How to Choose a VPN for Capped VSAT: 5 Checks

Updated 15 October 2026 · vpn, vsat, data caps, ship internet

Some links on this page are affiliate links. If you buy through them we may earn a commission at no extra cost to you — it never changes which product we recommend.

How to choose a VPN that works on a VSAT connection with data caps comes down to one rule: pick the tunnel that eats the fewest megabytes of your quota and still holds a link over a geostationary satellite hop. In practice that means WireGuard over UDP, split tunneling you control, gentle keepalive settings, and a quota test you run yourself before you trust any review.

Most VPN reviews are written for home fibre, where a little extra traffic costs nothing. On a ship, the crew portal counts every byte that leaves your phone, including the bytes the VPN adds on top. This guide shows where those extra bytes come from, which settings cut them, and how to measure the real cost on your own vessel in one evening.

Why data caps change how you choose a VPN on VSAT

On capped VSAT, the best VPN is the one that costs you the least quota while staying connected. Speed is a secondary concern. On a home line you pick the fastest service. On a ship you are buying a fixed number of megabytes from the crew welfare system, and anything that wastes them shortens your month.

VSAT links also behave differently from the connections VPN companies test on. A geostationary satellite sits far above the equator, so every packet makes a long round trip. SatelliteInternet.com, in a page with no publication date that was read on 15 October 2026, puts geostationary latency above 600 ms and Starlink latency at roughly 25 to 50 ms. That gap explains why a VPN that feels instant at home can feel sluggish on a VSAT ship. It also explains why advice written for Starlink does not carry over to a traditional dome. If your vessel has switched to low orbit, the guide on running a VPN with Starlink Maritime is the better fit.

The third difference is the counter. Your crew portal does not care whether traffic is encrypted. It sees bytes going in and out of your device and subtracts them from your balance. The VPN hides what you are doing from the portal, but it cannot hide how much you are doing.

What a VPN actually adds to your data use

A VPN adds data in three ways: per-packet overhead, background keepalive traffic, and the loss of any compression the satellite provider applies. None of the sources gathered for this guide publish a measured gigabyte figure for a named VPN on a named VSAT plan, which is why the test later in this article matters.

Tunnel overhead and keepalives

Every packet that goes through a VPN gets wrapped in an extra header and encrypted. On a single web page that wrapper is small, but it is charged on every packet, all day. On top of that, most VPN apps send small keepalive packets to hold the tunnel open while your phone sits in your pocket. Keepalives help on a flaky link, and a 2026 tuning guide published on vpn.how recommends them for satellite tunnels. They also cost quota while you sleep, so the interval you choose is a trade between stability and data.

Lost compression on video and images

Some satellite services shrink video and images before they reach you, and a VPN can switch that off without telling you. A Viasat retailer page from American TV, undated when it was read in October 2026, says Viasat's Video Data Extender may fail to recognise and optimize video once a VPN hides the traffic type. The same logic applies to any operator that compresses or shapes traffic by category. If your ship's welfare system does this, a video call through the VPN can cost more of your cap than the same call outside it.

Reconnects after a satellite dropout

VSAT links drop for short spells when the dome loses the satellite behind a mast, a crane or heavy rain. Each time, the VPN has to rebuild the tunnel, and apps that stalled in the meantime retry their uploads from the start. A protocol that reconnects quickly wastes less of your quota on retries. The article on why a VPN keeps disconnecting on ship WiFi covers the causes in more depth.

How to choose a VPN that works on VSAT with data caps: five checks

The five checks below are the ones that change how many megabytes you spend. Brand names come last, because no published source has tested a commercial VPN against a real ship quota.

Check one: WireGuard over UDP

The first thing to confirm is that the VPN offers WireGuard and lets you choose it manually. A 2026 study hosted on the University of Hawaii's ScholarSpace repository measured VPNs over satellite links and found a small but consistent latency cost, with OpenVPN taking the largest throughput hit and WireGuard showing the highest overall throughput. WireGuard also runs over UDP, which the vpn.how guide from 2026 recommends over TCP for difficult satellite links. Our deeper comparison of WireGuard and OpenVPN on high-latency links explains why TCP inside a tunnel struggles on a long satellite hop.

Check two: split tunneling you control per app

Split tunneling lets you send only chosen apps through the VPN and leave the rest on the plain connection. This is the biggest data saver on a capped link. You can tunnel your banking app, email and anything you use on port WiFi, and leave video calls home outside the tunnel so any provider compression still works. Check that the feature exists on the platform you actually use, because some VPNs offer it on Android and laptops but not on iPhone.

Check three: adjustable MTU and keepalive

The VPN should let you change the MTU and the keepalive interval, or at least pick a server setting that does it for you. The 2026 vpn.how guide suggests lowering MTU to 1392, or to 1280 on harder links, and adjusting MSS so packets do not get split in transit. Fragmented packets get resent, and resent packets cost quota. A longer keepalive interval saves data when the phone is idle, and a shorter one holds the tunnel through brief dropouts, so pick one and measure.

Check four: a server near where your traffic lands

Pick a VPN server close to the shore station where your ship's satellite traffic comes down, if the ship's IT officer or the portal page tells you where that is. A server on the far side of the world adds more delay to an already long path, and slow connections cause more timeouts and more retries. If you do not know where the traffic lands, test a few servers in nearby regions and keep the one that loads a page fastest.

Check five: a refund window you can use at sea

Choose a provider whose refund terms give you enough time to run the quota test on board. Read the refund policy on the vendor's own page before you pay, and note the deadline in your phone. A VPN that looks perfect at home can fail on your ship's firewall, and you want the option to walk away. If the tunnel will not connect at all, start with six ways around a ship firewall that blocks VPNs.

What each VPN feature does to your quota

The table below sums up how each setting affects data use, speed and stability on capped VSAT. It describes how each setting works. It does not report measured results.

How to measure a VPN's real cost against your quota

The only reliable way to know what a VPN costs on your ship is to run the same task with and without it and read the portal counter both times. Nobody has published this measurement for a real ship plan, and every vessel's welfare system is set up differently.

Start by noting your remaining balance on the crew portal. Do a fixed task with the VPN off, such as sending the same set of photos to yourself or making a video call home for a set length of time. Read the balance again and write down the difference. Then switch the VPN on with WireGuard, repeat the identical task, and read the balance a third time.

Next, test idle cost. Leave the phone untouched with the VPN connected for an hour, then compare the balance with an hour of the VPN switched off. This tells you what keepalives and background reconnects cost while you sleep. Finally, if your plan slows you down after a certain amount of data, run the test again once you are in the slow tier. The research gathered for this guide recommends measuring after throttling starts, because a tunnel that copes at full speed can become unusable at the reduced rate.

If the VPN version of a task costs clearly more than the plain version, try split tunneling first, then a lower MTU, then a longer keepalive, and test after each change. For the speed side of the same problem, the guide on why a VPN makes slow ship internet even slower walks through ping and throughput checks.

Pros and cons of a VPN on capped VSAT

A VPN on capped VSAT is worth it for protecting logins and sensitive apps, and it is expensive if you leave everything running through it. Here is the honest balance.

Pros:

• Your logins stay encrypted on a shared crew network and on port WiFi, where anyone on the same network could be watching.
• Home apps behave more normally when they expect a connection from your home country.
• Browsing details are hidden from the portal operator, although your ship's IT can still see more than most people expect, as explained in what ship IT can see through a VPN.

Cons:

• It uses more of your quota, through packet overhead, keepalives and reconnects.
• It can switch off provider compression, so video through the tunnel may cost more than video outside it.
• It adds delay to an already slow link, and the 2026 ScholarSpace study found a consistent latency cost even with the best protocol.
• Some ship firewalls block it, and company policy on some vessels forbids it outright.
• A kill switch can freeze everything during a satellite dropout until the tunnel comes back.

Who should not run a VPN on capped VSAT

Some crew are better off leaving the VPN off on board and using it only ashore. If your company's IT policy bans VPNs on the crew network, follow it. A blocked contract or a disciplinary note costs far more than any privacy gain.

If your monthly quota is small and you mostly use messaging apps that already encrypt their own traffic, the VPN adds cost and little protection. The same goes for crew whose main use is video calls home on a system that compresses video, since the tunnel can undo that saving. In those cases, keep the VPN for port WiFi and banking, and switch it off the rest of the time.

Where the named VPNs fit

No source gathered for this guide has tested a commercial VPN on a real VSAT quota, so every brand has to pass the five checks on your own ship. VPNAlert's satellite comparison, undated when read on 15 October 2026, names NordVPN and ExpressVPN as recommendations, but it publishes no protocol test, no VSAT result and no data use figures for either. Treat any brand as a candidate. Confirm on the vendor's own page that it offers WireGuard, split tunneling on your device and a refund window, then run the quota test before the refund period ends. The same applies to every other VPN, and the broader roundup of VPN options for cruise ship crew is a useful starting list.

FAQ

Does a VPN use more data on VSAT?

Yes, a VPN adds some data to everything it carries, through encryption overhead, keepalive packets and reconnects after dropouts. It can also stop your satellite provider from compressing video. How much extra you pay depends on your ship's system, so run the before-and-after quota test described above.

Is WireGuard or OpenVPN better for a capped VSAT link?

WireGuard is the better default. A 2026 study on the University of Hawaii's ScholarSpace repository found WireGuard had the highest throughput over satellite and OpenVPN the largest throughput hit. Keep OpenVPN as a fallback for firewalls that block WireGuard.

Should I leave the VPN on all the time on ship WiFi?

Usually not on a capped plan. Use split tunneling to protect banking, email and work apps, and leave video calls and large downloads outside the tunnel. Switch the full VPN on when you connect to port WiFi.

Can the crew portal still count my data through a VPN?

Yes. The portal counts bytes leaving and reaching your device whether they are encrypted or not. A VPN hides what the traffic is, but it never reduces the amount charged against your balance.

Does a VPN make a throttled connection worse?

It can, because the VPN adds delay and overhead on top of a link that is already slow. No published source shows a named VPN staying usable after a VSAT plan throttles. Test your tunnel once you are in the slow tier before you rely on it.

Verdict

On capped VSAT, choose a VPN by what it costs your quota first and how fast it feels second. Insist on WireGuard over UDP, split tunneling on your own device, adjustable MTU and keepalive, and a refund window long enough to test at sea. Then let the crew portal counter decide, because no review has measured your ship's plan.

Related reading

• Connectivity at sea in 2026: costs and what you can buy yourself
• Real crew WiFi quotas and monthly data use
• Does a VPN work on Inmarsat Fleet Broadband?

About the author

Sea Current Tech is written by a working marine engineer who has lived with crew internet sold through a portal quota on a VSAT dome. This guide is built from the published sources named in the text. It does not claim any test the author did not run, and every product claim is listed in the registry below with its source. Quota is the scarcest resource on board, which is why this guide on how to choose a VPN that works on a VSAT connection with data caps puts the cap first and treats speed as the second question.

Latest updates

• Does a VPN Work on Iridium GO? (2026) Satcom Reality — our newest guide on this topic.