VPN on Coworking Wi-Fi: Member Portal First, Not a Cafe Habit

A cafe is a stranger AP and a skip you can name: you came for a menu. Your employer is a named account, a laptop that may have MDM, and a tunnel into resources they run. A coworking space copies the splash from a cafe, then adds a member login, a printer on the LAN, a posted AUP, and a floor of people who are not your coworkers even if the Slack emoji says otherwise. Mixing those three in one sentence is how farms sell best VPN for remote work until the affiliate cookie expires.

The cafe habit still helps: get a real route, then start the tunnel, then open mail. The BYOD habit still helps: two full tunnels fight. The coworking twist is furniture you pay dues for and still do not own. Their SSID is not your home guest network. Their printer is not your USB-C dock at the house. Their AUP is not a suggestion from a ranking site. Read it. I am not a lawyer. This is not legal advice. It is product hygiene.

I will not walk packet sniffing again. The public Wi-Fi how-to already did. I will not sell this space a branded amenity. You are a member with a backpack. Ask staff the SSID if two names appear. Do not pick Guest because it sorted first in a hallway full of phones. Do not treat a neighbor's hotspot named after the space as the space.

Klox is a consumer tunnel to an exit you picked. It is not the coworking operator's LAN. It will not make you a floor admin. It will not replace their captive portal. Farms mash coworking next to cafes because the keyword is public. Public is not one product. A membership LAN has printers and a contract you clicked. That is the whole point of this URL.

Coworking Wi-Fi often wants a member login, an email, a voucher on a keycard, or an 'I agree' before you have a real route. Same garden as a cafe, ruder paperwork. If Smart Connect or a kill switch fires before the splash, you get no internet and no page. Disconnect. Pause fail-closed if traffic is bricked. Complete the garden. Confirm a boring site. Then connect Klox. WireGuard first. You will be naked on that LAN for a minute. That is the cost of the splash. I will not claim zero exposure.

Some spaces keep a cookie so you skip the splash until the lease ends. Some do not. Some re-auth every morning. If you already have a route, waiting is how mail fetches on their DNS. Connect. Do not perform a portal ritual that is not there. If you are not sure, load a plain site. If it hangs on a login, you are still in the garden.

Staff can reset a session. Staff can also tell you the SSID. Ask. A fake Guest in a building full of freelancers is still an evil twin. Encryption is not authentication of the floor. A tunnel on a twin is still a tunnel to a stranger. Ask the front desk the name printed on the tent. Do not pick the loudest open network in the stairwell.

The member page is also where the AUP usually lives. Read it before you tap Connect on a consumer VPN. If the text forbids proxies, personal VPNs, or 'circumvention,' treat Klox as a maybe-not on that SSID. I will not write a second paragraph that walks around that sentence. Cellular exists. Another cafe exists. The seven-day window exists if you bought a year for a desk that does not want the hop.

A full-tunnel VPN sends LAN traffic toward the VPN too, unless the client punches a hole. The coworking printer lives on their subnet. After you connect Klox, print jobs can vanish into a hop that has no idea what 192.168.x.x meant on that floor. That is expected. It is not a defect in WireGuard. You hid the LAN on purpose.

If the app shows split tunnel, bypass VPN, allow LAN, or a cousin of those words, that is the row. You can exclude the print path so the printer still answers while the browser stays in the tunnel. The exclusion is a scheduled leak. The space can see that printer hop. HTTPS on a website you print from is a different lock. Split tunnel is the hole. Confirm the glass. I will not write click-here steps that assume a Windows radio button we did not confirm in your build. The VPN Split Tunnel in Plain English: An Exception, Not a Second VPN page owns the vocabulary.

If the row is missing, pause the whole tunnel, send the job, restore the tunnel. Two minutes of clear for a PDF is ugly. It is also honest. Do not hunt for a hidden lab mode because a farm screenshot had three toggles. Do not install a second VPN 'just for printing.' That is how you get two default routes and a Tuesday on split brains.

I will not tell you to scan their subnet, map their printers, or poke at a VLAN you were not invited to. Print the document you came to print. Use the queue they posted. If printing is broken even with Klox off, that is their LAN, not our handshake. Ask staff. A consumer tunnel is not a print server.

Some members also run an employer VPN or ZTNA client. Corporate tunnel is a door into resources the employer runs. Klox is a consumer hop for a LAN you do not trust. One laptop can physically run both. That does not make them friends. Two default routes fight. Two DNS stacks fight. Two fail-closed switches fight. The symptom looks like nothing loads, or intranet timed out, or the VPN is broken. The cause is two products claiming one NIC.

I will not invent a Klox work mode that stitches them. We do not ship employer ZTNA as a consumer line item. If the AUP at work says only the company tunnel, use that tunnel. Keep Klox on a personal phone. If the coworking AUP also forbids a personal VPN, you have two documents. Read both. The hotter no is the one you obey on that SSID.

If both policies allow a personal VPN when the work client is off, off means off. Stacking them because a farm said always-on is how you spend a day on split routes. Sequence: member page, then one tunnel. If you need SharePoint behind a company gateway, you needed the company client, not Klox. If you need the hop hidden from the coworking LAN and you do not need intranet today, Klox is the one, and the work client stays down.

The BYOD article is the longer two-tunnel essay. This page only exists so you do not treat a hot desk as a cafe and then stack tunnels because the office VPN icon was already in the tray. Tray icons lie. Look at which handshake actually owns the default route.

A kill switch is fail-closed: if the tunnel dies, nothing else leaves. On a laptop at home that is often what you want. On coworking Wi-Fi it collides with the member splash, with printers you paused for, and with a radio that drops when the all-hands fills the band.

Deadlock looks like this. Auto-connect starts WireGuard. Handshake fails because the portal has not blessed you. Kill switch blocks the HTTP the portal needs. You toggle random settings. You tell the community manager the Wi-Fi is down. The product did what you asked. You asked for a brick until the tunnel exists. The tunnel cannot exist until the brick is lifted.

Pause the switch for the garden. Restore it after the tunnel is up if you still want fail-closed on a radio that will drop. If you cannot live with a pause, skip kill switch on coworking days and accept a leak window on drop. That is an adult trade. Pretending fail-closed and captive portals are friends is how tickets get written.

Coworking APs are shared. They roam. They rate-limit. A podcast recording in the booth next door is not a VPN bug. Fail-closed will cut you more often than at home. That is not a defect in WireGuard. It is a floor with eighty laptops.

A coworking table is usually one laptop. Sometimes a phone on the same SSID. That is one seat, or two if both tunnels are up. Klox is five. You can install in more places. Only five can be connected at once.

The tablet you left at home on auto-connect still counts if it is holding a session. Ghost phones count. A router at home holding a tunnel counts as one seat and then covers a house, which is a different article. For the hot desk: disconnect what is not in the bag, or live with an error when the sixth handshake tries.

I work with a laptop. That is the kit. I do not need a family seating chart to know one is one. If a phone also joins the member SSID, you are at two. Still fine. If a work laptop is a second machine in the same bag, count before you sit down. The work laptop may not be allowed to run Klox at all. That is the BYOD page, not a sixth seat.

Remove retired devices in the portal. Sleep is not disconnect. A laptop lid can keep a peer. Open the app and look. Do not assume the coworking cap is why you hit five. The cap is often a tablet on the couch.

The farm copy still talks as if 2012 HTTP is the default web. It is not. Your bank, your mail web UI, your work chat: TLS. RFC 8446 is how a lot of that encryption works. Contents of the page are not a gift to the person at the next hot desk running Wireshark for fun.

What the space still gets, without a VPN, is the fact of a hop. Destination IP. Often the name in SNI. DNS if your queries are not inside some other encryption. That is a map of who you talked to, not the password you typed into the form. People mash those together because both sound like they can see me. Split them.

A VPN hides that map from the coworking LAN by making the interesting hop a VPN server. The space sees encrypted traffic to that server. Member logs, badge readers, cameras over the desk: those are not VPN problems. If your threat is a person in the room, sit differently. If your threat is the LAN, tunnel. If your threat is the site, that is the site.

Klox routes DNS through the tunnel. Features also lists IPv6 leak protection and WebRTC leak blocking. Those matter after you are connected. They are not a reason to skip the member-page sequence. They are why a connected session is more than HTTPS was on anyway. A tunnel does not hide that you were in the building. Dues and a badge already did that.

Skip if you do not join their Wi-Fi. Use cellular. Use a phone hotspot you run. That is the clean skip. Skip on the AP if the session is throwaway and you know it: one search for the meeting-room screen, a PDF they posted, a site you would show a stranger anyway. I still connect for mail and work. I do not connect to argue about the physics of a skip.

Skip is also the honest answer when the AUP forbids a personal VPN. I will not write a workaround. I will not tell you to obfuscate, hop protocols to hide the fingerprint from their filter, or dual-home so the logs look clean. If the posted rules say no, stay off the hop on that SSID. Cellular. Another network. Or accept their LAN and keep the session boring.

Skip is not I am good at security. Skip is this packet is boring, or this network does not want the product. If you cannot tell those apart, do not skip for vanity. Connect after the portal, or leave. The habit is cheaper than a story about how careful you are.

Do not skip because the app felt slow once. Switch protocol. Move seat. Use cellular. Slowness is not a moral argument against a tunnel, and it is not a reason to bypass a rule. WireGuard first. OpenVPN when UDP is rude. If both fail and the AUP forbids the hop, you are done. That is what the seven days are for if you bought a year for this desk alone.