Why Does a VPN Work on Mobile Data but Not Wi-Fi in China?

When you see a VPN work on mobile data but not Wi-Fi in China, the problem points to the Wi-Fi path rather than the app itself: an unfinished or expired login page, the network's own policy, DNS or routing differences, and device settings can each make the same VPN fail only on Wi-Fi. Confirm that ordinary internet works on that Wi-Fi first, then compare the two networks with everything else unchanged. The mobile-data success narrows the fault domain, but it does not, by itself, prove that the Wi-Fi operator is deliberately blocking VPN traffic.

Key Takeaways

• Keep the device, account, app version, location, and test time as consistent as possible.
• Prove ordinary Wi-Fi internet and finish its login page before comparing the VPN.
• A mobile-data success is evidence about scope, not evidence of intent.
• Cross-check with one other device or one other authorized Wi-Fi when practical.
• Do not modify a hotel, company, school, or other person's router or bypass its policy.

Use the China VPN guide for preparation and selection. This article is only about interpreting the network comparison.

Why can a VPN work on mobile data? Start a controlled network comparison

Change one variable: the base network.

Variable	Keep it the same
Device	Use the same phone or computer
Account	Stay signed in to the same account
App	Keep the same installed version and settings
Target	Use the same location or connection choice offered by the app
Time	Run both tests close enough that service conditions are comparable
Test	Use the same ordinary webpage and the same VPN connection attempt

Android's official guidance specifically recommends switching between Wi-Fi and mobile data and checking whether the result differs.［1］ The method is useful beyond Android because it isolates the access network without claiming a cause.

Before switching, record the time, ordinary-internet result, VPN result, and exact error. Do not update the app, change three settings, and move locations between tests; that would make the comparison ambiguous.

In the AethoVPN app, the Target row means one location picked from the in-app list, preferably one whose load indicator is green. Write down its label and keep that same location selected for the mobile-data run and the Wi-Fi run, so the base network is the only difference. Settle the app version before the first run, not between runs. A clean comparison tells you where the failure sits; it does not repair a Wi-Fi network whose ordinary internet or portal step fails, which the next section checks. If the installed version is out of date, download the current Android or Windows client before the first run (on iPhone, refresh the setup-guide configuration, which needs Pro or Premium).

If the VPN fails only on Wi-Fi, what should ordinary troubleshooting prove first?

Connect to the intended SSID and make sure the device is not silently using mobile data. With the VPN off:

1. Open one expected, ordinary HTTPS page.
2. Open a second unrelated service.
3. Look for a hotel, airport, café, or office sign-in page.
4. Complete only a recognized portal request.
5. Retest ordinary internet.

A captive portal may restrict a device to a small set of services until site-specific conditions are satisfied. RFC 8952 describes this restricted state and the transition to broader network access.［2］ If the Wi-Fi itself is not online, a VPN failure says nothing useful about the tunnel.

Use the captive-portal troubleshooting guide when the sign-in page does not appear or repeats. Do not accept an unknown certificate, install an unverified profile, or enter an unrelated account password to force access.

How should you read a VPN mobile data vs Wi-Fi result matrix?

Mobile data	Wi-Fi ordinary internet	Wi-Fi VPN	Best current interpretation
Works	Fails	Fails	Fix or report the Wi-Fi internet layer first
Works	Works after portal	Fails	Failure follows this Wi-Fi during the test; cause remains open
Works	Works	Works	The earlier problem may have been transient or portal-related
Fails	Works	Fails	Look beyond the Wi-Fi/mobile split: app, device, account, or service path
Works on device A	Works	Fails only on device B	Compare device permissions, time, profiles, and conflicts

The second row is the common puzzle. Possible explanations include a portal session that is incomplete or expired, network policy, routing differences, address assignment, DNS behavior, congestion, a temporary endpoint problem, or a device-specific interaction. The experiment does not tell you which one is true.

Internet access and service availability in China can change with time and network conditions. Follow local law and the rules of the network you are using.［3］

Add one cross-check, not a dozen changes

If practical, choose one:

• test the same Wi-Fi with another device that you own or are authorized to use;
• test the same device on another trusted Wi-Fi;
• repeat the original two-path comparison later without changing the app.

Another device works on the same Wi-Fi: investigate the failing device's time, VPN permission, proxy, competing VPN, enterprise profile, or security tool. Both devices fail only on that Wi-Fi: report the network-specific evidence to the host or VPN support. Another Wi-Fi works: keep the result, but do not alter the original network unless you manage it.

The portable hotspot versus public Wi-Fi guide can help you choose a legitimate backup connection. A backup is not permission to evade an organization's acceptable-use policy.

Which actions are safe on a network you own?

On your own or explicitly authorized network, you may verify the SSID, reconnect, forget and rejoin after saving the password, restart equipment according to its manual, and review recent configuration changes. Make one reversible change and rerun the same test.

On a managed network, do not:

• log in to an administration panel without authorization;
• change DNS, firewall, access-control, or filtering policy;
• reset a hotel or office access point;
• disconnect other guests or employees;
• spoof identity or device registration;
• attempt to bypass access terms.

Ask the network owner whether VPN use is permitted and whether your device needs registration. Give them the time, device type, ordinary-internet result, and error, not your VPN password or recovery codes.

What should you report to VPN support?

Provide the controlled matrix: same device, account, app version, offered location, close test time, mobile-data result, Wi-Fi ordinary-internet result, portal state, Wi-Fi VPN result, and any second-device result. Remove private SSIDs, room numbers, passwords, verification codes, configuration secrets, and private keys.

If the matrix points to this Wi-Fi, a follow-up test may change one more variable, such as one other location the installed client currently lists. Record the old and new labels and compare once; a stale online list is not proof of current availability.

For the broader sequence when both networks fail, use VPN not connecting in China.

Summary

• Keep the test controlled and change only the base network.
• Verify ordinary Wi-Fi and its portal first.
• Treat mobile-data success as scope evidence, not proof of deliberate blocking.
• Add one authorized cross-check.
• Change router settings only when you own or manage the network.
• Report the result matrix without secrets.

FAQ

Does mobile data success prove the hotel blocks VPNs?

No. It proves only that the tested connection succeeded over mobile data and failed over that Wi-Fi under those conditions.

Should I forget and rejoin the Wi-Fi?

Only on a network you are allowed to use and after saving the password and any registration details. Complete the portal check first.

Why does ordinary Wi-Fi work while the VPN fails?

The two connections use different paths and may encounter different policy, routing, DNS, portal, or endpoint conditions. The symptom alone cannot select one cause.

Can I change the hotel's router settings?

No, unless the hotel explicitly authorizes you to manage that equipment. Ask staff or use an approved alternative connection.

Is a phone hotspot always safer or faster?

No. It depends on coverage, plan terms, device heat and battery, local rules, and the sensitivity of the task.

What should remain constant in the comparison?

Keep the device, account, app version, offered location, and test method constant, and run the two tests close together.

Disclaimer: This article provides general network troubleshooting information. Follow local law, service terms, and the policy of any managed network.

Sources

1. Google Android Help — Fix internet connection problems — https://support.google.com/android/answer/2651367?hl=en
2. RFC Editor — RFC 8952: Captive Portal Architecture — https://www.rfc-editor.org/info/rfc8952/
3. GOV.UK — China safety, security, and internet-access advice — https://www.gov.uk/foreign-travel-advice/china/safety-and-security

Sources checked 4 October 2026.

Related guides

• Prepare a VPN for China
• Use the full China connection checklist
• Complete a captive portal before connecting
• Compare a hotspot with public Wi-Fi