You're sitting in a hotel room at 11 P.M. with a deadline closing in.
The Wi-Fi is working fine, everything else loads instantly, but your VPN won't connect. You restart it twice, and nothing happens. So you send the email anyway, unprotected, over a network run by people you will never meet.
That's not a VPN problem; it’s a setup problem.
Most people treat a VPN like a light switch, on for public Wi-Fi and off at home, and assume that's good enough. But a VPN is a system with distinct modes, protocols, and settings that serve real purposes.
The defaults work fine in ideal conditions. Hotels, airports, and corporate networks are not ideal conditions, and that's exactly what this article is about.
What "On Demand" mode actually does
There's a gap between the moment you join a network and the moment you actually remember to turn on your VPN. Your phone syncs emails, apps refresh, and notifications come in. All of that is happening before your VPN is even on.
“On Demand” closes that gap automatically.
You mark the networks you trust, and the VPN activates the second it sees anything unfamiliar, whether that's hotel Wi-Fi, an airport lounge, or mobile data. You don't have to remember. It just handles it.
Pro tip: Set “On Demand” once right after installing IPVanish. Add your home and work networks to the trusted list, then forget about it. Every other network gets the VPN automatically from that point onward.
Many people often confuse “On Demand” with the kill switch. Keep in mind, they're not the same thing, and they solve different problems.
“On Demand” is proactive and turns on the VPN before you even connect to the network, so the very first packet that leaves your device is already protected.
The kill switch works the other way around. It sits quietly in the background and only fires when the VPN tunnel fails, cutting all traffic instantly so nothing slips out unencrypted while the connection recovers.
You want both running together, because “On Demand” handles the start, and the kill switch handles the break; neither one covers what the other does.
Choosing your protocol: WireGuard, OpenVPN, or IKEv2
VPN connections don’t all behave the same. The protocol controls how your device builds the tunnel to the VPN server, and each one handles pressure differently. Firewalls, unstable Wi-Fi, and mobile networks all respond better to different setups.
Here’s how to pick the right protocol for the situation:
Wireguard
WireGuard is the newest of the three and, in most cases, the fastest. It’s built lean, so it connects faster and doesn’t drain your battery as older protocols do.
For everyday use like home networks, hotels' Wi-Fi that aren’t overly restrictive, or streaming, this is the easiest pick. And if you’re unsure, just start with this.
The catch? It only works over UDP.
And some networks love blocking that, like corporate setups or certain hotel Wi-Fi. And when WireGuard refuses to connect, that’s usually the reason. So when that happens, switch to OpenVPN and move on.
OpenVPN
OpenVPN is the oldest of the three. It’s reliable, flexible, and built to handle messy networks.
Run OpenVPN over TCP on port 443, and your traffic looks just like normal HTTPS browsing. To a firewall, it’s just another secure website.
This also matters because firewalls block traffic by recognizing what it is, as standard VPN traffic has a distinct signature, and a firewall that sees it can shut it down. Traffic that appears to be HTTPS doesn't trigger that.
Also, blocking port 443 in any case? Not happening. That would break half the internet. So most networks leave it alone.
That is why OpenVPN is your fallback when WireGuard refuses to connect. It can also run on UDP if you want more speed. And when you’re stuck on a locked-down network? Switch to TCP on port 443; that’s what gets you through.
IKEv2
IKEv2 has native support on iOS, macOS, and Windows, which gives it a real edge on those platforms. Its main strength is handling network switches: your phone moves from Wi-Fi to mobile data, and IKEv2 maintains the tunnel without dropping it, while most other protocols would disconnect and reconnect.
This is especially useful if you're moving around a lot during the day. The downside is that it relies on UDP ports 500 and 4500, which corporate firewalls frequently block.
If you're on a restrictive network, OpenVPN over TCP on port 443 is the better call.
The Kill Switch: What happens when the tunnel drops
VPN connections drop more often than you'd expect. A train signal cuts for a second, hotel Wi-Fi glitches, or your phone switches towers. When that happens, your device doesn't wait around. It falls back to your regular internet and keeps everything running.
Pages keep loading, apps keep syncing, and nothing feels broken. Except everything is now unencrypted, and you have no idea it happened.
That's exactly what the kill switch is there for.
The moment your VPN drops, the kill switch cuts your internet completely. Your device stays offline until the VPN reconnects successfully, ensuring nothing slips through the gap. Those few seconds feel like a minor inconvenience, but without the kill switch, they're enough for your traffic to leak without you ever noticing.
System-wide vs per-app: Which one to use
Most kill switch implementations block all traffic the moment the VPN drops. Some let you protect specific apps instead, which feels less disruptive but leaves everything outside those apps exposed if the tunnel fails.
- System-wide blocks everything. Safer, slightly more disruptive.
- Per-app protects only what you choose. More flexible, but anything you didn't select is still exposed.
Unless you have a specific reason to use per-app mode, go system-wide. A few seconds of interrupted internet is a small price compared to accidentally leaking anything on a network you don't control.
Split tunneling: Protecting some traffic, not all of it
Sending everything through your VPN sounds like the safest move. And it is, until it starts getting in the way.
Your local printer stops responding. Netflix buffers because your traffic is being routed through a server in another country. Your work VPN and your personal VPN start stepping on each other. None of this means your VPN is broken. It just means you're routing traffic that didn't need protection through a tunnel it didn't need to go through.
Split tunneling fixes this.
Instead of an all-or-nothing setup, you decide what goes through the VPN and what connects directly. Sensitive traffic stays protected. Everything else just works normally.
Here's how that looks in practice:
- Working remotely: Keep work email and internal tools on the VPN, but let Netflix and Spotify connect directly. No more routing your streaming through an office server in a different city.
- Traveling: Keep banking and private browsing inside the tunnel, but let maps and local apps connect normally so they actually work.
- At home: Keep printers and NAS drives outside the tunnel so they stay reachable, without slowing down everything else.
On iOS, you pick specific apps to exclude from the tunnel rather than a blanket setting. Not every iOS version supports this, so if you don't see it in IPVanish's settings, that's why. One more thing: split tunneling and “On Demand” cannot run together on iOS. If one is active, the other turns off automatically.
Anything you route outside the VPN is unprotected. On a network you don't fully trust, think twice before splitting traffic. Only exclude apps you're genuinely comfortable leaving exposed.
Port selection: The firewall bypasses most people, who don't know about it
Think of a port like a gate. Your VPN knocks on a specific gate every time it tries to connect, and if that gate is locked, the connection dies before it even starts.
Every VPN protocol has a default gateway it uses:
- WireGuard knocks on UDP 51820
- OpenVPN knocks on UDP 1194
- IKEv2 knocks on UDP 500 and 4500
Network admins know this, so on restrictive networks like hotels or offices, those gates are often deliberately locked.
Port 443 is the one gate nobody can afford to lock. It's the same gate your browser uses every time you visit a secure website. Lock it, and you break the internet for everyone on the network. So even the strictest firewalls leave it open.
That's your way through.
Switch to OpenVPN, set it to TCP, and use port 443. Your VPN traffic now looks exactly like someone browsing a normal website. Most firewalls won't even flag it.
Remember: Reach for this setting whenever your VPN refuses to connect, but everything else loads fine. Port 443 on OpenVPN TCP is almost always the fix.
How to configure IPVanish for three common situations
If you want the quick setups, here's exactly what I'd do.
Situation 1: Daily use at home or on a reliable network
For everyday use at home or on a solid network, keep it simple. Go with WireGuard, leave it on UDP, and turn on the kill switch. If you don't want to think about it, enable “On Demand” so it connects automatically when you leave your trusted network. Set it once and forget it. That's usually my default.
Situation 2: Hotel, airport, or any network that's blocking your VPN
When you're on hotel Wi-Fi, airport networks, or anything that's blocking your VPN, switch it up. Move to OpenVPN, set it to TCP, and use port 443. Your traffic now looks like regular browsing, so it gets through. Keep the kill switch on throughout. This is the setup I jump to when nothing connects.
Situation 3: Working remotely with local network access needs
If you're working remotely and still need access to local devices, use split tunneling. Route your work apps and browser through the VPN, and keep local traffic outside it. Your work stays protected, and everything around you continues to work normally.
These settings were always there. Now you know how to use them.
The right settings take five minutes. Start here.
IPVanish lets you control every setting covered in this article: protocol, kill switch, split tunneling, “On Demand”, and port selection. It works across Windows, macOS, Android, iOS, and Fire TV.
These settings work whether you're on a laptop in a hotel or switching between networks on your phone all day. Plans start at $2.19 per month on the two-year Essential plan, with a 30-day money-back guarantee.
FAQs
What VPN protocol should I use by default?
WireGuard is the best default protocol for most situations. It's the fastest and lightest of the three options, and it works well on home networks, hotel Wi-Fi, and for streaming. If it won't connect, switch to OpenVPN TCP on port 443.
What does “On Demand” mode do?
“On Demand” mode automatically activates your VPN the moment you connect to a network not on your trusted list. Instead of relying on memory, protection runs before you open a single app. It eliminates the gap between joining a network and remembering to connect and prevents any exposure of sensitive data.
When should I use split tunneling?
You should use split tunneling when routing everything through the VPN creates friction. Keep sensitive apps within the tunnel while allowing local devices, banking apps, or location-dependent services to connect directly. Don't route anything sensitive outside the tunnel on a network you don't trust.
What happens if my VPN drops and I don't have a kill switch?
If your VPN drops and you don't have a kill switch, your device automatically falls back to your regular unencrypted connection. Your traffic continues to go out unprotected; your ISP can see it, and you won't know it happened until after the fact.
Why does my VPN fail to connect in hotels or at work?
Your VPN fails to connect in hotels or at work because a firewall is blocking the port it uses. Switch to OpenVPN, set it to TCP, and use port 443. That port carries normal web traffic and is almost never blocked.
What's the difference between UDP and TCP for VPNs?
The difference between UDP and TCP for VPNs comes down to speed versus compatibility. UDP is faster and the better default for most connections. TCP is slower but more compatible with restrictive networks, especially on port 443, where it looks identical to normal HTTPS browsing. Switch to TCP when UDP is being blocked, and your VPN won't connect.