VPN not connecting? A systematic troubleshooting guide
When your VPN misbehaves: a systematic troubleshooting method, speed fixes ranked by impact, and a quarterly privacy audit.
Why connection problems happen (and why you shouldn't panic)
VPN connection failures feel worse than they are. You're locked out of the service you pay for, your traffic is exposed, and the error messages range from cryptic to nonexistent. But most connection problems stem from predictable causes: protocol conflicts, certificate expiration, DNS leaks, or plain old network interference.
This chapter walks through a systematic method—checking one variable at a time—so you waste less time on forum threads and restore your connection faster. We'll cover the common culprits first (they solve 80% of cases), then move to edge cases and platform-specific quirks.
Step 1: Confirm the obvious (5-minute checks)
Before diving into logs and config files, eliminate simple causes:
Check your internet connection without the VPN. Disconnect the VPN client entirely. Open a browser. If you can't reach google.com or your ISP's homepage, the problem isn't the VPN—it's your local network or ISP. Restart your router, check if other devices work, or call your ISP.
Verify your subscription is active. Log into your VPN provider's dashboard. Check if your payment method expired or if you accidentally canceled. If your account shows "inactive" or "suspended," reactivate it. Most providers send renewal reminders, but email filters bury them.
Restart the VPN app. Close it completely (not just minimize), then reopen. On macOS, use Activity Monitor to force-quit if the app hangs. On Windows, end the process in Task Manager. On mobile, swipe away the app and clear it from recent apps. A restart clears corrupted sessions and reloads config files.
Switch servers. If one server fails, try a different location. Servers go offline for maintenance, get overloaded, or face temporary ISP blocks. Most apps let you favorite a fallback server—set one now if you haven't.
Disable antivirus or firewall temporarily. Security software can block VPN connections. Disable it for 60 seconds and retry. If the VPN connects, you've found the culprit—restore the security software, then whitelist the VPN in its settings (usually under "Allowed Applications" or "Exceptions").
If none of these work, move to protocol-level troubleshooting.
Step 2: Switch protocols
Most VPNs default to automatic protocol selection—usually OpenVPN or WireGuard. But "automatic" can fail if the protocol is blocked or misconfigured. Manually override it.
Try WireGuard first. It's faster and more resilient to network changes (switching from Wi-Fi to cellular, for example). In the app settings, look for "Protocol" or "Connection Type" and select WireGuard (sometimes branded—NordVPN calls it NordLynx).
Fall back to OpenVPN over TCP. If WireGuard fails, switch to OpenVPN TCP (not UDP). TCP disguises VPN traffic as regular HTTPS, helping on restrictive networks (corporate Wi-Fi, hotels, some countries). It's slower but more reliable through firewalls. Most apps let you toggle between UDP and TCP under advanced settings.
Test IKEv2 on mobile. iOS and Android natively support IKEv2, which reconnects faster when you move between networks. If the app offers it, try it—especially if you're on cellular or frequently lose connection when switching between towers.
Avoid PPTP and L2TP. These older protocols are insecure and increasingly blocked. If your app still lists them, ignore them—they're relics.
If switching protocols doesn't help, the issue is likely network-layer interference or a corrupted config.
Step 3: Check DNS and kill switch settings
DNS misconfigurations and overly aggressive kill switches cause connection loops—the VPN tries to connect but blocks itself.
Disable the kill switch temporarily. The kill switch blocks all traffic when the VPN disconnects, which is great for privacy but can prevent reconnection if something breaks. Turn it off in settings, reconnect the VPN, then re-enable it once stable.
Flush your DNS cache. Stale DNS records confuse the VPN client. On Windows, open Command Prompt and run `ipconfig /flushdns`. On macOS: `sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder`. On Linux: `sudo systemd-resolve --flush-caches` (or `sudo /etc/init.d/nscd restart` on older systems). On mobile, toggle airplane mode on and off—it's crude but effective.
Use custom DNS servers. If your ISP's DNS is flaky or blocking VPN traffic, switch to a public resolver. Set it in the VPN app (many have a "Custom DNS" field) or system-wide. Options: Cloudflare (1.1.1.1), Quad9 (9.9.9.9), or Google (8.8.8.8). Avoid your ISP's default.
Check for DNS leaks after connecting. Even if the VPN connects, a DNS leak exposes your queries. Visit dnsleaktest.com while connected. If it shows your ISP's DNS instead of your VPN's, the app isn't routing DNS properly. Report it to support—it's a bug.
Step 4: Reinstall or update the app
Corrupted installations break connections silently. A reinstall takes 5 minutes and fixes more problems than you'd expect.
Check for updates first. Outdated apps lose compatibility with server infrastructure. Open the app's settings, click "Check for updates," or visit the provider's website. If an update exists, install it and restart.
Fully uninstall, then reinstall. Don't just delete the app—use the OS's uninstaller (Windows: Settings > Apps > Uninstall; macOS: drag to Trash, then empty Trash and delete ~/Library/Application Support folders for the VPN). Download a fresh copy from the provider's site (not a third-party mirror). Install it, log in, and test.
Clear cached credentials. Some apps store login tokens that expire or corrupt. Look for a "Log out" option in settings, log out, close the app, reopen, and log in again. This forces a fresh authentication handshake.
Step 5: Router and network-level fixes
If the VPN works on mobile data but not Wi-Fi (or vice versa), your router or ISP is blocking it.
Restart your router. Unplug it for 30 seconds, plug it back in, wait for full reboot (all lights stable), then retry the VPN. Routers cache firewall rules that can block VPN traffic after a firmware update or ISP-side change.
Check router firewall settings. Log into your router's admin panel (usually 192.168.1.1 or 192.168.0.1—check the sticker on the device). Look for firewall or security settings. Ensure ports 1194 (OpenVPN), 500/4500 (IKEv2), and 51820 (WireGuard) aren't blocked. If you see "Block VPN traffic" or "Allow VPN passthrough," enable passthrough.
Disable IPv6 temporarily. Some VPNs don't route IPv6 properly, causing connection splits or leaks. Disable IPv6 in your OS: Windows (Network Adapter settings > uncheck IPv6), macOS (System Preferences > Network > Advanced > TCP/IP > Configure IPv6: Link-local only). Test. If it works, either leave IPv6 off or switch to a VPN that supports it properly—Mullvad and IVPN handle IPv6 cleanly.
Try a mobile hotspot. Tether your phone and connect your computer to its Wi-Fi. If the VPN works, your home network or ISP is the blocker. If it still fails, the problem is device-specific.
Step 6: Platform-specific quirks
Windows
Reset network stack. Open Command Prompt as Administrator and run these commands in order: ``` netsh winsock reset netsh int ip reset ipconfig /release ipconfig /renew ipconfig /flushdns ``` Restart the computer. This clears corrupted network drivers and route tables.
Disable Teredo and ISATAP. These IPv6 transition protocols conflict with VPNs. In Command Prompt (Admin): ``` netsh interface teredo set state disabled netsh interface isatap set state disabled ```
Check Windows Firewall. Go to Windows Security > Firewall & network protection > Allow an app through firewall. Ensure your VPN app is checked for both Private and Public networks.
macOS
Grant full disk access. Some VPN apps need deeper permissions. Go to System Preferences > Security & Privacy > Privacy > Full Disk Access. Add the VPN app. Restart the app.
Remove old configuration profiles. Leftover profiles from previous VPNs cause conflicts. Open System Preferences > Profiles. Delete any VPN-related profiles you don't recognize. Restart.
Check system extensions. macOS blocks unsigned extensions. If prompted, allow the VPN's extension in System Preferences > Security & Privacy > General (you'll see a "System software from [developer] was blocked" message—click Allow).
Linux
Check for systemd-resolved conflicts. If using Ubuntu/Debian with systemd-resolved, it can hijack DNS. Edit `/etc/systemd/resolved.conf`, set `DNSStubListener=no`, then restart: `sudo systemctl restart systemd-resolved`.
Verify iptables rules. Some distros have default rules that block VPN ports. Run `sudo iptables -L` to list rules. If you see DROP rules for ports 1194, 500, or 51820, flush them: `sudo iptables -F` (warning: this clears all rules—document existing rules first if on a server).
Use NetworkManager integration. If you're manually importing configs, use NetworkManager plugins (OpenVPN: `network-manager-openvpn-gnome`, WireGuard: `network-manager-wireguard`). They handle routing better than standalone clients.
Mobile (iOS/Android)
Reinstall the profile. iOS VPNs use configuration profiles. Go to Settings > General > VPN & Device Management, delete the VPN profile, then reinstall from the app.
Check battery optimization. Android kills background apps aggressively. Go to Settings > Apps > [VPN app] > Battery > Unrestricted. This prevents the OS from closing the VPN.
Reset network settings. iOS: Settings > General > Reset > Reset Network Settings (this erases saved Wi-Fi passwords—have them handy). Android: Settings > System > Reset options > Reset Wi-Fi, mobile & Bluetooth.
Step 7: Contact support (and what to tell them)
If you've tried everything, contact your provider's support. But don't just say "it doesn't work"—give them data:
- Error message (exact text or screenshot)
- OS and version (Windows 11 22H2, macOS Ventura 13.4, Ubuntu 22.04)
- VPN app version (found in app settings)
- Protocol and server tested ("Tried WireGuard on US-NYC-01 and OpenVPN TCP on UK-London-03")
- Network type ("Home Wi-Fi" or "Cellular" or "University network")
- What you tried ("Flushed DNS, disabled kill switch, reinstalled app")
Persistent failures: When to switch providers
If connection problems happen weekly despite following this guide, consider switching. A good VPN should "just work" 99% of the time. Chronic issues signal poor infrastructure, outdated apps, or inadequate support.
Red flags:
- Support takes >48 hours to respond
- They blame your setup without testing on their end
- No app updates in 6+ months
- Frequent server outages (check their status page or Downdetector)
Key takeaways
- Check the basics first: internet without VPN, account status, app restart, different server. Solves 80% of problems in under 5 minutes.
- Protocol switching is your next move: WireGuard for speed, OpenVPN TCP for restrictive networks. Manual override beats "automatic" when things break.
- DNS and kill switch cause loops: Disable kill switch temporarily, flush DNS, test with custom resolvers (1.1.1.1 or 9.9.9.9).
- Reinstall solves silent corruption: Full uninstall/reinstall fixes more bugs than updates alone. Always download fresh from the official site.
- Router and ISP interference is common: Restart router, check firewall, test on mobile hotspot to isolate the blocker. Disable IPv6 if your VPN doesn't support it.
- Platform quirks matter: Windows network stack resets, macOS permissions, Linux iptables, mobile battery optimization—each OS has unique failure modes. Use the platform-specific steps.