5 min read
A corporate network blocks tunnels deliberately — this is not a fault. Usually three mechanisms operate at once: the firewall closes non-standard ports, the proxy only lets web traffic through itself, and the issued laptop carries a management agent that routes all traffic by company rules. Let us mark the boundary straight away: getting around those rules on a work device is a bad idea, and below is why. On a personal phone connected to the office guest network, however, the situation is different.
Not out of spite. The security team has three reasons, and all of them are sound:
Understanding this reframes the question: it is not "how do I get around it" but "which of three situations am I in".
| Situation | Device | What is appropriate |
|---|---|---|
| Work laptop on the corporate network | the company's | do not get around anything; take it to IT |
| Personal phone on the office guest network | yours | a tunnel is appropriate: the network is someone else's, the traffic is yours |
| Personal device at home or travelling | yours | the ordinary scenario, no constraints |
The first row is about rules, not technology. On a company-issued device its policy applies, you accepted it when you took the hardware, and circumventing a security policy is grounds for disciplinary action at many companies. If your work needs access to a service that is blocked, the right route is a ticket to IT, not a tunnel around it.
The second and third are your own business. A guest network is the same public network as a café's, just with your employer's logo, and the owner of the access point sees the traffic on it. Why defend yourself on other people's networks: security on public Wi-Fi.
Technical causes, by frequency:
That last point cannot be worked around with client settings — that is precisely what a management agent is for.
What not to do: connect a personal tunnel on the work computer "just for a minute", install clients against policy, or change the settings of the corporate agent. This is exactly the case where technical possibility and good sense part ways.
If you connect to a corporate VPN for work and want a personal one alongside it, the two combine poorly on one device: the system holds a single active tunnel, and the clients start taking it from each other. Symptoms and analysis: antivirus or firewall blocking the VPN.
The working solution is separation by device: the work laptop for work, the personal phone for personal things. That also settles the privacy question: your employer cannot see your personal traffic, because it does not travel through their channel.
On your personal device. The VLESS protocol with Reality masking uses the standard port 443 and looks like an ordinary HTTPS session, so on networks with basic filtering it gets through where classic protocols are cut off at the first packet. Automatic reconnection on network change — office, street, home, with no manual steps. Kill switch on Apple devices: if the tunnel drops, traffic stops rather than leaving in the clear across someone else's network.
On corporate hardware, go through IT — it is faster and safer for you.
Why won't the VPN connect at the office? Usually every port except web traffic is closed, and that traffic runs through an inspecting proxy. Classic protocols do not get through such a network.
Can my employer see that I turned on a VPN? On the corporate network, yes — an encrypted connection to an unknown address is visible. On a work device, the installation of the app is visible too.
Can I use a personal VPN on my work laptop? Technically sometimes yes, by the rules almost always no. The company's security policy covers issued hardware, and breaching it is a disciplinary matter.
What do I do if a service I need for work is blocked? A ticket to IT. It gets resolved in a day and creates no problems for you.
Is it safe to use the office guest Wi-Fi from a personal phone? It is as much someone else's network as a café's. The owner of the access point sees which addresses you reach if the traffic is not in a tunnel.
BessyConnect is a VPN for Telegram: restore chats and calls when Telegram isn't working. The VLESS+Reality protocol bypasses blocks and DPI on all devices. More
BessyConnect is a VPN for WhatsApp that restores voice and video calls when they're blocked. The VLESS + Reality protocol beats DPI. Get it for iOS and Android. More
BessyConnect is a VPN for Discord: get into Discord when it's blocked and restore voice, streams and screen sharing on PC and mobile. VLESS+Reality beats DPI. More
