Does blocking VPN, Tor or proxies on guest Wi-Fi protect your records?

A worry we hear often from business owners: "If a guest opens a VPN on their phone, does our record become useless?" The short answer is no. The long answer comes from understanding what the record actually holds. This post explains why the record is unaffected by VPNs, what Hotspot-Box does and does not do here, and what to weigh before you decide to block anything.

What the record holds, and what it leaves out

Law 5651 expects a public access provider to keep internal IP assignment records and protect their integrity with a timestamp. Hotspot-Box writes the following for every session:

• The guest's verification detail (the phone number that received the SMS code, stored encrypted and shown masked in the panel; a coupon code; an e-mail address)
• The device's MAC address
• The internal IP the box assigned to that device
• Session start and end time
• NAT (address translation) details where applicable

It does not write: visited sites, URLs, content, messages, location.

That list answers the question on its own. VPNs, Tor and proxies hide the content of traffic and where it goes. The record never cared about content. Whether the guest opens a tunnel or not, this chain stays the same: this number → this device → this internal IP → this time window. The tunnel starts one step outside that chain.

The chain is complete even when traffic is tunnelled

Picture it: a guest signs in with an SMS code, the box hands them an internal IP, then they switch on a VPN. To the outside world the visible address is now the VPN server's. On your side, nothing changed:

Question	Is it in the record?
Which device connected?	Yes, the MAC address
Who verified?	Yes, the phone number (encrypted) or coupon
Which internal IP did it receive?	Yes
When did it sign in and out?	Yes
Which site did they visit?	No; not stored with or without a VPN

The last row matters. What the law expects from a public access provider is the answer to "who, with which device, used which internal IP, and when". A VPN cannot damage that answer. Once the record is linked with a SHA-256 hash chain and stamped under RFC 3161, a guest having used a tunnel does nothing to the chain's integrity either.

Does the box block VPNs? No

Let us be plain: Hotspot-Box has no feature that blocks VPN, Tor or proxy traffic. That is a deliberate choice. The box's job is to verify the guest, separate the network, enforce the plan and keep the record safe. Classifying what is inside traffic is a different product category, and the box does not promise to replace a corporate UTM.

So the sentence "if we don't block VPNs we leave a Law 5651 gap" is simply wrong. There is no gap; you just cannot see what the guest is doing. You were never meant to.

If you still want to block

Some businesses consider blocking for other reasons: protecting bandwidth, house policy in a dormitory, or a security team's preference. That is a firewall and DNS policy decision. The options and their costs:

Method	What it stops	What it costs
Closing well-known VPN ports	Some VPNs on default settings	Many VPNs run over port 443; a travelling guest's corporate VPN drops
DNS filtering of VPN domains	Makes app installation and first connection harder	Needs list maintenance; useless once the guest sets their own DNS
Blocking Tor entry nodes	Direct Tor connections	Bridges get around it; the list changes constantly
Deep packet inspection	Recognises most tunnels	Separate appliance, separate licence, false positives and a privacy debate

Every method stops one thing and breaks another. The complaint we hear most goes like this: the venue blocks all VPNs, an engineer staying at the hotel cannot reach their company network, and there is an argument at reception. Nothing was gained for the record.

Example scenario: what happens when records are requested?

Say an authority asks for the records of a specific day and time window. You select those days in the panel and export them as a ZIP. The package contains day folders, line files, a manifest carrying the SHA-256 chain and the RFC 3161 stamp file; a verification report comes with it. Who used a VPN in that window is neither asked nor present in the package. The question is always the same: which device held this internal IP at that hour, and which verification did that device sign in with? The answer is complete even if the guest used a tunnel.

Our recommendation

1. You do not need blocking for the record. The chain is complete, the record is complete.
2. If bandwidth is the problem, solve it in the plan. Speed limit, session length, idle timeout and daily quota are defined in one place; VPN traffic stays inside those limits too.
3. If you do decide to block, write it into your terms of use. Guests should see in advance what is not allowed.
4. Enforce the policy on the AP or a separate firewall. The box keeps the network separation; filtering lives in its own tool.

For questions about what the record holds and how it is exported, see the FAQ; for how the box fits into your existing network, see the Box + Software page. To talk through your own scenario, get in touch.

This article is general information and is not legal advice.