Does a VPN Actually Work on Inmarsat Fleet Broadband? (2026)

Updated 23 September 2026 · vpn, inmarsat, satellite internet, ship connectivity

Some links on this page are affiliate links. If you buy through them we may earn a commission at no extra cost to you — it never changes which product we recommend.

Does a VPN actually work on Inmarsat Fleet Broadband? Yes. Inmarsat's own FleetBroadband best practices manual (publication date not stated) reports that several kinds of encrypted connection ran successfully over the service: IPsec, L2TP, SSL (the encryption method that protects most secure websites) and HTTPS (encrypted web browsing, the padlock in a browser's address bar). The harder questions are what that "tunnel" — the private, encrypted pathway a VPN builds for your data — costs in airtime, which is the per-megabyte or per-plan fee a satellite provider charges; which single terminal setting can block the tunnel; and which everyday jobs still work once it is up.

Most pages on this topic stop once they have answered the compatibility question. They skip the things that decide whether a VPN is worth running: a slow shared satellite channel, a bill charged by the megabyte, and a terminal that may need one setting changed before any tunnel comes up. This guide covers each of those using the vendor's documents and published airtime tariffs, and it says plainly where nobody has published measured results.

If Fleet Broadband is only the backup link on your ship, and the main connection is VSAT (a different kind of satellite dish system many ships use as their primary internet) or Starlink, this VPN guide is not the place to start. Read the overview of what connectivity at sea costs and what crew can buy themselves first, because that bigger picture matters more when Fleet Broadband is just the backup.

Does a VPN work on Inmarsat Fleet Broadband at all?

Yes, a VPN works on Inmarsat Fleet Broadband, and Inmarsat itself is the source for that claim. Inmarsat's best practices manual (date not stated) lists successful tests of IPsec, L2TP, SSL and HTTPS — the main families of connection-encrypting technology. It also names VPN software it tested from four security vendors: Check Point, Cisco, Netscreen and Nortel. It further lists PPTP, an older method for building encrypted tunnels that is now considered weak and easy to break into, so it is worth avoiding for anything sensitive even though it is on the tested list. The manual describes the standard business use too: crew members on a vessel connecting through the tunnel to their company's network back on shore.

A Fleet Broadband product brochure also advertises secure VPN access to email, internet and intranet (an internal, company-only network) services. The vendor treats VPN traffic as a normal job for the service, not an unusual one.

The limits of that evidence matter. Inmarsat's manual lists which types of connection passed its test, but it does not say how many ships or devices were tested — the "sample size" — and it publishes no success rate or description of how the testing was carried out. It also says nothing about the consumer VPN apps most people install on a phone today. The fair reading is that the main families of VPN technology have been shown to work in some form. Your own app, terminal and firmware — the built-in software that runs the terminal itself — still need a small, low-cost test before you trust them with real work.

What Fleet Broadband gives a VPN to work with

A VPN running on Fleet Broadband has to share a narrow satellite connection, and every signal makes a long round trip to a satellite roughly 22,000 miles above the ship and back. A VPN cannot avoid either limit; it inherits both. Inmarsat describes the underlying service as maritime satellite IP — internet-style data delivery carried over a satellite link — for email, internet access, electronic charts and weather reporting.

Viasat's FleetBroadband product page (Viasat; dated September 2, 2026) describes two ways to buy the service. One is a shared, "contended" service, meaning your speed depends on how many other ships are drawing on the same satellite beam at the same time. The other, available to some users, is a guaranteed data rate chosen to suit a specific application, at a corresponding price.

The speed figures are modest. "kbps" means kilobits per second, a measure of data speed; at full speed with nobody else sharing the channel, sending a single 5 MB email attachment at 432 kbps takes roughly a minute and a half. An Inmarsat FleetBroadband brochure, hosted by the reseller Castor Marine (publication date not stated), lists secure VPN access at up to 432 kbps over a shared channel. A Satmarin product listing (date not stated) gives streaming IP rates of up to 256 kbps. Both figures are service specifications, not measured VPN results, and nobody has published a test of what a VPN actually achieves on this link. On a shared channel, that top speed is a ceiling every device on board draws from at once, so real-world speed during a busy watch is often lower than the advertised number.

A few consequences follow for anyone planning to run a tunnel. A VPN adds no capacity of its own. Encryption and the extra data a VPN adds to each packet (called headers) make each packet a little larger, so the same job moves more bytes over the same connection.

A VPN also cannot shorten the trip to a geostationary satellite and back. Every handshake, login and page request still waits on that round trip, and some VPN setups add handshakes of their own. Our piece on why a VPN makes a slow ship connection even slower explains the protocol and packet-size side of that in more detail.

Finally, a VPN does not remove airtime charges and cannot keep the link from dropping. The satellite link sets the speed and the bill, and the tunnel sits on top of it.

Which VPN protocols Inmarsat says were tested

The protocols Inmarsat reports as working over Fleet Broadband are IPsec, L2TP, SSL and HTTPS, so start with those. The table sets the tested list against what each option is normally used for on a ship and the Fleet Broadband problem to watch for.

Most readers care about the last row, and it is the one without published data. If you use a consumer VPN app, treat the first session on Fleet Broadband as a test. Run something small and cheap before anything important. NordVPN, which uses the WireGuard-based NordLynx protocol, is one of the consumer options worth testing this way — no published Fleet Broadband result confirms it, or any other consumer app, in either direction.

Where the tunnel usually breaks: terminal settings

When a VPN fails on Fleet Broadband, check the terminal's own network settings first. The terminal sits between your device and the satellite and decides what gets through. The manual for the Furuno FELCOM 500 Fleet Broadband terminal includes a dedicated "VPN pass-through" setting, which shows that the terminal can allow or block tunnel traffic depending on how it is configured. Other terminals may call the setting something else or not have it at all, and nothing published confirms that every terminal handles every modern protocol.

Pass-through matters most for IPsec. A terminal usually translates addresses between the ship's network and the satellite side, and IPsec was designed around addresses that stay fixed. The tunnel therefore needs the terminal to pass it through untouched, or the VPN has to wrap itself to survive the translation. If a VPN app on board sits on "connecting" and never finishes, the ship's electro-technical officer (ETO, the crew member responsible for electronics) or company IT should look at this setting early on.

On most ships you will not have admin rights on that terminal — the login that lets someone change its settings. That is usually fine, because the terminal carries the vessel's business traffic and you should not be changing it. If you are working around a locked-down setup, our guide to setting up a VPN when you have no admin access to the ship's router goes through the options that stay within company rules.

Inmarsat's manual also describes a design that removes the VPN client on board altogether. Each vessel gets a static private IP address (a fixed internet address reserved for that ship, rather than one that changes) and connects to the shore corporate network over that. The manual says this can cut out VPN overhead while keeping the corporate network secure. The company and its airtime provider have to set this up, so raise it with them if the only reason for a tunnel is reaching office servers.

What a VPN on Inmarsat Fleet Broadband costs you

The VPN software is the cheap part. What you pay for is the extra data the tunnel sends over a plan that is either billed by the megabyte or slowed down after a threshold. Inmarsat's manual warns that secure protocols and related traffic generate extra network traffic and should be configured to keep overhead and cost down. It gives no overhead figure for any protocol, and none of the sources available as of September 2026 does either. The only way to know your number is to measure it on your own plan.

Airtime providers publish very different prices, so check the current page before relying on any of them. The table shows advertised monthly prices exactly as each provider published them on the date listed.

Some details in that table are worth a second look. Northern Axcess shows its 4 GB plan at US$1,830 in a service agreement dated March 9, 2026, and at US$2,230 on its airtime page dated August 7, 2026. The same provider's documents disagree, so confirm the price with the provider before you sign.

The "unlimited" plans Northern Axcess listed on August 7, 2026 include 20 GB before speed throttling. Encrypted traffic passes through the terminal like any other data. A tunnel left running all day therefore uses up that allowance faster, and the throttle applies to the tunnel just as it does to everything else.

None of these listings give enough detail on taxes, terminal costs, activation fees or fair-use rules to work out the real cost of a VPN workload. Ask the provider for the full rate sheet. For a wider view of airtime prices across services, see our maritime satellite internet price comparison.

Which daily jobs survive a VPN on Fleet Broadband

Small jobs that can tolerate delay work fine through a VPN on Fleet Broadband, while large or interactive jobs struggle. Nobody has published measured results for any of these jobs, so this section explains how the pieces interact rather than reporting benchmarks.

Email, chat and tickets

Email, text chat and support-ticket systems suit a VPN on Fleet Broadband best. They move small amounts of data and can wait out the round trip without anyone noticing. They are also the jobs the vendor's brochure names when it describes VPN access to email and intranet services.

Web portals and cloud apps

Web-based company tools usually work through the tunnel but feel slow. Each page load involves several separate requests, and every one of them waits on the satellite path. When a tool is already served over HTTPS, putting a second encrypted tunnel over it adds overhead without adding much protection, so ask company IT whether the web app can be used on its own instead.

Remote desktop

Remote desktop shows the delay more clearly than anything else, because it sends a picture of a distant screen back to you over the tunnel. Each keystroke and mouse movement travels to the satellite and back before the screen updates. Short admin tasks are tolerable, and long editing sessions become tiring. Lowering the screen resolution and color depth in the client reduces the data sent with each screen update, which helps on a slow shared channel.

Video calls

Video calls are the weakest case. A call needs a steady flow of data in both directions, and on the shared service everyone else on board is drawing from the same channel. If you have to make a call, audio only is safer than video. For applications that need a steady rate, Viasat's page describes the guaranteed-data-rate option, so ask the airtime provider how that is billed before you rely on it.

Large file transfers

Large file transfers are where the extra cost shows up on the bill, because encryption overhead is added to every megabyte sent. A dropped connection can force a full restart unless the tool can resume a transfer partway through, and on a metered plan you pay airtime rates for the entire amount sent, including any failed attempts. Compress files first and use a tool that resumes partial uploads. If the file can wait until the ship reaches port or a cheaper link, hold it until then.

Setting up a VPN on Inmarsat Fleet Broadband without wasting airtime

The best way to save airtime is to test with a small job before you trust the setup with real work. These steps follow that order.

1. Get permission first so you keep your job. On many ships Fleet Broadband carries the vessel's business traffic, so check with the master or company IT before you connect a personal device or a tunnel to it.
2. Confirm the terminal setting and skip hours of guessing. Ask whoever manages the terminal whether VPN pass-through, or its equivalent, is turned on.
3. Start with a protocol Inmarsat lists so you begin on tested ground. IPsec, L2TP, SSL and HTTPS have published results on this service, and anything else is untested.
4. Quiet the device before connecting to stop paying for background traffic. Turn off automatic updates, photo backup and cloud sync, because once the tunnel is up all of that traffic is encrypted and billed too.
5. Use split tunneling if your client offers it, to keep overhead off everything else. Split tunneling means only your company traffic goes through the VPN; the rest of your data travels normally, at its normal size.
6. Lengthen the keepalive interval if the client allows it, to cut idle traffic. A keepalive is a small packet the VPN sends periodically to hold the tunnel open while you are idle, and every one of those counts as billable data.
7. Run a small test and read the usage counter to learn your real overhead. Send a file of known size, then compare the provider's usage figure with what your device reports.
8. Find your plan's threshold so a long session does not surprise you. Check where the plan throttles or starts charging extra before you begin any big job.

Pros and cons of a VPN over Fleet Broadband

The main advantage is that the mainstream protocols are documented as working. The main drawback is that you pay for every extra byte on a slow, shared channel.

Pros

1. You start from documented compatibility, because Inmarsat reports IPsec, L2TP, SSL and HTTPS working over the service.
2. Your traffic is encrypted on a shared ship network, which protects it between your device and the VPN endpoint (the server the tunnel connects to).
3. You can reach company systems ashore, which is the use case Inmarsat's manual describes for remote users on a vessel.

Cons

1. The overhead costs real money, and Inmarsat's manual itself warns that secure protocols add traffic and cost.
2. You gain no speed and no latency improvement, because the tunnel runs on the same shared channel and the same satellite round trip.
3. The terminal can block the tunnel, and changing a pass-through setting like the one in the Furuno manual takes someone with admin rights.
4. Throttling still applies to "unlimited" plans, so a busy tunnel reaches the slowdown threshold sooner.
5. There are no public benchmarks, so latency, reconnects and call quality with a VPN on Fleet Broadband are unknown until you test them yourself.

Who should not run a VPN over Fleet Broadband

If you want streaming, gaming or heavy personal browsing, skip the VPN on Fleet Broadband. The channel is too narrow and the airtime too expensive for any of those, with or without a tunnel.

It is also the wrong tool if you are hoping a VPN will fix slowness. It adds work to every packet and cannot add capacity. Crew on ships where Fleet Broadband is reserved for business traffic should leave it alone unless the company has approved personal use.

Companies whose only reason for a tunnel is reaching office servers should look at the static private IP design in Inmarsat's manual before rolling out VPN clients to every vessel. That design moves the security work ashore and keeps overhead off the satellite link.

FAQ

Can I use a consumer VPN app on Inmarsat Fleet Broadband?

You may be able to, but no published test confirms that any specific consumer VPN service works on a particular Fleet Broadband terminal. Inmarsat's tested list covers enterprise clients and the IPsec, L2TP, SSL and HTTPS protocols. Try a consumer app with a small, cheap test first, and ask whether the terminal's VPN pass-through is enabled if it never connects.

Does a VPN make Fleet Broadband faster?

No. A VPN adds no satellite capacity and cannot shorten the round trip to a geostationary satellite. It also makes each packet slightly larger, so at best the connection feels the same, and on a busy channel it can feel slower.

Does VPN traffic use more of my data allowance?

Yes. Inmarsat's manual warns that secure protocols and related traffic generate additional network traffic and cost, and it advises configuring them to keep overhead down. No published source puts a number on it for a given protocol, so measure yours with a file of known size.

Will a VPN get around the throttle on an "unlimited" plan?

No. Encrypted traffic still passes through the terminal and counts like any other data. Northern Axcess listed its "unlimited" Fleet Broadband plans on August 7, 2026 with 20 GB included before speed throttling, so check your own provider's threshold before a long session.

Can a ship reach the office network without a VPN at all?

Yes, Inmarsat's manual describes that setup. Each vessel gets a static private IP address and connects to the shore corporate network without a VPN client on board. The manual says this removes VPN overhead while keeping the corporate network secure, and the company and airtime provider arrange it.

Verdict

A VPN runs on Fleet Broadband, the vendor documents it, and you pay for using one in airtime and patience. Pick a tested protocol, confirm pass-through on the terminal, keep background traffic out of the tunnel, and save large files and video for a faster or cheaper link. If the tunnel is only there to reach company servers, ask whether the static IP design can replace it.

Related reading

1. Read why a VPN keeps disconnecting on ship WiFi if your tunnel drops in the middle of a session.
2. Check which VoIP apps survive satellite latency at sea before you rely on a call over a slow link.
3. Compare Starlink and VSAT for crew welfare if your ship is weighing a faster main link.

About the author

This article was written by the Sea Current Tech editor, a working marine engineer who writes about connectivity and digital life on board. It draws on Inmarsat's own Fleet Broadband documentation, a Furuno terminal manual and airtime tariffs that providers published in 2026, and it points out where no measured data exists. The honest short answer to "does a VPN actually work on Inmarsat Fleet Broadband" is yes, as long as you budget for the airtime it uses.