Train WiFi: The Complete Guide for Rail Operators and Passengers

TRAIN WIFI: THE COMPLETE GUIDE FOR RAIL OPERATORS AND PASSENGERS A Purple WiFi Intelligence Podcast Runtime: Approximately 10 minutes --- [INTRODUCTION & CONTEXT — 1 minute] Welcome to the Purple WiFi Intelligence podcast. I'm your host, and today we're tackling one of the most technically complex and commercially significant connectivity challenges in the transport sector: passenger WiFi on trains. If you're a rail operator, a network architect working with a train operating company, or an IT director responsible for rolling stock connectivity, this episode is built for you. We're going to cover the full picture — from the physical architecture of how WiFi actually gets onto a moving train, through to the security risks your passengers face, the compliance obligations you carry, and the analytics opportunity that most operators are leaving on the table. Let's start with a number that sets the scene. According to Ookla's Speedtest Intelligence data from Q2 2025, the gap between Europe's best and worst train WiFi is staggering. Sweden delivers a median download speed of 64.58 megabits per second on its rail network. The United Kingdom, by contrast, delivers just 1.09 megabits per second. That's a 59-fold difference — on the same continent, in the same year. That gap isn't primarily a technology problem. It's a policy and investment problem. And understanding why is the first step to fixing it. --- [TECHNICAL DEEP-DIVE — 5 minutes] Let's get into the architecture. A modern passenger WiFi deployment on a train has three distinct layers, and most operators underinvest in the wrong one. The first layer is the WAN backhaul — the connection between the train and the outside world. This is where your data actually comes from. Historically, this was a single LTE modem with a roof-mounted antenna. Modern deployments aggregate multiple uplinks simultaneously: two or more LTE or 5G modems from different mobile network operators, trackside WiFi in stations and depots, and increasingly, low-Earth-orbit satellite connectivity from providers like Starlink. The aggregation logic — deciding which uplink to use, how to bond them, and how to fail over gracefully — runs on a WAN gateway device mounted in the train's equipment bay. This is the layer that determines your ceiling. You can have the most sophisticated onboard WiFi infrastructure imaginable, but if your backhaul is a single congested LTE connection in a rural cutting, your passengers will notice. Ookla's data confirms this: countries with modern WiFi hardware but poor backhaul infrastructure — like Spain and Italy — still underperform on real-world speeds. Backhaul is the dominant bottleneck. The second layer is the onboard network itself. This is where the WAN gateway connects to an onboard router and, typically, a rail server. The router handles VLAN segmentation — and this is critically important from a security perspective. Your passenger WiFi must run on a completely isolated VLAN, with no routing path to the operational network that carries your CCTV feeds, your Passenger Information System, your automatic ticketing systems, or — most critically — your European Train Control System signalling data. In 2024, a cyberattack on a UK passenger WiFi network demonstrated exactly what happens when this segmentation is inadequate. The attack propagated from the public-facing WiFi into systems it should never have been able to reach. IEEE 802.1X port-based authentication and strict inter-VLAN firewall rules are non-negotiable here. The rail server layer adds containerised application hosting — think local content caching, onboard entertainment portals, real-time journey information displays, and captive portal services. Running these locally means passengers get a responsive experience even when backhaul connectivity degrades in tunnels or rural sections. The third layer is the passenger-facing WiFi itself. This is where your access points live — typically ceiling-mounted throughout each carriage, operating on 802.11ac WiFi 5 or, in newer deployments, 802.11ax WiFi 6. Here's a critical finding from the Ookla data: in Germany, switching from WiFi 4 to WiFi 5 delivers a 241% speed improvement for passengers. Switching from the 2.4 gigahertz band to 5 gigahertz delivers a 328% improvement. Yet across Europe, nearly 40% of train WiFi connections still run on WiFi 4, and the UK has over half of all connections on that legacy standard. The cabin hardware upgrade cycle is overdue. Now, there's one physical challenge that's unique to trains and genuinely difficult to solve: RF attenuation through modern rolling stock windows. Contemporary train windows often incorporate metallic coatings for thermal insulation and UV filtering. These coatings can attenuate mobile signals by 20 to 30 decibels — more than a layer of reinforced concrete. This is why roof-mounted antennas feeding internal repeaters are essential, rather than relying on passengers' devices to connect directly to trackside infrastructure. Some operators are now pursuing RF-permeable window retrofits, but this is a significant capital programme. On the backhaul evolution front, the most exciting development right now is LEO satellite integration. Starlink's maritime and mobility product has demonstrated sustained throughputs of 100 to 200 megabits per second on moving vehicles, with latency in the 20 to 40 millisecond range — genuinely usable for video conferencing. Several European operators are in active trials. The economics are improving rapidly, and for rural and cross-border routes where terrestrial mobile coverage is patchy, LEO satellite is increasingly the pragmatic solution. Let's talk about the captive portal and data layer, because this is where the commercial opportunity sits — and where most operators are leaving significant value on the table. When a passenger connects to your WiFi, the captive portal is your primary touchpoint. Done well, it captures a verified email address or social login, presents your terms of service and privacy notice in a GDPR-compliant format, and begins building a first-party data profile of that passenger's journey behaviour. Done badly, it's a friction-heavy obstacle that passengers abandon, or worse, a compliance liability. Under GDPR, you need a lawful basis for processing passenger data — typically consent, obtained at the point of connection. That consent must be freely given, specific, informed, and unambiguous. Pre-ticked boxes don't count. You need a clear record of when consent was given, what was consented to, and the ability to honour subject access requests and deletion requests. Platforms like Purple's Guest WiFi solution handle this compliance layer natively, with audit-ready consent logs and automated data retention policies. The analytics that flow from compliant data collection are genuinely valuable. Journey frequency, peak connection times, carriage occupancy patterns, dwell time at stations — this is operational intelligence that feeds into capacity planning, service design, and targeted communications. It's the same data model that retailers and hospitality operators have been using for years, now available to rail operators through the WiFi access layer. --- [IMPLEMENTATION RECOMMENDATIONS & PITFALLS — 2 minutes] Let me give you the three decisions that will make or break your deployment. First: invest in backhaul before you invest in cabin hardware. A state-of-the-art WiFi 6 access point network fed by a single congested LTE modem will disappoint passengers. Audit your route coverage first. Identify the black spots — tunnels, rural cuttings, cross-border sections. Design your uplink aggregation strategy around those gaps. Consider multi-operator SIM bonding as a minimum, and evaluate LEO satellite for routes where terrestrial coverage is genuinely inadequate. Second: treat network segmentation as a safety-critical requirement, not an IT best practice. Your passenger WiFi and your operational network must be on separate VLANs with explicit deny-all inter-VLAN firewall rules. Penetration test the boundary annually. The 2024 UK incident should be a wake-up call for every operator that hasn't done this audit. Third: don't deploy a captive portal without a data strategy. If you're going to ask passengers to register, give them a reason to do so — faster speeds, journey updates, loyalty points — and have a clear plan for what you'll do with the data you collect. A captive portal that collects data with no downstream use is a compliance risk with no commercial upside. The pitfalls to avoid: Don't underestimate the coupling scenario. When multiple train units are joined, your network topology changes dynamically. Your onboard routing must handle inter-unit connectivity without creating bridging loops or VLAN mismatches. Test this explicitly in your acceptance testing. And don't neglect remote management. Every onboard router needs out-of-band management access — typically via a dedicated management VLAN and VPN — so your NOC can diagnose and remediate issues without sending an engineer to the depot. --- [RAPID-FIRE Q&A — 1 minute] Quick fire. Should I deploy WiFi 6 or stick with WiFi 5? If you're specifying new rolling stock, WiFi 6 — the per-device efficiency gains in crowded carriages are significant. For existing fleets, WiFi 5 upgrades deliver strong ROI. Is Starlink ready for production rail deployments? For rural and cross-border routes, yes. For urban commuter services with frequent tunnel sections, it's a complement to cellular, not a replacement. What's the minimum viable captive portal for GDPR compliance? A clear privacy notice, explicit opt-in consent for marketing, a record of that consent, and a documented data retention policy. Anything less is a regulatory exposure. Should passengers use a VPN on train WiFi? Yes, if they're handling sensitive business data. The network is shared and the operator's security posture is unknown to the passenger. --- [SUMMARY & NEXT STEPS — 1 minute] To wrap up: train WiFi is a multi-layer engineering challenge where backhaul quality is the dominant performance variable, security segmentation is a safety-critical requirement, and the captive portal is an underutilised commercial asset. The operators winning on passenger satisfaction — LNER in the UK, the Swedish national network, SBB in Switzerland — have treated connectivity as core infrastructure, not an afterthought. They've invested in trackside coverage, modern onboard hardware, and compliant data platforms. If you're planning a deployment or an upgrade cycle, start with a backhaul audit, design your VLAN architecture with security as the primary constraint, and choose a guest WiFi platform that handles compliance natively and turns connection data into actionable analytics. Purple's platform is built for exactly this use case — from the captive portal and consent management layer through to the WiFi analytics dashboard that gives your operations team visibility into passenger behaviour across your entire fleet. You can find out more at purple.ai, or explore the transport industry section directly. Thanks for listening. Until next time. --- END OF SCRIPT