Your VPN works fine on WiFi, then you leave the house, switch to T-Mobile or Verizon data, and it stops loading anything. The obvious conclusion is "my carrier blocks VPNs". In most cases it doesn't. None of the big three US carriers block ordinary VPN use as policy. What breaks the connection is usually a feature on your line, an app the carrier installed, or the way 5G home internet is built.
Here's what to check for each carrier, and the fixes that work.
Short answer: no, T-Mobile, Verizon and AT&T don't block VPNs as a rule. The usual culprits are T-Mobile's Web Guard content filter, which T-Mobile itself says may not be compatible with VPNs, a carrier security app running its own VPN (Verizon Digital Secure, AT&T ActiveArmor), and CGNAT and MTU quirks on 5G home internet. Turn those off or adjust them and a normal VPN works.
Table of Contents
T-Mobile: Web Guard and Home Internet
T-Mobile's own broadband disclosure says it doesn't block lawful traffic based on content unless it's part of a service the customer chose. VPNs aren't blocked as a category.
The feature that trips people up is Web Guard, T-Mobile's free content filter for family lines. T-Mobile's Web Guard support page says plainly that content filtering "may not be compatible with certain products or services, such as Virtual Private Networks". Web Guard only applies on mobile data, not WiFi. That's exactly why the VPN works at home and fails outside. If you're the account holder, set Web Guard to No Filtering in the T-Mobile app or on T-Mobile.com under Profile, then Family Controls. If it's a child's line, that's the filter doing its job.
One more T-Mobile detail: its video optimisation can't identify video sent through a VPN, so streams over a VPN may use more data than T-Mobile's optimised video would.
Verizon: Digital Secure and 5G Home
Verizon doesn't block VPNs either. It actually sells one. Digital Secure ($5 per line or $10 per account a month) includes a "Secure VPN" that can turn itself on automatically when you join an unsecured WiFi network. If it's installed and set to auto-connect, it can take over Android's VPN slot from the VPN you actually want to use.
Verizon's own Digital Secure FAQ also notes that content-filtering or parental-control devices on your home network can make the app flag your WiFi as unsafe. That's another sign that filters and VPNs tend to clash.
AT&T: ActiveArmor and Wi-Fi Calling
AT&T's paid ActiveArmor advanced mobile security includes "Public Wi-Fi Protection", which is a VPN. AT&T's terms say it can auto-connect on open WiFi, and that it isn't compatible with Wi-Fi Calling on some devices. On those phones, calls bypass or disconnect the VPN. AT&T's business brochure also says the feature turns on automatically on public WiFi unless another VPN is already active, so connect your own VPN first and they won't fight.
The Rule Most People Miss: One VPN at a Time
Android allows exactly one VPN app to run at a time. Carrier security apps (Verizon Digital Secure, AT&T ActiveArmor), "secure WiFi" features and some antivirus apps all use that same slot. When two of them are set to auto-connect, they keep knocking each other off. You see the VPN flicker on and off, or a "Disconnected from Always-on VPN" message. Pick one, then turn off auto-connect in the other. Our VPN keeps disconnecting guide covers this in more detail.
5G Home Internet: CGNAT and MTU
T-Mobile 5G Home Internet, and many Verizon 5G Home lines, put you behind CGNAT: many customers share one public IPv4 address. This catches people out in two ways:
- Normal VPN apps still work. Your phone or laptop opens the tunnel outward, the same way it loads a website.
- Hosting your own VPN at home doesn't. If you run a WireGuard server on your home network and try to reach it from outside, CGNAT blocks the incoming connection, and port forwarding can't fix it.
The other common issue is MTU. If a VPN connects but some pages or apps hang, the packets may be too large for the 5G link. Lowering the VPN's MTU (users with work VPNs on T-Mobile Home Internet report that 1300 fixed it) often fixes it. On a phone app without an MTU setting, try switching server or protocol first.
Fix Checklist
- Test on WiFi. If the VPN works there but not on mobile data, check your carrier settings (Web Guard, family controls).
- Turn off content filters on your line if you're the account holder.
- Turn off auto-connect in carrier security apps (Digital Secure, ActiveArmor) if you use another VPN.
- Set Private DNS to Automatic. A custom DNS can stop a VPN loading pages. See our Private DNS guide.
- On 5G home internet, lower MTU if pages hang, and don't expect to host a VPN server behind CGNAT.
- Still stuck? Work through VPN not connecting on Android.
Frequently Asked Questions
Does T-Mobile block VPNs?
No. T-Mobile says it does not block lawful traffic based on content unless it is part of a service the customer chose. Its Web Guard content filter may not be compatible with VPNs, so turning Web Guard off usually fixes VPN problems on T-Mobile data.
Does Verizon block VPNs?
No. Verizon even sells its own VPN in the Digital Secure add-on. If that app is set to auto-connect, it can take Android’s single VPN slot from another VPN app.
Does AT&T block VPNs?
No. AT&T’s ActiveArmor advanced mobile security includes its own VPN for public WiFi, which turns on automatically unless another VPN is already active. It may not work with Wi-Fi Calling on some devices.
Does a VPN work on T-Mobile 5G Home Internet?
Yes, VPN apps work because they connect outward. What does not work behind T-Mobile’s CGNAT is hosting your own VPN server at home and reaching it from outside.
Do US carriers include a free VPN?
Some security add-ons include one: Verizon Digital Secure ($5 a line) and AT&T ActiveArmor advanced mobile security both include a VPN for public WiFi. Pixel 7 and newer phones also have VPN by Google built in.
Sources
- T-Mobile: Web Guard device content filter
- T-Mobile: Broadband Internet Access Services disclosure
- Verizon: Digital Secure (pricing and Secure VPN)
- AT&T: ActiveArmor mobile security terms
- FlashRouters: What is CGNAT? T-Mobile and 5G home internet
A VPN That Works on Any US Network
CarrotVPN runs WireGuard® on servers in the USA, Germany, the Netherlands and more. No account, no data cap.
Download CarrotVPN Free