A VPN can show “Connected” while webpages still fail to load. That status usually confirms that the client has established a tunnel; it does not prove that DNS, routing, the selected server, or the device’s local network is working correctly. The quickest way to narrow things down is to test one layer at a time instead of repeatedly reconnecting or changing several settings at once.
This guide walks through a practical checklist for Windows, macOS, Android, and iPhone. Start by checking whether the internet works without the VPN, then test a different website or app, inspect DNS and proxy settings, and try another server or protocol if available. Keep track of each change and undo it if it does not help. That makes it easier to identify the cause and restore your usual setup.
Identify where the connection fails
“No internet” can describe several different problems. A browser may fail to resolve a website name while other apps still work. One app may be using a proxy that the VPN client does not support. The tunnel may connect to a server, but the server may not be able to reach the destination. Or the phone or computer may have lost its Wi-Fi or mobile-data connection. These cases need different fixes, so begin with simple comparisons.
Test the local network first
Disconnect the VPN and open a site or app that you know normally works. If it still cannot connect, check whether the device is connected to the expected Wi-Fi network or has mobile data enabled. On Wi-Fi, try loading a page on another device connected to the same network. If that device also has no access, restart the router only if you control it, or contact the network administrator. On a managed work, school, hotel, or public network, restrictions may prevent VPN traffic until you complete the network’s sign-in process.
If the internet works without the VPN, reconnect and test more than one destination. Try a familiar website in a browser and an app that uses a different service. If only one website or app fails, the issue may be specific to that destination, its app settings, or the way the client routes that traffic. If every destination fails only when the VPN is connected, investigate the selected server, DNS, proxy, and routing mode.
Check for a network sign-in page
Public Wi-Fi sometimes requires a browser sign-in or acceptance of terms before it provides internet access. A VPN can make that page difficult to reach because its traffic is already being routed through the tunnel. Disconnect the VPN, open a browser, and complete the network’s normal sign-in process. Then reconnect and test again. Do not enter sensitive account details into a page unless you have confirmed that it belongs to the venue or network operator.
Also check whether another VPN, proxy, firewall, or traffic-filtering app is active. Two apps trying to control the same network connection can create a route conflict. Close or pause the competing tool temporarily, test with only one VPN client active, and restore your preferred protection afterward.
- ✅ Confirm that the internet works with the VPN disconnected
- ✅ Test more than one website or app to rule out a destination-specific issue
- ✅ Complete a public Wi-Fi sign-in before reconnecting
- ✅ Keep only one VPN or proxy client in control while testing
- ❌ Change DNS, protocol, and routing mode all at once
Check DNS, proxy, and routing settings
DNS translates a domain name, such as a website address, into the information needed to connect to it. If DNS queries are blocked, sent to the wrong resolver, or routed differently from other traffic, a VPN may appear connected while websites fail to open. One clue is that an app or page works when opened through a saved connection but not when you enter its domain name. Another is that some services load while many ordinary websites do not.
First, reconnect the VPN and try another browser or app. If only one browser is affected, review its proxy, secure DNS, extension, and privacy settings before changing system-wide settings. If all browsers and apps fail, check the operating system’s network proxy settings and the VPN client’s DNS or routing options. Labels differ by client: settings may be called “DNS,” “system proxy,” “TUN,” “route,” “global,” or “rules.” Do not assume two similarly named options have the same effect across different clients.
A system proxy and a VPN tunnel are not identical. Some clients create a device-wide tunnel, while others configure apps to send traffic through a local proxy. A browser with its own manual proxy setting can bypass that local proxy or point to an unavailable address. Check that no old proxy address remains in the operating system or browser. If you use a compatible third-party client, confirm that its active profile supports the protocol and transport settings in the imported configuration. A profile can load successfully without every connection option being suitable for the current network.
Routing mode matters too. In rule-based mode, some traffic may be sent directly while other traffic uses the VPN. In global mode, the client attempts to route more traffic through the tunnel. If only selected apps or sites fail, compare the routing rules and app-level exclusions. Avoid switching modes as a permanent workaround until you know what the setting changes, particularly on devices used for work or local network access.
On phones, review any system-level private DNS, content filter, firewall, or ad-blocking app that may affect name resolution. On computers, check security software that inspects or blocks network traffic. You can pause a third-party filter briefly for diagnosis if it is safe to do so, but turn it back on after the test. If a setting is managed by your employer, school, or device administrator, do not override it; ask the administrator whether VPN use is supported on that network.
Work through a safe connection test
Use this sequence to isolate the failure while making as few changes as possible. The exact button names vary, but the order works across desktop and mobile clients. If the client offers a diagnostic log, collect it only after removing or masking account details and subscription links. A subscription link is a credential; do not post it publicly or include it in a screenshot.
- Record the starting state. Note whether you are on Wi-Fi, mobile data, or a managed network, and whether the issue affects one app or everything. Check the client’s displayed server, protocol, and routing mode without changing them yet.
- Test without the VPN. Disconnect the tunnel and open a familiar site. If it does not load, resolve the local network issue before changing VPN settings. If it works, reconnect and continue.
- Reconnect once and allow the client to settle. If the client reports a connection error, note the message. If it reports connected but traffic still fails, do not repeatedly toggle the connection; move to the next comparison.
- Try a different server. Select another available server in the same general region first. This helps distinguish a server-specific problem from a device-wide configuration issue. If that does not help, try a different region only if it is appropriate for the service you are accessing.
- Change one connection option. If the client provides multiple supported protocols, try another protocol offered in the same account or profile. Keep other settings unchanged so you can tell whether the protocol made a difference. If the client uses imported configurations, check that the selected protocol and transport are supported by that client.
- Review DNS and proxy settings. Check the client, operating system, and affected browser for conflicting custom settings. Restore a setting to its previous value if the change does not improve access. Avoid copying DNS or proxy values from an untrusted post.
- Restart the client and retest. Disconnect cleanly, quit the client if appropriate, reopen it, and connect again. If a restart is requested after a system extension or network permission change, follow the client’s instructions.
- Undo temporary diagnostic changes. Re-enable any firewall, filter, or privacy feature you paused, restore your usual routing mode, and confirm that ordinary network access still works.
This sequence is intended to identify the layer causing the failure, not to force every app through a particular route. If a change makes the connection worse, revert it rather than stacking additional changes on top. For help importing a configuration or checking a client setup, see the setup guide.
Apply the checks on each device
Windows
On Windows, first confirm that Wi-Fi or Ethernet shows an active connection and that the same network works with the VPN disconnected. Then open the VPN client and check its connection mode, server selection, and any system-proxy option. If a browser still fails, review Windows proxy settings and the browser’s own proxy configuration for an old manual address. A proxy left behind by another client can make the VPN appear connected while the browser sends requests to a service that is no longer running.
Windows may also retain network behavior from another VPN, security product, or virtual adapter. Avoid deleting adapters or resetting network components as an early step: doing so can remove settings needed by other software. Instead, close competing network tools, reconnect with one VPN client, and test a different server. If only one application fails, check whether it has a separate proxy setting or is excluded by the client’s routing rules. If a firewall prompt appears, verify that it refers to the client you installed before allowing access.
macOS
On macOS, check that the client has the permissions it needs to establish its network extension or VPN configuration. The system may show a permission prompt in the client or in network settings; follow the prompt from the installed app rather than approving an unfamiliar component. If the VPN connects but traffic stops, disconnect and reconnect once, then test with a different server. Review any manually configured proxy settings and any other network utility that filters traffic.
iCloud Private Relay and a VPN are separate network features, and their interaction can make it harder to interpret which service is handling a request. For diagnosis, change only one feature at a time and compare the same website with the VPN on and off. If you use a client with split routing, confirm whether the affected app is meant to use the tunnel or the regular connection. Avoid removing system network extensions manually; use the client’s own uninstall or repair process if reinstalling becomes necessary.
Android
Android allows only one active VPN service at a time in many standard configurations. Check the system VPN indicator and disconnect any other VPN app before testing. Also review Android’s Private DNS setting, any always-on VPN option, and any setting that blocks connections outside the VPN. These features can intentionally prevent traffic when the tunnel is unavailable, so a strict setting may look like “no internet” during a connection problem. Change it only for a controlled test, then restore your preferred protection.
If the connection works on Wi-Fi but not mobile data, or the reverse, compare the client’s behavior on each network rather than assuming the configuration is broken. Battery restrictions can also stop a client from maintaining its background connection on some devices. If the tunnel drops when the app is not visible, review the device’s battery or background-app controls for that client. Keep the client updated through a trusted source and avoid importing a configuration into an app that does not support its protocol.
iPhone and iPad
On iPhone or iPad, check that the VPN profile is active and that the operating system has not left another VPN or filtering profile in control. If a content-filtering or security app is installed, test with its settings unchanged first; if you temporarily pause a feature, restore it immediately after the comparison. Reconnect the VPN, try another server, and test more than one app. If only a browser fails, check browser-specific privacy or proxy settings before resetting the device’s network configuration.
When a network configuration or profile appears damaged, use the VPN app’s documented disconnect, remove, or repair workflow. Deleting profiles without understanding their purpose can affect other services, including work or school access. If the VPN profile is managed by an organization, ask its administrator before changing it.
Know when to change server or contact support
A different server is a useful test when local internet works normally but traffic stops after the VPN connects. A different protocol can also help if the current network does not handle the existing connection method reliably. Neither change is a universal fix: a service may restrict certain destinations, a managed network may block VPN traffic, or an app may be using a route that the client does not control. Compare changes one at a time and return to the original settings if the result is unclear.
Before contacting support, gather the information that helps identify the failing layer: device and operating-system version, client name and version, whether the issue occurs on Wi-Fi, mobile data, or both, the selected server and protocol, and the exact error message. Mention whether ordinary internet access works with the VPN disconnected and whether the problem affects all apps or only one. Do not send your password, complete subscription link, private key, or an unredacted configuration file. If logs are requested, remove credentials and personal information before sharing them through an appropriate support channel.