Does a VPN Work on Iridium GO? (2026) Satcom Reality

Updated 16 October 2026 · vpn, satellite-internet, iridium, connectivity-at-sea

Some links on this page are affiliate links. If you buy through them we may earn a commission at no extra cost to you — it never changes which product we recommend.

Does a VPN work on Iridium GO or other satcom links? On ordinary IP satellite services such as Starlink, a VPN generally works once you deal with latency and packet size. On Iridium GO, no published source we could find documents VPN support at all, so plan as if it will not work and keep the GO for email, weather and messages.

That gap matters more than it sounds. Plenty of crew and small-boat sailors carry an Iridium GO as the backup when the ship's VSAT or the yacht's Starlink goes quiet. Then they find out, usually mid-ocean, that the VPN they rely on for banking or the office laptop won't come up. This article separates what is documented from what is guesswork. It also gives you a safe way to test your own setup without burning your allowance, and it explains what to change when a VPN connects on satellite and then misbehaves.

The short answer: does a VPN work on Iridium GO?

Nobody has documented it, so assume no. We found plan listings from several resellers, and none of them mentions WireGuard, OpenVPN, IPsec or any other VPN protocol. We also found no published test, no setup guide and no failure report that settles the question for the GO.

Iridium GO also does not behave like a normal IP hotspot. The reseller plan pages sell it in "data minutes" alongside voice minutes and SMS, and a weather routing company, PredictWind, sells airtime for it. That tells you what the device is built for: small, specific jobs such as pulling a weather file or sending a text email through an app designed for a thin pipe. A VPN client expects a general-purpose internet connection that stays up. Those are very different jobs.

So the honest position is this. A VPN on a GO might connect in some setups, and it might fail in others. Until you test your own unit with your own client, you do not know which one you have.

First, check which Iridium GO you actually have

Two products carry the GO name, and they handle data in very different ways. Most of the confusion in forum threads comes from people talking about one while owning the other.

The original Iridium GO is the small puck that has been on boats for about a decade. It uses Iridium's older data service, and the speed most often quoted for it is around 2.4 kbps. To put that in perspective, moving 1 MB of raw, uncompressed data at 2.4 kbps would take close to an hour in theory. That is why the apps built for it compress everything hard and why the plans count minutes. All the plan prices in this article are for this original GO.

The Iridium GO exec is the newer, larger unit. It runs on Iridium Certus 100, which Iridium sells as an IP data service, with published speeds of up to 88 kbps download and 22 kbps upload. Those are Iridium's own figures as we understand them, so check the current spec sheet before you buy, because we did not verify them against a fresh datasheet for this update. GO exec airtime is sold on its own plans, and we did not price those here.

On paper the GO exec is the more plausible VPN carrier, because it hands devices something closer to ordinary IP data. Even so, our research turned up no published VPN test, no vendor statement and no reseller note about VPN support on the GO exec either. It is faster than the original, and it is still very slow next to Starlink or VSAT. A VPN that pulls background traffic will still feel heavy on it, and the meter still runs.

If you are not sure which unit you have, the GO exec has a touchscreen and is noticeably bigger. The original GO has a small flip-up antenna and no screen.

VPN on Iridium GO vs other satcom links, side by side

A VPN behaves very differently on each kind of satellite link. The deciding factor is whether the service hands you ordinary IP connectivity. The table below sums up what the published sources actually support as of October 2026.

Read the last row carefully. "Unknown" means nobody has published a clear answer we could check. It does not mean the VPN will fail. Our separate look at whether a VPN works on Inmarsat Fleet Broadband goes into that service in detail.

The physics behind the table is simple. A geostationary satellite sits about 35,786 km above the equator, so every packet makes a very long trip up and back down. Starlink satellites orbit a few hundred kilometres up, so the trip is far shorter. Iridium also uses low orbits, and its limits come from the narrow data channel. Distance is a smaller factor. Each of these limits hurts a VPN in a different way, which is why one fix rarely works everywhere.

Why Iridium GO is a poor fit for a VPN

The GO's billing model and its narrow data service both work against a VPN. A tunnel needs a link that stays open, carries every packet from every app, and keeps talking even when you are idle. A per-minute satellite allowance punishes every one of those habits.

Data minutes and what they mean for a tunnel

A VPN spends airtime before you do anything useful. It has to finish a handshake with a server that may be on another continent, and it sends keepalive packets to hold the tunnel open. Once it is up, everything on the device flows through it: app updates, photo sync, cloud backup, the browser tab you forgot to close.

On a link billed in minutes, as the GO plan pages describe it, that background traffic is time on the meter. Some plans make it worse by pooling the allowance. The All Road SAT and Satphonecity listings checked in October 2026 describe plans where the same pool of minutes covers either voice or data, so a VPN that sits reconnecting can eat into the minutes you kept for a call home.

Every VPN also adds a wrapper of extra bytes to each packet. On a fast link you never notice it. On a very slow link that overhead takes a bigger share of what little throughput there is, and nobody has published a GO-specific figure for how big that share gets.

Where the airtime really goes

It helps to know which part of a VPN is expensive, because the obvious suspect is the wrong one. Take WireGuard, the protocol behind many modern VPN apps. Its handshake is tiny: the opening message is 148 bytes and the reply is 92 bytes, according to the protocol's own documentation. On its own, that costs almost nothing, even at GO speeds.

The cost comes from three other places.

1. Per-packet overhead. WireGuard adds about 60 bytes to every packet over IPv4 and about 80 bytes over IPv6. A full-size packet barely notices. A stream of small packets, which is what chat apps and keepalives send, carries a much bigger share of wrapper.
2. Keepalives and rekeys. WireGuard is quiet by default and sends nothing when idle. Many setup guides switch on a PersistentKeepalive of 25 seconds so the tunnel stays reachable behind routers, and that turns an idle tunnel into a steady trickle of traffic. WireGuard also refreshes its keys about every two minutes while traffic is flowing. OpenVPN and IPsec clients have their own ping and renegotiation timers, often switched on by the app without telling you.
3. Everything your device does once the tunnel is up. This is the big one. A phone that finds a working connection will start checking mail, syncing photos, updating apps and refreshing feeds. Without the VPN, the GO's own apps control what goes out. With the VPN in charge, the whole device is talking.

On a time-billed plan, the clock matters more than the bytes. A tunnel that takes a long time to connect, or keeps retrying, costs minutes even if it moves almost no data. That is why the test procedure later in this article focuses on the clock and on the counter, and pays little attention to megabytes.

What Iridium GO plans cost as of October 2026

Plan prices vary a lot by reseller, and we found no single price from the manufacturer. These are the listings we saw. Check the reseller's own page before you buy, because these figures may already have moved.

BlueCosmo's Iridium GO monthly plan page, checked in October 2026, listed US$72.50 a month for 15 minutes, US$105 for 130 minutes, and US$159 for unlimited data plus 200 voice minutes. PredictWind's airtime help page, checked in October 2026, listed US$154.95 a month for unlimited data, 150 voice minutes and 1,500 SMS messages, plus a US$49.95 SIM activation fee. All Road SAT's monthly page, checked in October 2026, listed US$65.99 for 5 minutes, US$95.99 for 75, US$119.99 for 150 and US$145.99 for unlimited.

Dividing the monthly price by the included minutes shows how expensive a misbehaving tunnel can get. These per-minute figures are our own arithmetic from the listings above. They ignore taxes, activation fees and any overage rates, which the listings price separately.

On the smallest plan, a VPN that spends three minutes trying to connect and failing would use more than half the month's allowance. On the 130 and 150 minute plans the same failed attempt costs a couple of dollars. That difference should decide whether you test at all.

The unlimited data plans remove the fear of a VPN draining your minutes without you noticing. They do not answer the compatibility question. You can pay for unlimited data and still find that your VPN client never completes its handshake, and no source we found says otherwise. Read the fair use terms on any unlimited plan too, because resellers can attach conditions to the word "unlimited" that only show up in the small print.

Other satcom links: where a VPN does work

A VPN generally works on satellite services that give you ordinary IP internet, which covers Starlink and most ship VSAT. On these links the usual complaint is a tunnel that connects and then crawls, stalls or drops. Total failure to connect is rarer. Both of the published sources we found point at the same few causes.

Starlink and other LEO links

Low-orbit links are the friendliest to a VPN, because the satellites are close and the round trip is short. Bitdefender's article on split tunneling over satellite, updated September 29, 2026, describes direct LEO latency as roughly 20 to 50 ms in its example. It also says latency climbs when traffic has to cross continents to reach a VPN point of presence. That article does not name a tested VPN, provider, location or method, so treat the figures as an illustration.

The practical lesson is to pick a VPN server close to where the satellite traffic lands. A server on the far side of the world adds a long detour to every request. At sea, your traffic usually comes down at a ground station and leaves the satellite network from a nearby gateway, which may be in a different country from the one your ship is passing. A quick way to find it is to check your public IP location with the VPN switched off, then choose a VPN server in or near that city. For setups people actually run on board, see our guide to a VPN that works with Starlink Maritime.

Starlink is also the link where the MTU stall described below shows up most often in user reports, so if your VPN works for chat and fails on big downloads, skip ahead to that section first.

GEO VSAT links

A VPN works on geostationary VSAT, but every round trip is slow. The same Bitdefender article from September 29, 2026 places GEO latency in the hundreds of milliseconds. That delay hits a VPN twice. The handshake takes longer, and protocols that wait for acknowledgements spend much of their time waiting.

There is a third, less obvious effect. Many VSAT providers speed up ordinary web traffic with acceleration equipment that works on the TCP connections passing through it. Once your traffic is inside an encrypted tunnel, that equipment can no longer see or help it. So a VPN on VSAT can feel slower than the raw overhead alone would explain. Split tunneling, which sends only the apps that need protection through the VPN, lets everything else keep the provider's acceleration.

Protocol choice matters on a high-latency link. A VPN running over TCP stacks its own retransmissions on top of your apps' retransmissions, and on a lossy GEO link the two can fight each other. UDP-based protocols such as WireGuard and OpenVPN over UDP usually cope better, when the provider lets UDP through. Our comparison of WireGuard and OpenVPN on high-latency satellite links covers which settings to change first.

Crew Wi-Fi on board: portals and blocked ports

On many ships the VPN problem starts before the satellite. Crew internet systems often sit behind a captive portal where you log in with a voucher or account. If your VPN starts before you have logged in, it has nowhere to go and fails, and some clients then retry in a loop. Open a browser, finish the portal login, and only then switch the VPN on.

Some crew systems also restrict the ports or protocols VPNs use, or apply company policy that limits tunnels on the crew network. If WireGuard fails, try your app's OpenVPN TCP option or a mode that runs over port 443, which looks more like ordinary web traffic. If nothing works, check the company's IT policy before trying harder, because getting around a deliberate block can break your contract terms.

The MTU stall: when small things load and big things don't

If your VPN connects, simple pages load, and then large downloads or heavy pages hang, suspect packet size. Bitdefender's article, updated September 29, 2026, explains that the VPN wrapper can push packets over the size the path allows. Oversized packets then fragment or stall, and you see slow loads and timeouts. Its advice is to use MSS clamping and to lower the VPN's MTU in small steps.

Windscribe's Starlink VPN guide, read in October 2026, gives a concrete starting point: an MTU of about 1400 when small requests work but larger transfers stall or pages load only partly. Windscribe sells VPNs, and this is its own troubleshooting advice. Nobody has benchmarked it independently. Still, the symptom it describes is the most common one people report on satellite links, and lowering the MTU is cheap to try.

Here is a practical way to step down without guessing.

1. Note your client's current MTU. WireGuard clients commonly default to 1420, and many commercial apps hide the setting entirely.
2. Set it to about 1400, reconnect, and load one heavy page or start one large download.
3. If it still stalls, drop by 20 or so at a time and test again after each change.
4. Stop at 1280 at the lowest. That is the minimum packet size IPv6 allows, and going below it can break IPv6 traffic.

You can also measure the path directly with the VPN off. On Windows, ping -f -l 1372 8.8.8.8 sends a 1372 byte payload with "don't fragment" set. On Linux, the same test is ping -M do -s 1372 8.8.8.8. Add 28 bytes of headers and that probes a 1400 byte packet. Raise or lower the number until you find the largest size that gets through, then subtract your VPN's overhead (about 60 bytes for WireGuard over IPv4) to get a safe tunnel MTU. On a router or firewall you control, MSS clamping does a similar job automatically for TCP traffic.

If your VPN app gives you no MTU setting, switching protocol sometimes achieves the same thing, because each protocol uses a different packet size. A travel router that runs the VPN for the whole cabin is another way to get that control.

Choosing a VPN for Starlink and ship VSAT

On IP links, the VPN itself matters less than how it behaves on a slow, shared connection. These are the features worth checking before you sail.

1. A WireGuard-based protocol. It has a small handshake, light overhead and copes well with links that change, such as a ship moving between beams.
2. Split tunneling. It saves data and keeps provider acceleration for the apps that do not need the tunnel.
3. Control over auto reconnect and the kill switch. A kill switch blocks all traffic when the tunnel drops, which is safe ashore and frustrating on a flaky satellite link. You want to choose.
4. Servers in many regions. That way you can pick one near your satellite gateway as the ship moves.
5. Enough devices on one plan for a phone, a laptop and a tablet, since crew often share one cabin connection across all three.

Two services we point crew toward for Starlink, VSAT and port Wi-Fi are NordVPN{rel="sponsored nofollow"} and Surfshark{rel="sponsored nofollow"}. NordVPN's NordLynx protocol is built on WireGuard, and its apps offer split tunneling on some platforms. Surfshark also supports WireGuard and has no device limit, so one plan covers your phone, laptop and tablet. Both are affiliate links, and we earn a commission if you sign up. Neither company says anything about Iridium GO support, and we have not tested either one on a GO, so buy them for your IP links and nothing else.

If your raw markdown renderer does not support attribute syntax, the same links as plain HTML are NordVPN and Surfshark.

When you are alongside, port Wi-Fi is often the weakest link for security, and a local eSIM data plan avoids shared networks entirely. An eSIM from Airalo{rel="sponsored nofollow"} (affiliate link) gives you mobile data in port without logging in to a terminal hotspot, and you can still run your VPN over it.

How to test a VPN on your own link without burning your allowance

The only way to know whether your VPN works on your GO or your ship's link is to test it yourself, carefully. No published test answers the question for every setup, so here is a procedure that keeps the cost of finding out low. It is written with the GO in mind, and it works just as well on a capped VSAT plan.

1. Write down your minute or data counter before you start, so you can see exactly what the test cost.
2. Confirm the link works without a VPN first by sending one short text email through the app you normally use, so you know any later failure belongs to the tunnel.
3. Switch off automatic updates, cloud sync and photo backup on the device, because a VPN carries all of that traffic once it is up.
4. Turn off auto reconnect, the kill switch and any persistent keepalive in the VPN app before the first attempt, so a failure cannot turn into a loop.
5. Pick a VPN server close to your satellite gateway, using a WireGuard-based protocol if your app offers one.
6. Start the VPN and time how long it takes to connect or give up, so you have a real number for your own setup.
7. Run one small task through the tunnel, such as sending a text email or loading one light page, and stop there.
8. Disconnect and read the counter again, so you can compare the VPN run against the baseline.
9. Stop after a failed attempt and don't let the client retry on its own, because automatic reconnect loops are where minutes vanish without you noticing.
10. Write the results down: unit, plan, VPN app, protocol, server, connect time and minutes used. The next time you need the GO in a hurry, you will know what to expect.

If the tunnel connects on an IP link but large pages stall, lower the MTU as described above and test again. If it drops every few minutes, our guide on why a VPN keeps disconnecting on ship WiFi walks through keepalive and protocol fixes.

Do the GO test in calm weather, close to land or a port, with plenty of allowance left in the month. Never run it on a passage where the GO is your only weather source.

Pros and cons of running a VPN over satcom

A VPN over satellite is useful on ordinary IP links and costly on metered ones. Here is the trade-off as plainly as we can put it.

The pros are real:

• Your traffic is encrypted on shared networks, which matters when a whole crew shares one connection.
• You keep access to services that expect a home-country address, such as some banking and work tools.
• Split tunneling lets you send only the apps that need protection through the VPN, which leaves everything else on the plain link and saves data.

The cons are just as real:

• Every packet carries extra overhead, which costs more on a slow or metered link.
• The MTU stall breaks large transfers until you find the right setting, and some users never find it.
• A distant VPN server adds latency on top of a satellite delay that is already high on GEO links.
• Unstable links force repeated handshakes, and each reconnect costs time, data and battery.
• On Iridium GO, support is undocumented, so you may pay for airtime and get nothing usable.

What to use on Iridium GO instead of a VPN

The GO does its job well when you use it the way it was designed. Its ecosystem is built around apps that compress and batch traffic so a few minutes of airtime go a long way. PredictWind's offshore app pulls weather files and routing over it, and satellite email services such as XGate compress mail before sending. Iridium's own apps handle calls, SMS and tracking.

Those apps decide what goes over the link, and that is the main reason they work where a general VPN struggles. They do not run your whole device through a tunnel, so nothing else wakes up and starts syncing.

For privacy, assume less. We found no published detail on how each GO app encrypts traffic end to end, so keep anything sensitive off the GO. Banking, password resets and remote access to work systems can almost always wait until you reach Starlink, ship VSAT or port Wi-Fi with a VPN. If a bank or employer sends one-time codes by SMS, the GO's text messaging can receive those without any internet session at all, which is often all you really need at sea.

Who should not count on a VPN over Iridium GO

Anyone whose work depends on a VPN should not treat an Iridium GO as their fallback. If your employer requires a VPN for email, remote desktop or a company file share, the GO is not a documented path to any of them. Find out before the voyage what your office accepts when the main link is down.

You should also skip the VPN test entirely if you are on the smallest minute plans and the GO is your only safety link. Your pooled minutes may be the same minutes you need for a weather file or a call in bad weather. That trade is not worth making to satisfy curiosity.

Finally, if you mainly want a VPN for streaming, social media or general browsing, the GO is the wrong tool whether the tunnel connects or not. Save that for the ship's VSAT or Starlink, and read up on what each type of connectivity at sea costs and what crew can buy themselves.

FAQ

Can I use a VPN on Iridium GO?

No published source we found confirms that any VPN protocol works on Iridium GO, and none rules it out either. The reseller plan pages we checked in October 2026 describe voice, SMS and data minutes, and they say nothing about VPNs. Test your own unit carefully before you rely on it, and assume it will not work until it does.

Does a VPN work on Starlink at sea?

A VPN generally works on Starlink because Starlink provides ordinary IP internet. The common problem is large transfers stalling, and Windscribe's Starlink guide, read in October 2026, suggests lowering the MTU to about 1400 when that happens. Picking a VPN server close to where your traffic lands also keeps latency down.

Why do pages only half load through a VPN on satellite?

This is usually a packet size problem. The VPN adds extra bytes to each packet, and packets that end up too large for the path can fragment or stall. Bitdefender's article updated September 29, 2026 recommends MSS clamping and lowering the VPN's MTU in small steps until large pages load cleanly.

Does a VPN use up Iridium GO data minutes faster?

Very likely. A VPN spends airtime on its handshake, on keepalive packets and on any background traffic from your apps, and on a plan sold in data minutes all of that runs on the meter. Some plans pool voice and data minutes, according to the All Road SAT and Satphonecity listings checked in October 2026, so a reconnecting VPN can eat into your calling time too.

Which VPN protocol is best on a high-latency satellite link?

It depends on the link and on how your provider handles UDP traffic, and no source in our research ranks protocols for Iridium GO. On IP links such as VSAT and Starlink, the protocol you choose changes how well the tunnel copes with delay and drops. Our WireGuard and OpenVPN comparison covers the settings that matter most on satellite.

Does a VPN work on the Iridium GO exec?

The GO exec runs on Iridium Certus 100, which Iridium sells as IP data with published speeds of up to 88 kbps down and 22 kbps up. That makes it a more plausible VPN carrier than the original GO, but we found no published test or setup guide for a VPN on it as of October 2026. Treat it as untested and measure your own usage before relying on it.

What MTU should I set for a VPN on a satellite link?

Start with what your client uses by default (WireGuard clients commonly use 1420) and drop to about 1400 if large pages stall, which is the figure Windscribe's Starlink guide suggests. If that still fails, step down in small amounts toward 1280, the minimum size IPv6 allows, and test a heavy page after each change.

Should I turn off VPN keepalives on a metered satellite plan?

On a plan billed by the minute or by the megabyte, yes, unless you need the tunnel held open for incoming connections. WireGuard sends no keepalives by default, and the 25 second PersistentKeepalive value many guides suggest adds steady background traffic. Also switch off auto reconnect so a failed tunnel does not keep retrying on your allowance.

Will a VPN slow down Starlink or ship VSAT?

A little, and sometimes a lot. Every packet carries extra VPN overhead, and a distant server adds a detour to each request. On Starlink the extra delay is usually small if you pick a nearby server. On GEO VSAT, where Bitdefender puts latency in the hundreds of milliseconds, a far away server makes an already slow round trip noticeably slower.

What should I use instead of a VPN on Iridium GO?

Use the purpose built apps the GO was designed for: compressed email, weather downloads and messaging apps from providers such as PredictWind or a satellite email service. Keep sensitive work like banking or remote desktop for an IP link such as Starlink, VSAT or port Wi-Fi, where a VPN is a documented, working option.

Can the ship's crew Wi-Fi block a VPN?

It can. Some crew internet systems require you to log in through a captive portal before any traffic flows, and a VPN that starts first will simply fail to connect. Some systems also restrict the ports or protocols VPNs use. Log in to the portal first, then start the VPN, and if one protocol fails, try another before giving up.

Related reading

• Why a VPN makes an already slow ship connection even slower
• How to choose a VPN that works on a capped VSAT connection
• Does a VPN actually work on Inmarsat Fleet Broadband?

Verdict

Use a VPN freely on Starlink and ship VSAT, and expect to spend a few minutes tuning MTU and server choice. Treat Iridium GO as a narrow tool for email, weather and messages, and don't plan any work around a VPN on it until you have tested your own unit and watched the counter. The GO exec is a better candidate on paper and is still untested in anything we could find. If the GO is your only backup and your job needs a VPN, sort out an alternative with your office before you sail.

About the author

Sea Current Tech is written by a working marine engineer who has spent contracts depending on whatever link the ship provides, from slow GEO VSAT to newer LEO systems. We have not run a VPN over an Iridium GO ourselves, and we found no one who has published a test we could check. That is why this page marks clearly what comes from vendor and reseller pages, what is our own arithmetic, and what is still unknown. Plan prices were checked in October 2026 and will be rechecked in January 2027. We will update the page when real test data appears, and every update starts from the same question: does a VPN work on Iridium GO or other satcom links?

Latest updates

• Why Does an Airalo eSIM Fail to Activate on a Ship? (2026) — our newest guide on this topic.