VPN on Public Wi-Fi
A VPN that drops mid-upload does not tell you. A kill switch does.
What Is VPN on Public Wi-Fi?
A VPN only protects traffic while it is connected, and when the tunnel drops mid-session many apps simply reconnect without it, sending the rest of your work over the local network. HTTPS still encrypts the content, but the network sees where it goes and it leaves your company's protected route. You will connect before you work on a cafe network, watch an upload continue after a silent drop, then turn on the kill switch so the next drop stops traffic until the VPN reconnects.
What You'll Learn in VPN on Public Wi-Fi
- Connect to the company VPN before starting work on any network you do not run, including one confirmed with the venue.
- Explain what HTTPS protects on public Wi-Fi and what a VPN adds: hiding the services you reach and keeping work traffic in the tunnel.
- Recognize that many apps reconnect on their own after a VPN drop, so traffic quietly continues outside the tunnel until you notice.
- Turn on the VPN kill switch so a dropped tunnel blocks traffic instead of letting it leave over the local network.
- Check the VPN shield in the browser to confirm the tunnel is up before you send work files.
VPN on Public Wi-Fi — Training Steps
-
A table at Wrenloft
Alice has a table at Wrenloft Coffee and two packages to send to a client, Tessmoor Cider. Wrenloft prints its guest network and password on every receipt, so the name and the key come from the cafe itself, not from the Wi-Fi list. IT set up Ostmere's VPN on her laptop last week. It is installed and configured, but not connected yet.
-
Open the outbox
Ostmere sends client files through its own transfer service. Alice opens her outbox, where both Tessmoor Cider packages are waiting.
-
What the cafe can see
The outbox loads over HTTPS, so the files themselves travel encrypted. On a network someone else runs, that is not the whole picture.
-
Connect before you work
Before she sends anything, Alice connects the VPN IT set up for her. With the tunnel up, the cafe network still carries her traffic but can no longer see where it goes.
-
Send the print pack
With the shield green, Alice sends the first package: the label print pack for Tessmoor Cider, three files and 1.21 GB.
-
Watch the upload
The print pack is the big one, 1.21 GB. Alice keeps half an eye on the upload while she finishes her coffee.
-
Nothing stopped it
The pack is delivered. Before she moves on, Alice reads the delivery note and looks at the address bar again.
-
What should have stopped it?
-
Turn on the kill switch
Before she reconnects, Alice opens the VPN app and turns on its kill switch. With it on, the laptop sends nothing outside the tunnel: if the VPN is down, traffic stops instead of finding another way out.
-
Reload the outbox
The VPN is still disconnected, and the kill switch is now on. The outbox is still on screen: the browser loaded it earlier, and showing it again sends nothing. Alice goes back to the browser and reloads the page, which does have to go out over the network.
Security Framework Coverage
CWE
- CWE-300 Channel Accessible by Non-Endpoint
MITRE ATT&CK
- T1040 Network Sniffing
CIS Controls
- CIS 12 Network Infrastructure Management
NIST CSF
- PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
- PR.IR Technology Infrastructure Resilience