[Nexus 5 Q&A, Help & Troubleshooting] danarama:
To elaborate on my scenario. A browser has a user agent string. For example, this may say you ate using Firefox on a desktop computer. Some mobile carriers have a database of all "desktop" user agents and if this is what they detect through packet analysis, will block it. They will also do the same for things that say safari tablet. ...or maybe even they detect you have nexus 5 and only allow that user agent string.

So flipping that in reverse, maybe your carrier only looks for android mobile, or whatever your user agent string is. Check here using a browser...

http://www.whatsmyuseragent.com/

For chrome I get:

Mozilla/5.0 (Linux; Android 4.4.4; Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.71 Safari/537.36

Yet for dolphin in desktop mode I get:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-us) AppleWebKit/537.16 (KHTML, like Gecko) Version/5.0 Safari/537.16

See in the last how it doesn't say android? This user agent string is used by *most* sites to detect you're mobile and therefore give you mobile websites instead. Changing bathe string can give you desktop mode instead. That's what dolphins "desktop" mode does. Note, some sites use a new method I don't understand yet.

Browsers always have a user agent, whether you're osx, iOS, linux , windows, android etc. Most non_browser apps do not have one. That's why torrent clients, Facebook, Tapatalk maybe can work on tether and not browsers. If you receive back message only in a browser yet other apps work, it stands to reason that this is how it could be done. You can test it. Install dolphin and set to desktop mode. Still get the message?

For the VPN question, I'll keep it simple. Whenever you communicate over a network, you are transmitting packets of data. This data has information attached, such as then user agent string. These packets are seem by the network you are travelling through. If you load Google, in simple terms, you send a packet asking to load Google, to Google. Google responds with a packet that will be the web page. The network sees this because it routes the traffic.

With a VPN (virtually private network) you are creating a tunnel between your end point device (n5 in this case) and a server. This tunnel, burrows through your network to then server. Then tunnel is impenetrable. The network cannot see then packets. They're encrypted. It cannot see any user agent string or anything else. It doesnt need to either as your network does not route the traffic inside the tunnel. When you VPN tons server then load Google, the server uses its internet connection to load the page. The server sends a packet to google using its network. You are connected into the same network as the server so your carrier sees nothing.

To try and clarify my VPN rambling... Imagine a laptop for a company you work. You plug a network cable in on site and you connect to their network. You can see intranet and network drives. Pull out cable, gone. Go home, still gone. VPN is a way of creating back network connection into work as if you were on site. With a cable. It creates a secure, encrypted connection between you and your company.

I hope this helps.