The client’s final comments arrived as my train left Manchester, but the document stopped loading the moment I turned on my VPN. I had forty minutes to approve a revised contract before the legal team began its meeting in London. The onboard Wi-Fi portal worked, my VPN displayed a green Connected badge, and every page containing the actual contract returned a timeout. I blamed the London server, switched to Amsterdam and refreshed. The document remained blank.
Ordinary websites still opened.
The train operator’s journey page loaded. Search results appeared. Even the café menu arrived quickly enough to tell me the breakfast sandwiches had already sold out.
The client portal did not move.
I tried email. New subject lines appeared, but attachments refused to download. The video-meeting link opened a white page and stopped.
The VPN was connected in the narrowest possible sense. It had created a tunnel.
The train Wi-Fi was not carrying anything useful through it.
The short answer
One passenger discussion reduced the problem to a familiar frustration: train Wi-Fi handled email, but the work VPN was “a no go.” ( Reddit ) That was close enough to my situation to confirm that the green connection badge was not the same as usable access.
I had connected in the wrong order
My first mistake had happened before the train left Piccadilly.
The VPN was set to start automatically whenever the laptop joined an unfamiliar network. It switched on as soon as I selected the onboard Wi-Fi, before the train’s sign-in page had authorised the device.
I disconnected the VPN and opened a browser.
The rail portal appeared immediately.
I accepted the terms, completed the Wi-Fi login and confirmed that the client’s public website worked without protection. That matched the operator’s instructions: join the onboard network, finish the on-screen connection process and only then start using the internet. The operator also describes the service as public Wi-Fi and advises passengers to take the usual security precautions. (Co)
For a moment, I thought the problem was solved.
I reopened the established VPN provider, selected its automatic route and returned to the contract.
The portal stalled again.
Completing the train login had fixed the first problem. It had not fixed the VPN connection itself.
That distinction mattered. It stopped me from repeatedly clearing the browser and sent me toward the part of the connection that was actually failing.
The Wi-Fi symbol hid a moving mobile network
Onboard Wi-Fi looks like an ordinary wireless network, but the connection behind it is constantly moving.
Equipment on the train reaches the internet through mobile networks outside the carriage. The system may combine several operators, but it still has to move through changing coverage, crowded cells, cuttings and tunnels. (Icomera)
The UK government’s continuing investment in rail-connectivity trials reflects the same weakness. A “super Wi-Fi” trial launched on South Western Railway routes in December 2025 was designed to improve service where conventional onboard connections remained unreliable. (Gov)
That explained why speeds rose and fell as the train moved south.
It did not explain why ordinary browsing worked while the VPN carried almost nothing.
To separate those problems, I returned to the provider I already trusted.
It had years of public history, mature applications and a large server network. London seemed sensible because the client’s systems were hosted there.
The VPN connected.
The contract page timed out.
I tried Amsterdam again, then Paris. Both routes produced respectable speed-test results. Neither downloaded the document.
The Paris server briefly opened the client portal, but the comments panel remained empty. When I tried to join the meeting, the browser displayed Establishing secure connection until the page failed.
Each server changed the far end of the route.
None changed how the tunnel entered the train’s network.
Once I saw that pattern, the server list stopped looking like the solution.
A server list could not change the tunnel
One passenger discussion reduced the problem to a familiar frustration: train Wi-Fi handled email, but the work VPN was “a no go.” (Reddit) That was close enough to my situation to confirm that the green connection badge was not the same as usable access.
The reason was straightforward. Conventional VPN traffic has recognisable connection patterns. A public network can identify or mishandle that traffic before it reaches London, Paris or Amsterdam. (Usenix)
Changing the destination did not change the type of connection leaving my laptop.
I could not observe whether the onboard system was deliberately restricting VPN traffic, prioritising other services or simply failing to carry that tunnel reliably. I could observe the result: ordinary internet access worked, the established VPN connected, and protected work traffic repeatedly stopped.
The legal meeting was now twenty-three minutes away.
I stopped choosing cities.
The contract opened before I checked the country
I opened the smaller travel backup on my laptop.
Instead of presenting a wall of server locations, it asked what kind of network problem I was facing. I selected the restricted-network preset and returned to the client portal.
The login page appeared.
The contract opened.
A row of comments loaded down the right side of the screen.
I scrolled to the final clause, compared the revised language with my notes and added the approval the client was waiting for.
Then I opened the meeting link.
The camera preview appeared.
The microphone test completed.
I sent a message to the legal team:
“I’m in. Reviewing the final paragraph now.”
The reply arrived before I had closed the chat.
At 9:26, I pressed Approve.
The portal confirmed the action and generated a timestamp. Four minutes later, I joined the meeting with the contract already in the lawyers’ hands.
That was the result I had needed from the beginning.
The established provider had offered more countries and better-known infrastructure. The smaller service gave the train network a connection it could actually carry.
Its restricted-network preset combines traffic obfuscation with an HTTP/3-based transport. In practical terms, the tunnel blended with ordinary web traffic instead of presenting the same familiar VPN pattern that had repeatedly stalled.
The explanation was brief because the outcome was visible.
The comments loaded.
The approval registered.
The meeting connected.
Once those three things happened, I stopped watching the VPN badge.
The connection survived the tunnel outside Milton Keynes
The meeting continued as the train accelerated south.
A lawyer shared her screen and moved through the final changes. The picture softened occasionally, but the audio remained clear enough to follow.
Then the train entered a tunnel.
The onboard Wi-Fi disappeared.
My laptop switched to a phone hotspot I had used earlier in the week. The shared screen froze, and the lawyer’s voice dropped out.
I expected the VPN to disconnect and the meeting to throw me back into its waiting room.
Instead, the audio returned first.
The screen followed.
The protected session recovered without asking me to reconnect or choose another server. The service’s HTTP/3 transport uses QUIC, allowing the connection to continue when the laptop moves from one network path to another. (IETF)
By the time the train emerged, the meeting had carried on past the interruption.
Nobody asked whether I had left.
That recovery was not the reason I had first opened the app. The contract had already been approved. It solved the next problem naturally: a useful train connection had to survive the train behaving like a train.
The smaller service has fewer locations, fewer independent ratings and a shorter public history than the established provider I tried first. That is its clearest limitation.
But the larger provider’s map had encouraged the wrong response. Every failure sent me toward another city, even though the failure occurred before London, Paris or Amsterdam could matter.
The established VPN connected but could not carry the work. The smaller app changed the connection itself, opened the contract and kept the meeting alive when onboard Wi-Fi gave way to mobile data.
By the time we reached Euston, I understood what UK train Wi-Fi had actually been testing.
Not how many servers my VPN could offer.
Whether one protected connection could remain useful long enough for the contract—and the train—to reach London.
Questions this experience may leave you with
What was actually causing the problem?
One passenger discussion reduced the problem to a familiar frustration: train Wi-Fi handled email, but the work VPN was “a no go.” ( Reddit ) That was close enough to my situation to confirm that the green connection badge was not the same as usable access. (Reddit)
Why did the obvious fixes fail?
The Paris server briefly opened the client portal, but the comments panel remained empty. When I tried to join the meeting, the browser displayed Establishing secure connection until the page failed.
What should you check first?
The reason was straightforward. Conventional VPN traffic has recognisable connection patterns. A public network can identify or mishandle that traffic before it reaches London, Paris or Amsterdam. ( Usenix ) (Usenix)
What finally changed the result?
That recovery was not the reason I had first opened the app. The contract had already been approved. It solved the next problem naturally: a useful train connection had to survive the train behaving like a train.
What is worth remembering?
The protected session recovered without asking me to reconnect or choose another server. The service’s HTTP/3 transport uses QUIC, allowing the connection to continue when the laptop moves from one network path to another. ( IETF ) (IETF)