When Not to Use a VPN: Skips You Choose on Purpose

A skip is a decision with a timestamp. I need the hotel page. I need the printer. The bank blocked the VPN IP. The LAN game will not see friends. Home is trusted and my threat is not the ISP today. You can say those sentences out loud. A forget is: the laptop joined cafe Wi-Fi, mail fetched, you were talking. No sentence. No leftover you budgeted. Smart Connect exists because forget is the common failure. A skip list that trains you to leave Connect untouched on untrusted Wi-Fi is a farm in a nicer font.

Write the leftover down if you are the anxious type. Portal: clear hop for two minutes, then tunnel. Printer: LAN in the clear, WAN maybe still tunneled if split tunnel exists. Bank: site sees your real IP for that session. Game: UDP to the LAN, cafe map intact for that app. Home: ISP sees destinations. If you cannot name the observer, you are not skipping. You are hoping.

I will not give you a personality test. Journalists and people on hostile networks should skip less. People printing shipping labels at home can skip more. The physics do not change with your job title. The budget does. Yearly from $2.83 a month is cheap enough that skip should stay rare. Rare is not never.

A named skip still has a restore. Portal done, tunnel back. Printer done, tunnel back. Bank login done, tunnel back. If you skip and then wander into mail on the same clear path, you converted a skip into a forget without standing up. That conversion is how this list gets abused. I would rather you connect too often than collect pauses like souvenirs.

Captive portals want a clear hop. The AP intercepts HTTP, shows a login, an I agree, a voucher, a room number. Your OS tries to detect that garden. A VPN that starts the instant the radio associates can steal the first hop. A kill switch that is already armed can then block the HTTP the portal still needs. Deadlock. Wi-Fi says connected. Nothing loads. That is not a reason to uninstall. That is a reason to pause.

Order: join the SSID. If Smart Connect already fired, Disconnect. Pause the switch if traffic is still blocked. Complete the page. Confirm a boring site loads. Connect Klox. WireGuard first. Restore the switch and Smart Connect if you use them. You will be naked on that LAN for a minute. That is the cost of the garden. I will not claim zero exposure. I will claim this is the skip that every travel day contains.

If there is no splash, you already have a route. Then this skip does not apply. Waiting is how mail fetches on cafe DNS. Connect. Do not perform a portal ritual that is not there. The cafe habit article is the longer version of that fork. Here it is one row: pause is for the page, not for the whole latte.

Cellular instead of the shop Wi-Fi is a clean skip of the portal and of the cafe LAN. Your carrier still sees a hop unless you tunnel on cellular too. That is allowed. It is a different observer.

A tunnel that owns the default route can hide the printer. Discovery packets never arrive. The NAS is on 192.168.something and your laptop is trying to hairpin through a VPN node. Symptom: printing failed, scanner missing, Time Machine sulks, SSH to the pi times out. This is a LAN problem. It is not a reason to decide VPNs are malware.

If the Klox app shows split tunneling, exclude the printer software, or exclude local networks if that is the row. Confirm on the glass. Features copy can list split tunneling while a given build hides it. I will not invent a per-IP bypass from a marketing page. If the row is missing, pause the tunnel, print, restore. Ugly. Works. Daily printing is how you look for the row instead of living paused.

A router-level tunnel is a different chair. Whole-house VPN will hide LAN services from themselves unless the router is smarter than a consumer flash. That is the router article. Here: per-device pause on the laptop that needs the NAS, while the phone in the cafe stays connected. Five devices means those are different seats. Use that.

Do not buy a dedicated IP to talk to a printer in the next room. We do not sell a consumer dedicated IP. The printer never wanted a public IP. It wanted a LAN.

Some banks, some payment processors, some streaming logins treat shared VPN addresses as fraud. You connect. The app says try again later, or it wants a postcard, or it dumps you to a phone tree. HTTPS still worked. RFC 8446 still worked. Their risk engine did not like the exit IP. That is their box. It is not a Klox outage.

Try another server first. Try OpenVPN if WireGuard was the one they fingerprint. If it still fails, pause the tunnel for that login, finish the 2FA, reconnect. You just showed them a residential IP. That is the leftover. Name it. Do not leave the tunnel off for the next hour of mail because the bank was rude.

I will not sell you a dedicated IP so the bank can whitelist you. There is no consumer dedicated-IP SKU on /pricing. If a competitor page offers one, that is their catalog. If a white-label brand sells one, that is their catalog. You are on Klox consumer. Pause or switch server. If that is unacceptable, the seven-day window exists so you can leave.

Phishing still works while paused. A fake bank on cafe Wi-Fi does not become safer because the real bank hates VPNs. Prefer pausing at home for that login if you can wait. If you must bank on a cafe, you are stuck choosing between a blocked real app and a mapped hop. I still want the tunnel up until the app proves it will not load. Then a short pause. Then back.

Local co-op, LAN discovery, some console modes, a Minecraft world on the pi: they want the subnet. A VPN that owns the route will look like you left the house. Friends on the couch become friends on a distant node, or they vanish. Pause the tunnel on the machine that plays, or exclude the game if split tunnel exists. Same rule as the printer. Different emotional ticket, because now a child is involved.

Online games that merely hate latency are not this section. Extra hop can feel bad. That is a speed article. Here the skip is: packets that must stay on the LAN. If the game is actually internet matchmaking, a VPN is a hop like any other. Keep it if you wanted the hop. Pause it if the matchmaker bans data-center IPs, which is the bank story in a hoodie.

Do not disable a kill switch globally because a game crashed once. Pause, play, restore. If this is nightly, look for the split-tunnel row. If the row is missing, the laptop that games can live without a tunnel at home. The phone that travels should not inherit that lifestyle.

Five devices helps. A desktop that stays home can skip. A laptop that cafes cannot. Count seats. Sleep is not disconnect. A game PC holding a tunnel all afternoon is still a seat even if you skipped in your head.

At home you picked the password, maybe. The observer is often the ISP, plus whatever you already log into. If your threat is the cafe sniffer, home can skip. If your threat is the ISP's destination map, home should stay connected. That fork is the home-Wi-Fi essay. This paragraph is only: skipping at home is allowed when you mean the first threat, and it is not a template for the airport.

Trusted SSID in Smart Connect, if the row exists, is how you skip without forgetting in shops. Mark home trusted. Leave cafes untrusted. If you mark the cafe trusted because you go every Tuesday, you opted out of the habit. Allowed. Know that you opted out. If the Smart Connect row is missing, you have a Connect button and a memory. Memory fails. That is why the row exists on builds that ship it.

HTTPS still covers page bodies at home. RFC 8446 did not need a tunnel. The leftover of a home skip is the ISP map and a residential IP at sites. Some people want that IP for banks. Fine. Name it. Do not skip at home and then also skip at the cafe because the muscle memory of off took over.

I still connect at home most days because I do not want two brains. Always-on is a lifestyle. Situational is a lifestyle. Mixing them without Smart Connect is how forget wins. Pick one, then use the skip list for portals, printers, banks, games.

Split tunneling means some apps or some routes skip the VPN while the rest stay inside. Printer software out. Browser in. Game out. Mail in. That is the adult version of pause. It is also a leak you designed. Whatever you excluded is on the real path: cafe map, ISP map, real IP at those destinations. Name that. Then exclude only what you must.

Klox lists split tunneling on Features and on some OS pages. The app in your hand is the source of truth. If Settings shows split tunnel, bypass VPN, excluded apps, or a cousin of those words, that is the row. Use it for the printer and the LAN game. Do not exclude the browser on cafe Wi-Fi and call yourself protected. If the row is missing, you have pause. Pause is honest. Imaginary split tunnel is how tickets get written.

Default off. Full tunnel until a LAN thing breaks. Then exclude the one app. Do not build a zoo of exceptions because a YouTube video had fourteen checkboxes. Five devices can mean five different exception lists if you are messy. Be boring. WireGuard still carries the rest. OpenVPN still carries the rest. Kill switch still bricks the included apps if you armed it. Excluded apps may keep talking when the tunnel dies, depending on how the client wrote it. Test if you care. Do not assume.

I will not document a click path that a future build will move. Open Settings. Look. If you expected the row and cannot find it, write support. Do not paste a competitor's split-tunnel screenshot into a review.

The skip list is not the product. The product is a tunnel on networks you do not run. Cafe, hotel, airport, the library, the shop with a password on a chalkboard. After the splash, connect. HTTPS already locked the page. The LAN still sees the hop unless the hop is a VPN. That sentence is why Klox exists. This article exists so you do not brick a portal, a printer, a bank, or a LAN game and then uninstall.

Untrusted means you did not pick the backhaul. Home can be trusted. A friend's house is a judgment call. A cafe you visit every Tuesday is still a cafe. Smart Connect, if shown, is the automation for that sentence. If it is missing, the button is the automation. Either way, forget is the enemy. Skip is the tool.

WireGuard first. OpenVPN when the AP is rude. Five devices. Phone plus laptop is two. Yearly from $2.83 a month. Seven-day first-purchase money-back if you bought a cape and received a pause list. No city count. No SLA. No dedicated IP. Download from /download. Price on /pricing.

If a farm told you never to turn it off, they never sat through a hotel voucher box. If a forum told you always to turn it off for speed, they are selling a feeling about ping. You now have a table. Use the table. Then drink the coffee with the tunnel up.