The Best VPN for My Raspberry Pi Was the One the Hotel Wi-Fi Would Let Me Use

The Raspberry Pi controlling our exhibition entrance still showed the wrong opening time, and the press preview began in forty-one minutes. I was three hundred kilometres away, sitting on the floor beside a hotel-room desk because it was the only place the Wi-Fi remained stable. The Raspberry Pi Connect dashboard loaded, but the remote session stayed on Negotiating connection. I blamed the Pi, restarted the browser and tried the established VPN on my laptop. It never moved beyond Connecting.

The mistake on the screen was small enough to be embarrassing and large enough to matter.

Our exhibition occupied several rooms in a converted industrial building. Raspberry Pi 5 units powered the entrance display, room schedules and two interactive information stations. The evening before the press preview, someone had changed the opening time in the master schedule but exported the old version to the entrance display.

At 8:19 the next morning, a colleague sent me a photograph.

The screen still said Doors Open 11:00.

The journalists were arriving at 9:00.

Normally, fixing it would have meant replacing one file through a remote shell. We had also prepared the entrance Pi for Raspberry Pi Connect’s remote-update system, introduced in March 2026. It allows a prepared operating-system image to be sent to a supported device from a distance, with an A/B boot setup that keeps the existing system available while the new image is deployed.1

That feature had changed how we used the Pi. It was no longer a hobby computer someone had to visit with a keyboard. It had become a field device we expected to manage wherever the team happened to be.

Connect had also added tools for larger deployments, including device tags and required two-factor authentication for organisation accounts.2 Our entrance display appeared in the dashboard as EXHIBITION–LOBBY–EAST.

The device was online.

The route from my hotel room to that device was not.

The established VPN could not cross the hotel network

The large provider was the obvious first attempt.

It had a long public history, a broad European server network and far more independent reviews than the smaller services on my laptop. I had used it in airports, cafés and rented apartments without giving the connection much thought.

The hotel Wi-Fi exposed its weakness immediately.

I selected the automatic server.

The app waited, retried and failed.

I switched to Germany, then the Netherlands. Neither tunnel completed. Ordinary websites loaded, email worked and the Raspberry Pi Connect dashboard continued to show the entrance device as online. The VPN itself could not establish a route.

I disconnected it and tried Connect directly.

The remote shell remained on Negotiating connection before returning an error. Connect uses an encrypted real-time session between the browser and the Raspberry Pi, but that session still needs a usable path through the local network.3

The hotel allowed enough traffic to show me the Pi.

It did not allow me to control it.

I tried my phone hotspot. The remote shell opened, proving that the Pi and my Connect account were working. But the mobile signal inside the room was weak, and the prepared update image sat on our team server. At the speed shown, downloading and deploying it would take longer than the time remaining before the preview.

I carried the laptop into the corridor.

The signal improved briefly, then fell when the lift doors closed. Back inside the room, the hotspot returned to one bar.

Hotel Wi-Fi had the capacity.

Mobile data had the route.

Neither gave me both.

For owners of headless Raspberry Pis, that is the moment remote access becomes physical access: somebody needs to find a monitor, keyboard or cable and stand beside the device.4 Nobody at the exhibition had time to do that. My colleague was arranging press packs, briefing the front desk and trying to clear a delivery van from the entrance.

I had thirty minutes left.

The smaller app opened the route I already needed

The second option was OnlydogVPN^↗.

I had installed it as a backup for restrictive hotel and conference networks, then mostly forgotten it was there. It had fewer server locations and a shorter public history than the established provider, but it approached the connection differently.

The first screen did not ask me to choose a country.

It asked what kind of network problem I was facing.

I selected the restrictive-network preset.

The app connected over the same hotel Wi-Fi that had rejected the earlier attempts.

I reopened Raspberry Pi Connect. The entrance device appeared under its tag, and this time the remote shell opened.

The prompt arrived:

lobby-east:~ $

That single line changed the morning.

I ran a status check. The Pi was online, its storage was healthy and the display process was active. The wrong image was exactly where I expected it to be.

I could have replaced the file manually, but the prepared update image already contained the corrected schedule and the latest kiosk configuration. It had been tested the previous night, so deploying it was safer than making several hurried edits through the shell.

I opened the update panel, selected EXHIBITION–LOBBY–EAST and chose the signed image from our server.

The upload began.

Ten percent.

Thirty-eight.

Sixty-four.

The hotel connection hesitated. The progress indicator stopped for several seconds, then continued.

At 100 percent, Connect showed that the image had been received and verified. I started the deployment.

The Pi rebooted.

For a minute, the device disappeared from the dashboard. Then its status returned, followed by the remote shell.

I ran the display check again.

The updated schedule was active.

A message arrived from my colleague with a photograph taken from the entrance:

Doors Open 09:00

Below it, she had written: “Press just arrived.”

The task was complete. The correction was no longer waiting on my laptop or sitting in a cloud folder. It was visible on the Raspberry Pi-powered screen where visitors would read it.

The smaller app had not replaced Raspberry Pi Connect or changed the device’s operating system. It had supplied the missing piece: a protected route through the hotel network to the remote-management tools already in place.

Its restrictive-network mode concealed the familiar VPN pattern that had stalled earlier. I could not inspect the hotel’s internal filtering rules or identify the exact rule that separated the two attempts. The visible difference was enough: the established provider never reached a working tunnel, while the smaller app connected and delivered the update before the preview began.

The session followed me into the corridor

Once the entrance display was corrected, I checked the other exhibition devices.

The room-schedule Pis were still running the previous image. They did not contain the wrong opening time, so they could wait until after the press tour, but I wanted to confirm that they were online.

Then the hotel Wi-Fi disappeared.

A housekeeping cart had stopped outside the room, and when I stepped into the corridor to ask whether the floor’s access point was being restarted, the laptop moved out of its strongest coverage area.

I enabled my phone hotspot.

The VPN paused, recovered on mobile data and returned me to the same Connect dashboard. The device list remained open, and I completed the checks without rebuilding the remote session.

That was not the main result. The corrected entrance screen had already justified the app. The network handoff simply gave me a reason to keep it installed.

Remote Raspberry Pi work rarely happens from one perfect connection. It happens from hotel Wi-Fi, a phone hotspot, a train, a client office or the corner of an exhibition hall. When the administrator’s connection changes, restarting the entire remote session can turn a small interruption into another support problem.

The service’s HTTP/3-based transport is built to recover across those changes. In the corridor, the technical explanation reduced to one useful result: the Wi-Fi disappeared, the phone took over and the Pis remained within reach.

The best Raspberry Pi VPN did not need to run on the Pi

The established provider still offered more locations, more reviews and a longer operating history. The smaller app’s shorter public record remained its credible limitation.

But the exhibition failure was not caused by a missing Raspberry Pi feature.

The Pi was connected. Connect was configured. The update image was prepared, and the device was ready for remote deployment. Installing another commercial VPN directly on the Pi would have added complexity to a field device that was already working.

The actual failure was on the administrator’s side.

The established provider presented a large server map but could not establish a tunnel through the hotel Wi-Fi. The smaller app opened a usable route, reached the tagged Pi and carried the corrected image to the entrance before the first journalist walked through the door.

For that Raspberry Pi deployment, the best VPN was not the one with the most elaborate Linux configuration. It was the one that let the remote-control plan work from the hotel room where the emergency actually happened.