Set Up a Mobile VPN for Secure Public Wi-Fi

What Public Wi-Fi Actually Exposes

Open networks at airports, cafes, and hotels put you on the same broadcast segment as every other stranger connected to that access point. Anyone on that network with basic tools can attempt ARP spoofing to intercept your traffic, run a rogue DNS server to redirect you to fake login pages, or simply set up an "evil twin" access point with a matching name to capture everything you send before it ever reaches the real network. Most modern traffic is encrypted end-to-end via HTTPS regardless of the network, which mitigates a lot of this — but DNS queries, connection metadata, and any app that doesn't enforce HTTPS strictly are still exposed. A VPN tunnels all of that traffic through an encrypted connection to a server you trust, so the local network operator (or anyone else on it) sees nothing but encrypted noise.

Option A: Self-Hosted WireGuard

WireGuard is the modern standard for VPN tunnels — lean codebase, fast, and built into both major mobile OS app stores. Running your own server gives you a VPN endpoint you fully control instead of trusting a third-party provider's logging policy.

1. Provision a small VPS from any cloud provider, or use a home server/router that supports WireGuard natively (many consumer routers running OpenWrt or with vendor firmware do).
2. Install WireGuard server-side. The fastest path on a fresh Linux VPS is a setup script like wireguard-install (angristan) or PiVPN, which handles key generation and config for you interactively.
3. The install script generates a client configuration, usually rendered as a QR code directly in the terminal.
4. On your phone, install the official WireGuard app (iOS App Store / Google Play).
5. In the app, tap Add a Tunnel → Create from QR code and scan the code generated by the server script.
6. Toggle the tunnel on. Your phone's traffic now routes through your server.

Option B: Commercial VPN Provider

If running your own server isn't something you want to maintain, a reputable commercial VPN provider that supports the WireGuard protocol gets you most of the same security benefit with none of the server maintenance, at the cost of trusting the provider's no-logs policy.

1. Choose a provider that explicitly supports WireGuard (most major providers do at this point) and publishes independently audited no-logs claims rather than just asserting them.
2. Install their app from the App Store or Google Play — most providers ship their own client rather than requiring you to configure the generic WireGuard app manually.
3. Log in, select a server location, and toggle the connection on.

Making the VPN Connect Automatically

The biggest practical failure mode for mobile VPNs isn't the encryption — it's forgetting to turn it on before joining a random airport network. Both platforms support automating this:

• Android: go to Settings → Network & internet → VPN, tap the gear next to your configured VPN, and enable Always-on VPN. You can also enable Block connections without VPN so nothing leaks out if the tunnel drops unexpectedly.
• iOS: the official WireGuard app and most commercial VPN apps support On-Demand activation under the tunnel's per-app settings, letting you configure the VPN to auto-connect whenever you're on Wi-Fi that isn't a network you've explicitly trusted (like home).

Verifying the Tunnel Is Actually Working

Don't just trust the toggle — confirm traffic is actually routing through the tunnel:

1. With the VPN connected, visit an IP-lookup site (e.g., ipleak.net or whatismyipaddress.com) in your mobile browser and confirm the reported IP matches your VPN server's location, not your actual location.
2. Check the DNS leak section of the same tools — if your ISP's DNS servers still show up instead of the VPN's, your device may be resolving DNS outside the tunnel, which defeats part of the purpose. This is a known WireGuard client quirk on some configurations; make sure the DNS field in your tunnel config points at a resolver reachable through the tunnel.

Wrap-Up

The gap between "have a VPN app installed" and "actually protected on public Wi-Fi" is entirely about whether it's connected before you start browsing. Set up Always-on VPN or On-Demand activation once, verify the tunnel with an IP/DNS leak check, and you won't have to remember to toggle anything the next time you're tethered to airport Wi-Fi.