Why Enterprise Firewalls Kill Your Tabletop Session and How Obfuscation Actually Fixes It
Ready to bypass enterprise packet inspection and maintain a continuous AboveVTT sync?
If you have ever tried opening AboveVTT from an office desk or a managed co-working space, you probably know the exact frustration. The extension loads fine, your character sheet on D&D Beyond pulls up with all your spells and stats intact, but the moment you enter the shared canvas, nothing syncs. Token movements freeze, dice rolls take a minute to post or fail entirely, and down in the corner of your browser, the status indicator gets stuck in an infinite loop: connecting, connected for two seconds, dropped, reconnecting.
At first, you assume the AboveVTT server or your DM's host is having a temporary outage. You hit refresh, restart Chrome, or clear your cache. When that changes nothing, you check the community Discord on your phone, only to see everyone else rolling initiative without a hitch.
The issue is almost never AboveVTT itself. It is the network you are sitting on.
Corporate local area networks, enterprise guest Wi-Fi, and co-working environments run behind strict security appliances like Fortinet, Palo Alto, or Cisco Meraki. While normal web traffic runs over plain HTTPS on port 443 with standard request-and-response patterns, AboveVTT relies on persistent WebSockets to keep every player's map state, fog of war, and roll log synchronized in real time.
To an enterprise firewall configured for office productivity, a long-lived, continuous bidirectional WebSocket connection looks suspicious or unnecessary. Most corporate proxy rules enforce aggressive idle timeouts or actively terminate non-standard HTTP upgrade headers. Worse, Next-Gen Firewalls (NGFW) perform deep packet inspection (DPI). The moment the firewall inspects the transport layer and identifies peer-to-peer or persistent tabletop socket protocols, it sends a TCP reset packet or drops the keepalive silent ping. The browser extension thinks it dropped carrier, immediately retries, gets killed again, and leaves you trapped in the reconnect loop.
The instinctive reaction is to grab whatever free browser proxy extension or standard VPN client you have lying around. But on a corporate or managed network, that usually makes things worse.
A basic browser proxy only reroutes standard HTTP requests; it frequently fails to tunnel raw WebSocket frames cleanly, leaving the handshake broken. Meanwhile, a standard desktop VPN running on WireGuard or default OpenVPN ports gets instantly spotted by network monitors. Enterprise firewalls routinely block standard VPN handshake signatures on port 51820 or 1194. Even if IT doesn't care about your casual session, the automated security policy will simply block the VPN tunnel on connection, leaving you completely offline.
To solve the AboveVTT disconnected loop on an office network, your traffic needs to satisfy two requirements simultaneously: full layer encapsulation so WebSockets are protected inside the tunnel, and traffic obfuscation (stealth mode) so the enterprise firewall sees nothing except ordinary, indistinguishable TLS traffic on port 443.
This is where a stealth-focused solution like ONLYDOGSVPN enters the picture. Rather than broadcasting standard VPN protocols that trigger immediate gateway blocks, it wraps your outbound packets in stealth encapsulation, disguising the connection as standard web browsing. To the office firewall, your machine is simply maintaining an encrypted web session, allowing the underlying AboveVTT WebSocket handshake to persist without arbitrary socket terminations or proxy interference.
You also have a choice in how you run it: a lightweight browser extension or a full system client.
If you are using a shared or monitored workstation where you cannot install system-level drivers—or where you strictly want your tabletop session routed through the tunnel while company email, Slack, and internal intranet portals remain untouched—a dedicated browser extension with secure proxying is the cleanest route. It isolates AboveVTT inside Chrome or Brave and leaves the rest of your machine alone.
If you are on your personal laptop connected to the corporate guest Wi-Fi, running a system-wide client with obfuscation and a built-in kill switch is the more robust choice, ensuring voice apps like Discord and background token assets never leak over the monitored gateway.
That said, you should be realistic about whether you actually need this tool.
If your office Wi-Fi requires you to install a corporate root SSL certificate on your machine for mandatory deep packet decryption, running a VPN on a company-owned computer can violate workplace acceptable-use policies and may trigger automated alerts in your security operations center. If you are on an IT-managed machine with strict software restrictions, do not try to circumvent system policies just to join a midweek one-shot. In that scenario, tethering your personal laptop or tablet to your phone's cellular hotspot is far safer and avoids touching the corporate gateway altogether.
Similarly, if you are playing from home and experiencing the WebSocket loop, your problem is almost certainly an aggressive local antivirus web shield, an outdated browser extension, or an unstable home router DNS—not an enterprise proxy firewall. You do not need a paid stealth VPN to fix a home browser conflict.
However, if you are sitting on a restrictive office or co-working network on your own device, your character is stuck waiting at the dungeon door, and an overzealous proxy keeps severing your real-time tabletop feed, running an obfuscated tunnel is the single most effective way to eliminate the loop and stay connected through the entire session.