When WireGuard UDP Is Blocked (White-Label View)

A blocked UDP path does not always look like an error. It looks like Connecting for 20 seconds, then a generic fail, then a retry that fails the same way. Users call that the app is broken. Engineers call that a timeout. Brands need a third name: this network is not passing WireGuard. Put that in the UI or you will spend the year translating.

Do not lead with your Wi-Fi is unsafe. They already paid for a tunnel. They need a next step. Unsafe is a homepage scare. It is the wrong noun at minute two on a lobby SSID.

If the client retries WireGuard forever with no hint, you trained them to wait. Waiting is how they miss dinner and leave a one-star. I would rather an early, slightly ugly banner than a beautiful spinner.

They are not the same machine. A hotel wants a splash page, a payment, maybe a filter that treats UDP like abuse. A school wants minors off the open web and often ships a vendor that blocks VPN by category. An office wants data loss control and sometimes TLS inspection. One macro for all three is how you look lost.

Hotel: captive portal first. Then UDP. Then OpenVPN. The amenity article is if you are selling to the hotel. This article is if your consumer user is a guest on someone else's lobby SSID.

School: they may see a page that names VPN. Your copy should not dare them to jailbreak the filter. Offer OpenVPN. If it still dies, tell the truth: this network may not allow VPNs. Refund policy is a later conversation. Lying that you always work on campus is how you buy chargebacks.

Office: guest Wi-Fi might be hotel-like. Corporate SSID might inspect. Do not print we beat inspection. Print try OpenVPN TCP. If the company forbids VPN, that is an HR problem wearing your icon.

Two failures get mashed into VPN broken. One: they never accepted the portal, so nothing including WireGuard can reach the internet. Two: they are online, Chrome loads, WireGuard still times out. If your string does not distinguish those, agents will not either.

Sequence for hotels: pause or disconnect the VPN, complete the portal, then connect. Kill switch copy can fight this. If fail-closed is on, the portal never loads. Point at the kill-switch article. Do not pretend transports fix a switch that is strangling DHCP.

Once the portal is done, Chrome works, and WireGuard still dies, you are in UDP-drop land. Now OpenVPN. Now TCP if you ship it. Now a sentence that does not mention the portal again.

Write the timeout like a human who has been in a lobby. Could not connect with WireGuard. This Wi-Fi may block it. Try OpenVPN in settings. Button: Switch to OpenVPN. Secondary: View steps. Do not add a lecture about encryption. They already bought encryption. They need a tap.

If you cannot deep-link to the protocol picker, the button is a liar. Ship a picker path or drop the button. A button that opens Chat is an escape hatch. Fine if you staff it. Not fine if the hotel is at midnight in another timezone.

Match settings labels. If settings say OpenVPN (TCP) and the banner says stealth, you created a scavenger hunt. The TCP-fallback article is how you decide whether TCP is a product. This article is the banner that points at whatever you decided.

A printed ladder beats a smart Auto nobody understands. 1. Finish the portal. 2. WireGuard. 3. OpenVPN UDP if you expose it. 4. OpenVPN TCP if you ship it. 5. Mobile data as a test. 6. Stop, and tell them this network may not allow a VPN.

Auto can climb that ladder if you still show which rung won. A silent Auto that lands on TCP while the UI still says WireGuard is how tickets say your app lies. Show the active protocol on the home card. Small type. Always.

Klox consumer is WireGuard plus OpenVPN. The ladder ends there in this post. I will not add a mystery protocol for flavor.

Three layers. The glass is for the person who will never search. The help center is for the person who will. The agent is for the leftover. If the glass is mute, the other two drown.

Help article title I actually want: VPN will not connect on hotel or school Wi-Fi. Not troubleshooting connectivity issues. The first title is searchable. The second is a folder name.

Agent macro: same ladder, same nouns as the banner. Attach screenshots per OS. Five devices means they may be on a laptop while chatting from a phone. Ask which device is failing. I still see macros that assume Android.

Sometimes the office page says VPN detected and kills you. Sometimes inspection breaks the handshake in a way that looks like a timeout. You will not tell those apart from a banner. Do not claim you will.

Allowed sentence: This network may block or inspect VPNs. Try OpenVPN TCP. If it still fails, the network may not allow VPNs. Disallowed: we disguise traffic as HTTPS so IT cannot see you. That is a fight with their employer wearing your logo. Decline that fight in writing.

RFC 8446 still is not your camouflage. Port 443 still is not invisibility. The TCP-fallback post is the honesty paragraph. Repeat a short version here so an agent does not invent stealth in chat.

A filter that shows VPN blocked is doing you a favor. You can stop guessing. Your reply is not a bypass tutorial. Your reply is we may not work on this network, here is OpenVPN anyway, here is the refund window if you just bought.

Minors plus VPN advice is how you get a conversation you do not want. Keep the steps technical and short. Do not joke about sneaking past the school. Cute tweets become exhibits.

Campus as a product is the university white-label post. This is the consumer user who happens to be a student. Different buyer. Same UDP.

The account is one. The paths are many. A router at home on WireGuard, a phone at the hotel on a timeout, a tablet at school on a filter page. Support that treats the account as one device will give router advice to a phone.

Ask device, OS, Wi-Fi versus LTE, whether Chrome loads, whether they passed a splash page, which protocol the home card shows. That is the intake. Without it you are performing.

Klox consumer is five devices. Your brand may pick another number. The intake does not change.

No always works on any Wi-Fi. No guaranteed hotel bypass. No city counts as a fix. No SOC 2. No we are undetectable. No turn off your school filter. No the protocol is broken so we will refund Mbps you never had.

You may say WireGuard uses UDP and some networks block it. You may say OpenVPN, including TCP, is the usual next try. You may say if both fail, this network may not allow VPNs. That is an adult paragraph. Use it on the site and in the app.

Do not blame WireGuard as a technology. Blame this path. The inherit article already told you not to become a protocol author in public. The timeout is not your chance to recant WireGuard on the homepage.

Before you freeze copy, fail on purpose. A cheap travel router that drops UDP is enough. A school-like filter if you can do it legally on your own lab. The office guest SSID on a Sunday. Watch the banner. Time how long until it appears. If it appears after they already left the app, it did not appear.

Have a stranger try without a briefing. If they cannot find OpenVPN in 30 seconds, the label is wrong. You are too close to the settings tree.

Then freeze a weekly count: handshake timeout tickets, switched to OpenVPN, refunds that mention hotel or school. If those counts are not boring, your homepage can still lead with WireGuard. Your timeout string cannot stay mute.

Agents will call everything a hotel block. Wrong. Auth expired. Account past due. Kill switch eating the portal. IPv6 leftover. DNS on the phone still pointing at the ISP. A burned exit the user already connected to last week. If you teach the inbox that timeout equals UDP, you will miss the cases where WireGuard is fine and billing is not.

Intake first: are they signed in? Does the home card show a plan? Did they just fail a card? Then portal. Then UDP. The dunning article is past-due access. The kill-switch article is fail-closed. This article starts after those are ruled out.

I would put a six-line checklist at the top of the timeout macro. If agents skip it, they will switch a paying home-fiber user to TCP for no reason and then you will read a slow app review. TCP is a tool. It is not a personality.

The in-app sentence should link to a stable URL you own: /help/restricted-wifi or whatever your help center actually serves. Not a Google Doc. Not a Notion page that dies when a contractor leaves. The banner is useless if View steps 404s.

That article should be the ladder, screenshots, and the honest end: this network may not allow VPNs. Date it. When you rename OpenVPN TCP in the app, edit the article the same day. Stale help is how people say your brand is fake.

If you do not have a help center yet, the knowledge-base post is the staffing of articles. Still ship the banner. A banner without a URL beats a URL without a banner. Both is the adult version.

Count tickets whose first line is will not connect on Wi-Fi. Tag hotel, school, office, other. Tag whether they had already finished a portal. Tag whether they switched to OpenVPN. Tag refunds inside seven days that mention connect. If you cannot tag, you will relaunch the same banner next year.

I do not want a fake dashboard percentage. I want a weekly number a founder can stand. If hotel tags rise after a travel campaign, pause the campaign until the banner ships. Buying traffic into a mute spinner is paid refunds. Klox consumer seven-day money-back will happily take that money back out. Your brand's window will too if you copied it.

Share the count with whoever owns store screenshots. A sofa Connected shot next to a travel ad is the mismatch users feel in the lobby.