Work
The VPN and the home hub
A corporate VPN is a second, fussier line sitting on your first. Some home products were not designed to carry it.
12 min read · Work
The home hub is a domestic appliance. The work VPN is a paranoid tunnel with a 1998 attitude to packet size. When they meet, people buy a faster tariff. Sometimes they needed 20 megabits more upload. More often they needed not to be double-NAT’d behind a carrier-grade address, or they needed the MTU lowered by 80 bytes, or they needed the laptop off the kettle radio. IT will blame the ISP. The ISP will blame Wi‑Fi. You live in the middle with a payroll.
The only A/B test that matters
Same desk, ethernet, same hour: speed test and a large page without VPN, then with. If both are poor, you have a line or radio problem. If only VPN is poor, you have a tunnel problem.
Phone hotspot as a third trial. If the VPN sings on 5G and sulks on the FTTP, look at NAT, MTU, and the hub — not at a 900 Mbit upgrade.
CGNAT is a product choice
Cheap household tariffs share IPv4. Fine for iPlayer. Less fine for some IPsec, some inbound cameras, some ‘the VPN hangs after an hour’ mysteries. Retailers sell a public IP or a static as an extra because addresses cost money.
Ask whether you are on CGNAT. If they do not know, that is information. A support-premium ISP often knows.
MTU, the unfashionable fix
Tunnels add headers. If the hub and the VPN both assume 1500, large packets fragment or vanish. Symptoms: small things work, big things hang, video is ‘fine’ until you screen-share.
Lowering WAN MTU (or MSS clamping) on a grown-up router is boring and effective. It is not a gigabit.
| Symptom | Try | Unlikely |
|---|---|---|
| All traffic slow | Upload, radio, the line | A new logo |
| Only VPN slow / hangs | CGNAT, MTU, split-tunnel | 900 Mbit down |
| Fine on 5G, bad at home | NAT/hub path | Your employer’s entire WAN |
A tunnel is not a speed test. Treat it as software sitting on a line, not as the line.
Work VPNs turn ordinary lines into special cases. Solve the special case. Do not throw gigabits at a header.
Questions searchers actually ask
Sources
- IETF notes on MTU and VPNs
- Provider CGNAT disclosures
- Typical corporate VPN client troubleshooting
Figures move. Prices, coverage and eligibility must be confirmed with the provider. OneTouchSwitch is not Ofcom, TOTSCo or a broadband network. Last fact-checked 10 September 2026.
Continue in this issue
Work
12 min read · Work
Work
A static IP without the business theatre
A number that does not change is a tool. It is not a status, and it is not a reason to sit on a business tariff you do not need.
Work
13 min read · Work
Work
Two workers, one upload
The household that needs two concurrent calls is a specification. It is not a lifestyle brand, and it is not 900 megabits down.
Hardware
13 min read · Hardware
Hardware
Your own router on Openreach
Bring-your-own is ordinary on Openreach. It is not a loophole, and it is not always allowed on every alt-net.
Retailers
12 min read · Retailers
Retailers
Zen and the support premium
Some retailers sell a helpdesk. The fibre is the same. Whether that is worth £8 a month depends on the Tuesday your ONT dies.
Practical guides