D06 · Deep dive
What the Hotel Sees: Two Travel Router VPN Modes, and Where DNS Goes
Nothing loads from YouTube until you press play. The video then plays in YouTube’s privacy-enhanced mode.
A deep dive into the Communication Suite's two tested network modes. Why the endpoint VPN carries the weight and the router adds an outer tunnel only in nested mode; the build requirement for nesting; what a hotel network sees in low-signature mode (high-volume UDP/443, with relay IP reputation and flow still observable) and in nested mode (the router's WireGuard); why plain WireGuard fails as the visible layer; and where DNS goes in each mode, with the limits of what the suite's hotel test lab observed.
What you’ll learn
- Know both validated profiles and why there are two
- Know why plain WireGuard fails as the visible layer
- Know the DNS rule for each mode
Chapters
The honest limits
The DNS result is an observation for that workload, not proof for every DNS path or the IPv6 path. AdGuard Home wasn't validated across mode changes. Full DAITA and Multihop nesting wasn't stable in the hotel test lab. One provider is still a shared trust domain. These results don't validate every device, or show that VPN use can't be spotted.