Hotel Wi-Fi is already a complaint product. Captive portals. Throttling. A conference floor that ate the band. A VPN can make a guest on a laptop feel less exposed on that network. It can also break the portal if they tunnel before they authenticate. That one sentence is a large slice of the hotel VPN tickets I have seen. If you skip it, the front desk will invent a ritual at 11pm, and that ritual will become folklore by breakfast.
This is not a consumer essay about cafe hotspots. The hotel is the hotspot. The buyer is a GM, a brand IT lead, or a management company that already owns a PMS, a portal vendor, and a night auditor who did not apply for a networking job. The overview article on ISPs, hotels, and MSPs is the map of three channels. This page is the property. Portal order. Credentials that die at checkout. QR amenity versus a 24-hour pass. A script a tired auditor can run in ninety seconds.
Do not force every guest through a subscription wall after a flight. They will use cellular and write a review about the Wi-Fi, not about your tunnel. Packaging is the product: include it in a business room with a printed QR; sell a 24-hour pass at the desk; or put a router in the executive lounge only. Pick one primary path. Three paths with three logins is how you melt the desk.
KloxVPN's consumer SKU is WireGuard, OpenVPN, OpenConnect, and Shadowsocks, five devices, from $2.83/month on yearly, 7-day money-back. A hotel should not quote that as a room amenity. Session length, property-level credentials, and who pays are a sales conversation. Confirm the package. Do not screenshot consumer retail into a franchise RFP.
Cloudflare and Wikipedia will still explain a tunnel to a non-engineer in brand. RFC 8446 is TLS 1.3 on the web, which is not your portal, but it is a reminder that encryption is a protocol. The portal is a walled garden. The tunnel is a later hop. Get the order wrong and the garden never opens. I have watched properties blame the VPN vendor for a portal they never whitelisted. The guest only knows the Wi-Fi is broken. The review does not mention your SOW.
Related reading: Linux delegated_credentials: Not a VPN Setting and White-Label VPN and Cadvisor (Follow-up). White-Label VPN and Calico and What is a VPN?. Download KloxVPN and Reseller program.
Looking for a reliable VPN?
KloxVPN — from $2.83/month. Apps for every device.
Guest Wi-Fi is already a complaint product. Do not add a second one.
People forgive slow Wi-Fi more than they forgive a login maze. A branded VPN that adds a maze will be remembered as the hotel's maze. White-label means the guest sees the property or the brand, not a platform name. If the icon says Klox, you turned an amenity into an affiliate. Affiliates are a different motion. Most hotels want the name on the towels to match the name on the phone. That is the point of white-label. Reseller is the wrong aisle if the GM cares about the icon.
Consumer VPN homepages talk about hiding on hotel Wi-Fi as if the hotel were the threat. NordVPN's consumer pitch is built for a traveler buying a personal plan. Do not paste it onto a property amenity page. You are selling to the hotel. Insulting the house network in the house voice is how brand legal kills the project in week two. Pitch a quieter laptop session, a business-room extra, a way to get a predictable egress if a guest's bank is picky. Do not pitch we hide you from us.
Who pays? Sometimes the property, as cost of goods for a premium tier. Sometimes the guest, as an upsell at check-in or in the loyalty app. Sometimes a corporate travel account. Write it. If who pays is TBD, the desk will guess, and guesses become disputes at checkout when the folio looks wrong.
- 1Join the SSID. Do not start the VPN yet.
- 2Open a browser and finish the captive portal.
- 3Open Klox. Connect WireGuard.
- 4If the handshake dies, switch to OpenVPN. Then work.
Do this in order
| Package | Who pays | Credential life | Desk load | Failure mode |
|---|---|---|---|---|
| Business-room QR amenity | Property, in the rate | Stay length, dies at checkout | Low if QR works | QR domain rotates, insert is dead |
| 24-hour pass at desk | Guest | 24 hours from enable | Medium: selling and resetting | Auditor cannot reset at 2am |
| Lounge / club floor only | Property | Session or stay | Low volume, higher expectation | Guest takes it to the room and it fails |
| Consumer subscription funnel | Guest card | Until they cancel | High at 11pm | Review about Wi-Fi, not about VPN |
If the night auditor needs to import an OpenVPN profile, you already lost the shift. OpenVPN as a protocol can stay. OpenVPN as a front-desk ritual cannot.
— KloxVPN operator notes
Cloudflare Learning: What is a VPN?
Wikipedia: Virtual private network
NordVPN (competitor traveler pitch — not a hotel amenity page)
The guest does not care about your SOW
They care whether the portal loads, whether email works, and whether they can join the 9am. Front desk will get the first question no matter what the contract says. Design for that. Train for that. If your design assumes they will email platform support from the lobby, you have not stayed in a hotel.
Reviews are the SLA the GM actually watches
I will not invent a Klox uptime percentage. I will say this: a dead portal after a VPN upsell will show up as Wi-Fi complaints, not as VPN complaints. Track amenity tickets against review language. If Wi-Fi scores drop after launch, pause attach. Do not argue physics with a TripAdvisor paragraph.
Captive portal first, tunnel second
A captive portal is a walled garden. Until the guest accepts terms or enters a room code, most destinations are blocked. A VPN client that tries to build a tunnel before that garden opens will fail, or worse, it will fail-closed and the portal itself will not load. Fail-closed is a valid privacy mode on a cafe. It is a trap on hotel Wi-Fi. The kill-switch copy article is the branded-app version of that trap. This page is the property version: the portal must win, then the app may connect.
Split the path. Allow the portal domains and the DHCP/DNS dance in the clear. Then connect. If your client cannot pause for a portal, do not default the amenity to a fail-closed kill switch. You will staff the desk with I have no internet at midnight. That ticket is not a handshake bug. It is product copy and a default you chose.
Some properties try to skip the portal for VPN users. That only works if the controller can identify them, which means you already had an identity. Most hotels do not. Most hotels have a vendor portal, a splash page, and a bandwidth policy. Work with that. Whitelist what the portal needs. Document it. When the portal vendor changes a domain, your amenity breaks. Put that change in the runbook next to the linen change, because it will happen on a Saturday.
Order of operations on a fresh phone
Join SSID. Complete portal. Open the hotel-branded app or scan the QR. Connect. If any step can be skipped, someone will skip it and call the desk. Print the order on the key packet. One diagram. No novel. Night auditors do not read novels.
Always-on VPN on guest phones
Travelers who already run a personal VPN with always-on or a fail-closed switch will fight your portal before they ever see your amenity. Your script should include: turn the personal VPN off, complete the portal, then use ours or turn theirs back on. You will not win a theology argument in the lobby. You will get them online.
IPv6 and guest isolation
Do not promise the tunnel will fix client isolation, mDNS, or casting. Isolation is why Chromecast dies. A VPN can make casting worse. Say that up front in the business-room card. Surprise is a one-star review. Honesty is a shrug and a cable.
Short-lived credentials that die at checkout
I like credentials that die when the folio closes. A code for the stay. A voucher that expires at 11am checkout plus a grace window you chose on purpose. Permanent accounts for one-night stays become a graveyard of emails and a privacy headache. Work with the PMS if you can. If you cannot, make expiry stupidly obvious in the app and on the paper.
GDPR and similar rules care about guest emails you did not need. If the amenity can run on a room number plus a stay token, prefer that over harvesting a Gmail. If you need an email for the store listing, that is the store, not your PMS. Do not mix them. A marketing list built from VPN amenity signups is how brand legal has a bad quarter.
Checkout is a delete. Not a disable we will get to. If a guest can still connect from the airport three days later on a token tied to room 412, you did not build hospitality. You built a hole. Automate the kill off the PMS event. If the PMS event is flaky, time-box the session to 24 or 72 hours and accept that early checkout needs a desk reset. Pick the failure you can staff.
Grace windows
Flights slip. Check-out at noon, session dies at 11:05, guest is still in the lobby on a laptop. A two-hour grace is cheaper than a scene at the desk. A two-day grace is how last night's guest is still on your nodes. Write the window. Tell the auditor. Do not leave it as whatever the vendor defaulted.
Shared rooms and extra devices
Klox consumer is five devices. A couple with two phones, two laptops, and a tablet is already at the cap if you copy that SKU. Hotel packages may differ. Confirm with sales. If the amenity is one session for the room, say so. If it is five tunnels, say so. Caps discovered at 10pm are desk tickets with an audience.
Lost phone, new phone
The desk needs a reset that does not require platform chat. One button in the property tool, or a code the auditor can issue. If reset means email us, you will have a line at 7am. Lines at 7am become GM tickets at 8am.
QR amenity versus 24-hour pass versus lounge-only
QR amenity in the business room is my default for a first property. The guest already paid for the room tier. The card is in the folder. The QR opens the branded app with the stay bound. Desk load stays low if the QR still resolves. Test the card like it is a product. Hotel printers and laminated cards outlive domains. If you rotate a host, reprint. Budget for reprint.
A 24-hour pass is an upsell. It needs a price the desk can say without flinching, a button that issues a code, and a refund rule when the portal was down. If the pass is sold and the tunnel fails, you will eat a folio fight. Write the reversal. The consumer 7-day money-back is the wrong policy on a one-night stay. Confirm how reversals work in your package. Do not paste consumer refund copy onto a hotel folio.
Lounge-only is a contained pilot. Small population, higher expectation, a staff member who can walk to the chair. It is a good first week. It is a bad forever plan if the GM wanted every room. Do not let a lounge pilot become the product because nobody scheduled the rollout.
Do not run all three on day one
One primary path. A fallback for VIP. That is enough. Three SKUs with three expiries is how the auditor sells the wrong one and the next shift cannot unwind it.
Loyalty app versus a separate VPN app
If you already have a hotel app, stuffing a VPN into it sounds clean and often dies in store review. VPN capabilities are their own homework. The rejection-patterns article is that wound. A small branded VPN app plus a QR from the loyalty app is usually faster than merging binaries. Confirm the store plan before you promise the brand a single icon.
Night auditor scripts: ninety seconds, three steps, a stop
The night auditor is not your NOC. They are checking in a delayed arrival, running a report, and watching a door. Your VPN cannot require a personality. Give them a card.
Step one: has the guest completed the Wi-Fi portal. If no, do that. Do not touch the VPN yet. Step two: is this a business-room amenity, a pass, or a lounge code. Issue or re-issue that thing only. Step three: still dead after portal plus fresh code? Collect room number, time, phone or laptop, and whether they have a personal VPN running. Then stop. Escalate to hotel IT or the platform path you wrote. Do not improvise OpenVPN imports. Do not factory-reset the guest's phone.
If the answer on the card is download OpenVPN Connect and import a profile, you have already lost the night auditor. OpenVPN as a fallback protocol inside the branded app is fine. OpenVPN as a front-desk ceremony is how you get a 40-minute call and a wrong profile on a stranger's laptop.
Translate the card. Breakfast has forty nationalities. English-only scripts fail at 1am. You do not need twenty languages on day one. You need the languages your front desk already uses for wake-up calls. Put the same three steps in those.
What the auditor must never do
Install random apps from a search result. Type a platform password into a guest device. Promise a speed. Blame the guest. Those four create liability, chargebacks, and folklore. The card should say never as clearly as it says the steps.
Shift briefing, not a training day
You get ninety seconds in a standup. Demo the portal. Demo the QR. Demo the reset. Done. A two-hour LMS module will be skipped. Skipped training plus a live amenity is a meltdown you scheduled.
After-hours escalation that is real
If hotel IT is not on a night rotation, the platform path must be. If neither is, the only honest script is disable and offer cellular, then a callback at 8am. Lying about a 24/7 engineering desk you do not have will be discovered once and remembered in the brand Slack forever.
Front desk versus hotel IT versus platform
Front desk owns: portal how-to, which package the guest has, issuing and resetting stay codes, folio questions. Hotel IT owns: SSID, controller, portal vendor, bandwidth policy, whitelist changes. Platform owns: handshake failures, client defects, node-side incidents. Shared: streaming and casting. Shared is a fight unless you timebox it.
The guest should not see three teams. They see the desk. Escalation is back-office. If you SMS a platform name, you taught them to shop the hotel. White-label means the property owns the relationship. Own means own. If that scares the GM, they wanted a consumer QR to someone else's app. That is reseller energy. Most brands will not accept it on the nightstand.
Write the split in the SOW. Cap categories. Review tickets per 1,000 room-nights with the amenity, not per 1,000 consumer subs. The support-load article is consumer ticket math. Do not clone it. Hotel mix is portal, code expiry, personal-VPN conflict, casting, and a thin tail of real handshakes. If handshake is the bulk, your portal order is wrong or your SSID is sick. Fix the house network before you buy more nodes.
A packet of facts for escalation
Room, time, device type, portal completed yes/no, package type, personal VPN yes/no, app version if they got that far. Six fields. Agents will not write a novel. Engineers will not accept a feeling.
Desk disable is a valid ending
Turn the amenity off for that stay, leave the portal Wi-Fi up, callback in the morning. A disabled VPN and a sleeping guest beats a 50-minute ceremony. Track disable-as-resolution. If it dominates, the product is wrong.
Business rooms, leisure, and the conference floor
Business rooms are the natural home. Laptops. Banks that flag cafe ranges. People who will actually open an app. Leisure is a harder attach. They wanted Instagram and kids' tablets. A VPN that breaks casting is a complaint, not a feature. Conference floors are saturation plus a thousand personal VPNs fighting your portal at 8:55am. Do not launch a new amenity on a citywide convention week. I have watched that movie. The ending is a GM in the NOC closet.
Corporate travel accounts sometimes want a dedicated egress for a negotiated property. That is a dedicated-IP conversation, not a guest story. The dedicated-IP article is the sales-tool version. Here: maybe a property-level sticky exit for a partner company. Not a privacy upgrade. Not PCI. Do not tell the GM the tunnel makes the card terminals safe. Card terminals are a different network if you are doing this like an adult.
Conference is a load test you did not schedule
If the amenity is on by default for every badge, you will discover portal capacity and node capacity in public. Default off, opt-in for rooms that paid, is how you survive a show. Default on for 800 devices is a press incident with a logo.
Kids' tablets and smart TVs
Usually leave them on the house Wi-Fi without the tunnel. TVs are a support sink. Streaming apps are picky. Start with guest laptops and phones. Add TV only if you will staff the tickets. The niche overview said that in one line. I am repeating it because someone will still put a QR on the Samsung.
What breaks: TVs, casting, streaming, and the kill switch
Casting wants devices to see each other on the LAN. Client isolation already hurts. A tunnel that yanks the laptop off the LAN finishes the job. Say it on the card. AirPlay, Chromecast, printing to the business-center printer: assume broken unless you tested that SSID with split exclusions you actually maintain.
Streaming may work, may not, may look like a VPN even when it is the hotel CDN. Do not promise catalogs. Do not put a speed number on the amenity card. Speed claims without a method are how you get a brand complaint. WireGuard on clean UDP is usually the nicer path. OpenVPN is the fallback when the portal or a middlebox is rude. Put protocol fallback in the app, not in the auditor's head.
A fail-closed kill switch on a branded guest app is how the portal never loads. Default it off for a hotel SKU unless you have a portal-aware path. The copy article is where you name the toggle. Here I only care that the default does not take the house Wi-Fi hostage. Confirm client defaults in your package with sales. Do not guess from a consumer screenshot.
Personal kill switches versus yours
The guest's own app may already be fail-closed. Your script already said turn it off for the portal. Do not stack two fail-closed clients and then act surprised. One tunnel at a time. That sentence belongs on the card.
Printers and meeting-room gear
If the business room is sold as print from your laptop, test it with the tunnel on and off. If it only works off, the card should say use house Wi-Fi without VPN to print. Ugly. Honest. Better than a 20-minute hunt for an IP.
Dedicated IP as a property tool, not a guest bedtime story
A sticky egress can help a corporate account that allowlists one address, or a property that wants predictable source IPs for a partner. It does not make guests anonymous. It does the opposite. It does not make you PCI-compliant. Do not sell it as a privacy medal.
IPv4 is scarce. A free forever dedicated IP per room is a future you will regret. If you need one per property or per corporate account, price it. Confirm availability and regions with sales. I will not invent a city count. The consumer site talks 60+ countries and 100+ locations. Your hotel footprint is the contract.
SLA language, if the brand asks, is a credit schedule with exclusions for guest Wi-Fi physics, portal vendors, and last-mile. I will not mint a 99.something in this blog. The dedicated-IP and SLA article is the contract shape. Point procurement there. Do not clone it into a guest FAQ.
Allowlists change
If a partner company allowlists your property exit, a quiet IP change is an outage for them. Written notice. A window. Someone who owns the change. If you cannot staff that, do not sell the sticky IP.
Procurement: GM, IT, brand, franchisee — who actually signs
A franchisee may want the amenity. The brand may own the app name. The management company may own the desk. The portal vendor may own the splash page. If you sell to the wrong one, you will launch into a veto. Map the four. Get the vetoes out in meeting two, not at reprint.
Legal will ask about guest data. Short-lived tokens help. Do not collect what you will not delete. Do not invent certifications. I will not put SOC 2 on this page. Answer questionnaires with what you can verify. Forward what only the platform can verify. Guessing is a three-year lie.
Who is merchant of record if the guest buys a 24-hour pass? If the hotel takes it on the folio, the hotel is in the tax path. If you take a card in the app, you are. The billing article is the general wound. Here: folio versus in-app is a choice that changes refunds, chargebacks, and who the guest yells at. Pick it on purpose.
RFPs that want a unicorn
Every room, every TV, dedicated IP, 24/7 phone, next week, $1 a stay. Rewrite or walk. A lounge pilot with an end date is a win. A signed unicorn is a convention-week outage with a logo.
Brand standards versus property reality
Brand wants one app worldwide. Property has a portal vendor from 2014. You will live in the gap. Either the brand funds a portal refresh, or the amenity stays room-tier and QR. Pretending the gap is a software setting is how you miss the season.
What you must not promise the guest
Do not promise anonymity. Cameras in the lobby, names on the folio, and the SSID still exist. Do not promise every streaming catalog. Do not promise the VPN makes Wi-Fi fast. Do not promise PCI. Do not promise a kill switch that never breaks the portal. Do not promise five devices if the hotel SKU is one session. Confirm device caps with sales.
Do not promise WireGuard will pass every portal. Offer OpenVPN in the app as fallback. Test both on the real SSID. Do not promise 24/7 engineering if the night path is a callback at 8am. The card should match the SOW. The store listing should match the card. Misalignment is a ticket category. Name it before launch.
If this still sounds like your property, bring a real package: who pays, portal vendor, QR or pass, credential life, desk languages, night path. White-label is the platform conversation. Contact is the meeting. Pricing on the consumer site is the wrong sheet. Download is for people who already have an account, not for a guest in a bathrobe.
Pilots that never end
End date. Metric: desk tickets per 1,000 amenity-nights, portal-related versus handshake, review-language watch. No metric, no rollout. I have been the free amenity. It is a lousy identity.
When to walk
They need you to lie about logs, lie about PCI, or staff a language you cannot staff. There are other properties. There is not another reputation. If they wanted a consumer plan from $2.83/month, send them to pricing. This aisle is for a desk that already has a line.
Key Takeaways
A hotel-branded VPN is a guest path that survives the captive portal, dies at checkout, and can be explained by a night auditor in three steps. It is not a consumer subscription funnel and it is not a speech about hiding from the house network. Portal first. Tunnel second. Short-lived credentials. One primary package. A reset the desk owns. WireGuard on clean paths, OpenVPN when the middlebox is rude.
KloxVPN can put the property name on that pair. You still have to package the stay like an operator. Session length, who pays, and client defaults are a sales conversation. Confirm them. Do not paste a five-device consumer SKU onto a folio and call it hospitality.
If you needed the three-niche map, that article exists. If you needed kill-switch naming for the app, that article exists. This one is the front desk. Bring the portal vendor and the auditor card. Leave the 11pm OpenVPN ceremony at the door.
Related Resources
Put a hotel name on a guest tunnel that the desk can support
White-label apps, WireGuard, OpenVPN, OpenConnect, and Shadowsocks, and a packaging talk for properties. Confirm session length and SKUs with sales. This page is not a rate card.
See white-label VPNFrequently Asked Questions
KloxVPN Team
Experts in VPN infrastructure, network security, and online privacy. The KloxVPN team has been building and operating VPN services since 2019, providing consumer and white-label VPN solutions to thousands of users worldwide.