trap. 802.1X needs the radio. A captive portal needs a browser. An always-on client that owns the stack before either ceremony finishes will look like dead Wi-Fi.

Staff travel laptops can tolerate stricter defaults after you tested hotel portals. Student amenity on campus SSIDs should default to stay out of the join. The White-Label VPN and Kill Switch Copy strings have to match that default. If the toggle says block all traffic and the desk card says join eduroam first, you wrote two products on one glass.

Personal consumer clients students already installed will fight yours. The script is: turn that off, join the SSID, then decide. You will not win a theology argument in the lobby. You will get them to the LMS.

I will not claim a campus build is leak-proof because a blog said so. Test the real SSIDs. Test the portal SSID you pretend you do not have.

NordVPN's school Wi-Fi essay is a consumer pitch: campus air as public hotspot, hide, stream, stay safe. It is a specimen. It is not an ITS architecture. Campus WPA-Enterprise is not a cafe. ITS may already log, filter, and allowlist. Telling students to hide from the house network in the house voice is how legal kills a branded amenity.

If students want a personal tunnel on cellular, that is their consumer purchase. Klox consumer remains five devices, WireGuard, OpenVPN, OpenConnect, and Shadowsocks, from $2.83 a month, 7-day money-back. That SKU is not a campus RADIUS replacement. Do not screenshot it onto a board packet as eduroam-but-better.

AUP still applies. A tunnel that exists to evade lab filters will become an abuse ticket. Write whether personal VPNs are allowed on campus SSIDs. Ambiguity is a Discord rumor by week three.

Dunk the marketing. Do not clone it. Your FAQ has two hops. Their landing page has one mood.

Sentence one: eduroam or the campus WPA-Enterprise SSID gets you on the air. Sentence two: the VPN app is a later encrypted path, optional, for off-campus or for a resource that needs a known egress.

If you need a third sentence, make it the order: join, confirm the LMS, then connect the tunnel if you were told to. If you need a fourth, make it the negative: the VPN does not replace RADIUS, does not replace a guest portal, and does not make the copier work when you full-tunneled RFC1918.

Put those sentences on the same page as the eduroam instructions. Not in a vendor PDF students will not open. Date the page. When ITS changes VLAN roles, update the split-tunnel note on the same day or you will debug ghosts.

The white-label conversation is still a platform conversation if you want a campus name on the client. This FAQ is true even if you never brand an app. Consumer Klox users can ignore it. ITS cannot.

Protocols do not join SSIDs. They run after. Klox consumer is WireGuard, OpenVPN, OpenConnect, and Shadowsocks. UDP gets blocked in rude networks; TCP fallback is why OpenVPN still earns a button. Test both on the real residence SSID before you print WireGuard-only on a faculty travel card.

Five devices is a household SKU. It is not a dorm census and it is not an eduroam policy. If a campus build uses five, print five. Confirm with sales.

Custom domains for a branded portal are a different post. White-Label VPN and Custom Domain DNS is the hostname. This page is the radio versus the tunnel. Mix those tickets and you will restart named for a PEAP failure.

I will not publish API URLs or a city list as a reason the library should trust you. The hop order does not care how many exits you bought. It cares whether the laptop associated.