What to Do When Your VPN Is Blocked: 6 Ship Firewall Fixes

Updated 12 October 2026 · vpn, ship wifi, crew connectivity, cybersecurity

Some links on this page are affiliate links. If you buy through them we may earn a commission at no extra cost to you — it never changes which product we recommend.

When a ship's firewall blocks your VPN, the first thing to fix is the order you connect in. Join the ship's WiFi with the VPN off, finish the login page, and only then switch the VPN on. If it still fails, find out whether the network allows VPN traffic at all, talk to whoever runs it, and only after that try another protocol or an obfuscation mode.

Most of the time that sequence settles it within a few minutes. When it doesn't, the block is usually deliberate, and you need a different plan. The rest of this guide covers why a VPN that works at home dies onboard, the six fixes in the order worth trying, and what to do once you've tried them all and the connection is still dead.

Why a ship's firewall stops a VPN that works fine ashore

Whoever manages a ship's network controls one shared satellite link, and they decide what kind of traffic goes through it. At home your router passes almost everything. A ship's network is filtered on purpose, because a single expensive pipe is shared by everyone onboard and the operator wants to keep it predictable.

A VPN can fail at several points along the way, and they're worth separating because each one has a different fix.

The first point is the captive portal, the login or purchase page that pops up when you join the WiFi. Until you get past it, the network holds back almost everything else. A VPN that tries to start before you've authenticated has nowhere to go. Some VPN settings make this worse: Seafy warns that an always-on VPN or a kill switch can stop the login page from loading at all, which leaves you stuck between two locks.

The second point is the firewall rules themselves. A filtered network typically lets ordinary web browsing through and drops traffic on ports and protocols it doesn't recognise or doesn't want. Many VPN protocols use their own ports and their own handshake, so they're easy to spot and easy to drop.

The third point is plain policy. Some operators simply don't support VPNs. Carnival's internet plans page says VPN connections are not supported and that onboard settings can't be changed for you. MSC Cruises says the correct functioning of VPNs and corporate remote-access systems can't be guaranteed onboard. Third-party reports from GigSky say Norwegian Cruise Line allows VPN use on a higher-tier package, so the rule can depend on what you paid for.

There's one gap here that matters to crew. Nearly every published VPN policy comes from cruise lines writing for passengers. Crew welfare networks on tankers, bulkers and container ships are set by the company and its connectivity provider, and nobody publishes those rules in one place. If you work on a cargo vessel, the cruise line examples show you the kinds of rules that exist. They don't tell you what your own ship allows. For how the crew network usually sits apart from the ship's operational systems, see our explainer on how crew WiFi is separated from the ship network.

The six fixes for a VPN blocked by a ship's firewall

Work through these in order. The early ones are free, quick and allowed everywhere. The later ones cost more time and sometimes need permission.

Fix one: set up and test the VPN before you sign on

Install the VPN, sign in, and test it on a normal connection before you join the ship. Several guides in the research give the same advice for a practical reason: a ship's portal may stop you downloading the app or completing the account setup once you're onboard.

Do the full setup while you still have a decent connection at home or in the airport. Install the app on every device you plan to use, log in, connect once, and note which protocols the app offers. If the app has an obfuscation or stealth setting, find where it lives in the menus now, while you can still search the provider's help pages.

Fix two: log in to the portal with the VPN off

Connect to the ship's WiFi with the VPN switched off, complete the portal login or package purchase, and then turn the VPN on. MSC's own connection instructions spell out "VPN OFF" during this step, and Seafy's troubleshooting guide says the portal may need to be finished before the VPN can start.

If your VPN app has a kill switch or an "always on" setting, pause it during login. Once the portal accepts you, open an ordinary website to confirm you have internet, then start the VPN. This single change fixes more "blocked VPN" complaints than anything else, because the block was never the firewall. The VPN was just starting too early. We cover this failure in more detail in why port WiFi captive portals block your VPN connection.

Fix three: find out whether VPN traffic is allowed at all

Ask the person who runs the network whether VPNs are allowed on the crew package before you spend an evening on settings. On a cruise ship that's the onboard internet desk. On a cargo ship it's usually the master, the officer responsible for IT, or the company's IT department ashore.

Carnival's page tells remote workers to raise connection limitations with their employer's IT department. The same advice works in reverse for crew: your employer's IT team runs the network, so they're the people who can tell you whether a VPN is blocked by design, allowed on a different tier, or blocked by mistake. A mistake can sometimes be fixed. A design decision usually can't, and it's better to learn that before you start working around it.

If you're worried about what the IT team can see once you're connected, our article on whether your ship's IT department can see what you do through a VPN explains what stays visible.

Fix four: restart cleanly when the connection hangs

When the portal won't load or the VPN sits on "connecting" forever, do a clean restart before you change anything else. MSC and Seafy both describe the same basic routine: restart, reconnect to the WiFi, clear the browser cache if the portal page won't appear, and contact onboard support if it still fails.

A clean restart means turning WiFi off, forgetting the network if your phone keeps a stale login, joining again, logging in with the VPN off, and then starting the VPN. Satellite links drop and recover all the time, and a VPN that lost its session during a dropout can hang without telling you. Seafy also suggests a speed test site such as Speedtest.net to check whether the link itself is alive. That tells you if the ship has internet at the moment. It tells you nothing about whether your VPN is allowed.

If your VPN connects but keeps falling over, the cause is often the link and not a firewall rule. Our guide to why a VPN keeps disconnecting on ship WiFi walks through the usual causes.

Fix five: change protocol or turn on obfuscation, if the rules permit it

If VPNs are allowed but yours still won't connect, switching protocol or turning on an obfuscation mode is the next thing to try. Published guides recommend changing protocols, using a stealth or obfuscation setting, or picking a TCP or HTTPS-compatible option so the VPN looks more like ordinary web traffic.

The reasoning is simple. A firewall that only lets normal web traffic out will drop a protocol it doesn't recognise, while a VPN that's set up to look like web traffic has a better chance. A Reddit user reported that different carriers block different ports and protocols, which fits that picture, but it's one person's experience and proves nothing about your ship.

Read the condition in the heading again before you try this one. Changing a protocol on a network that allows VPNs is ordinary troubleshooting. Using obfuscation specifically to get round a network that has banned VPNs is a different decision, and on a company vessel it can end up as a conversation with the master. If you want the technical background on protocols over satellite, see our comparison of WireGuard vs OpenVPN on high-latency links.

Fix six: know your fallback when nothing gets through

If the VPN still won't connect after all of this, stop trying and switch to a fallback. None of the published guides cover this step, though it's where crew spend most of their frustration.

There are four realistic fallbacks.

Do the sensitive task in port. Banking, password changes and work logins can usually wait for mobile data ashore. A local eSIM in port gives you a connection the ship doesn't control.

Use the connection without the VPN for low-risk things. Messaging apps and most banking apps already encrypt their own traffic. Leaving the VPN off for a family video call is a reasonable trade.

Ask IT for a specific exception. If you need a VPN for a course, an exam portal or a second employer, a named request with a reason is far more likely to get approved than a general "please unblock VPNs".

Pause when the VPN drops. Seafy advises stopping sensitive activity until the VPN reconnects. Don't let the app fall back to an unprotected connection in the middle of a login.

A tempting option is to skip the ship's network altogether with your own hardware. One remote-work guide says plainly not to bring a Starlink terminal or a personal router to bypass ship WiFi, and none of the sources confirm that any operator permits it. On a working vessel, connecting your own equipment without permission is a much bigger step than changing an app setting. If you're thinking about it, read our honest take on a Starlink Mini in a crew cabin first.

Symptoms, likely causes and what to try

Most blocked VPNs fall into a handful of patterns, and you can usually tell which one you have from what you see on screen.

Obfuscation modes compared: what the sources actually say

Each of the three big VPN brands that come up in this research advertises a mode meant to disguise VPN traffic. None of them has published proof that it gets through a particular ship's firewall. The only source for all three is the EarthSIMs cruise VPN roundup, which is a third-party list, not a test.

Two of these have partner links on this site, and we earn a commission if you sign up through them. NordVPN lists obfuscated servers, and Surfshark lists Camouflage mode, according to the EarthSIMs roundup. Treat either one as something to test in port before you sign on. For a broader comparison of providers, our pillar guide to the best VPN for cruise ship crew covers free and paid options.

Honest pros and cons of working around a ship's VPN block

Trying to get a blocked VPN working is sometimes worth it and sometimes isn't, and it helps to weigh both sides before you spend your off-watch hours on it.

The pros:

• Privacy on a shared network. A working VPN hides your traffic from other users on the same crew WiFi.
• Access to home services. Some banking and government sites behave better when you appear to be in your home country.
• Lower risk on public networks. The habit carries over to port WiFi, where the risk is higher.

The cons:

• It may break the rules. Where the operator has banned VPNs, getting round the block can break the network policy you agreed to.
• It costs speed. A VPN adds overhead to a link that's already slow, and Disney's guidance as reported by GigSky says ship speed may not fully support VPN use.
• No guarantees. MSC says VPN functioning can't be guaranteed, and nobody has published success rates by ship or operator.
• It can lock you out of the portal. A kill switch left running can stop you logging in at all.
• It burns time you could spend calling home. An evening of protocol switching is an evening of not using the connection you paid for.

Who should not try to get around a ship's VPN block

Some crew are better off leaving the block alone. Skip the workarounds in fix five and fix six if any of these apply to you.

If your company's IT or cyber policy says no VPNs on the crew network, follow it. Ships are under growing cyber-security scrutiny, and a crew device doing something unusual on the network stands out for the wrong reasons.

If you only want a VPN to stream shows from your home library, the speed trade-off will probably disappoint you anyway. Our guide on watching Netflix on a ship covers downloads, which hold up better than streaming over satellite.

If you need a VPN for a second job or a corporate remote-access system, don't plan your income around ship WiFi. MSC's warning about corporate remote access applies broadly: you can't count on it working.

FAQ

Why does my VPN work at home but not on the ship?

A ship's network is filtered on purpose, and a home router usually isn't. The ship may hold back traffic until you finish the captive portal, drop VPN protocols it doesn't recognise, or ban VPNs as a matter of policy. Start the VPN only after you've logged in to the portal, then check with the operator whether VPNs are allowed.

Is it allowed to use obfuscation to get past a ship's firewall?

That depends on your ship's network policy and your employer. Changing protocol on a network that permits VPNs is normal troubleshooting. Using obfuscation to get round an explicit ban is a policy decision, so ask the IT contact first.

Will paying for a premium WiFi package unblock my VPN?

Sometimes it will, depending on the operator. Third-party reports say Norwegian Cruise Line ties VPN use to a higher-tier package, while Carnival says VPN connections aren't supported at all. Crew packages on cargo ships follow company rules that aren't published, so ask before you pay.

What should I do if my VPN drops in the middle of a banking session?

Stop the session and wait for the VPN to reconnect before you carry on. Seafy advises pausing sensitive activity until the VPN is back. If drops are constant, save banking for mobile data in port.

Can I bring my own router or satellite terminal to avoid the ship's firewall?

You shouldn't count on it. One remote-work guide says not to bring a Starlink terminal or personal router to bypass ship WiFi, and no source confirms that any operator permits it. On a working vessel, connecting your own equipment needs the master's or the company's approval.

Related reading

• How seafarers stay connected at sea, our overview of what crew connectivity costs and what you can buy yourself.
• Why a VPN makes an already slow ship connection even slower, for when the VPN connects but crawls.
• How to set up a VPN on a ship's router without admin access, for the workarounds and where they stop.

Verdict

The fix that solves the most cases is also the dullest one: log in to the ship's portal with the VPN off, then start it. After that, ask before you tinker, because the answer to "is this blocked on purpose?" decides everything else. Protocol changes and obfuscation are reasonable on networks that allow VPNs. On networks that don't, your fallback is port data and patience.

About the author

This guide comes from the Sea Current Tech team, whose lead author is a working marine engineer who writes about connectivity and digital life onboard. Nobody here tested these VPN modes on a specific vessel for this piece. Every product statement above is therefore marked in the list below as either the vendor's own word or a third-party report, so you can judge how far to trust it. The order of the steps comes from how ship networks are built. Your ship's own rules decide the rest of what to do when your VPN is blocked by a ship's firewall.

Latest updates

• Does a VPN Work on Iridium GO? (2026) Satcom Reality — our newest guide on this topic.
• How to Choose a VPN for Capped VSAT: 5 Checks — our newest guide on this topic.
• Best eSIM for Seafarers: Be Your Own 2-Layer Backup (2026) — our newest guide on this topic.