If your VPN works over mobile data but fails on Wi-Fi, the difference is useful: the client and account may be working, while something about the Wi-Fi network, router, or device settings is interfering with the connection. Start with simple checks before changing advanced options. Confirm that the Wi-Fi itself has internet access, then test the VPN on another network and make one change at a time. This makes it easier to identify the cause without losing track of settings that were already working.
The steps below cover common causes on Windows, Android, and iPhone. Menu names vary by operating system version and VPN client, but the diagnostic logic is consistent: check the underlying connection, remove conflicts, test a different server, and only then consider changing protocols or asking the network administrator for help.
Confirm what is actually failing
Before changing the router or reinstalling an app, separate a general internet problem from a VPN-specific problem. Disconnect the VPN and open a few familiar websites or apps. If they do not load, reconnecting the VPN is unlikely to solve the underlying Wi-Fi issue. Check whether the device has joined the intended network, whether the router shows an internet connection, and whether a sign-in page is required.
Some public and workplace Wi-Fi networks require a captive-portal sign-in before they allow normal internet access. Disconnect the VPN temporarily, open a browser, and visit a regular website. If a network sign-in page appears, complete it first, then reconnect the VPN. On a phone, the sign-in notification may be easy to miss; check the browser and Wi-Fi settings rather than assuming the network is ready because it shows as connected.
Next, compare the same device on Wi-Fi and mobile data. If the VPN connects on mobile data but not on one particular Wi-Fi network, note that distinction. If it fails on every Wi-Fi network but works on mobile data, the issue may instead be a device setting, a local firewall, or another network utility. If several devices fail on the same router, investigate the router or the network policy before changing each device individually.
5
diagnostic fixes
3
platforms covered
1
change at a time
Write down what happens, not just that the VPN “does not work.” A connection timeout, an immediate disconnect, a client that remains on “Connecting,” and a connected status with no usable traffic can point to different layers. Record the device operating system, client version, Wi-Fi network type, selected server, and exact error wording. Do not include a subscription link, password, or other access credential in notes shared with anyone.
Fix 1: Check the router and Wi-Fi network
Routers can apply access controls, parental controls, firewall rules, or DNS filtering that affect VPN traffic. Managed networks may block some connection methods by policy. A VPN can also be affected by guest-network isolation or an unusual router configuration, even when regular web browsing appears normal. If you administer the router, check its settings for recently enabled filtering or restrictions. If the network belongs to a hotel, school, employer, or other organization, ask its administrator whether VPN connections are permitted rather than trying to bypass its controls.
Restarting network equipment can clear a temporary router or access-point problem. If you control the network, restart the router using its normal interface or power procedure, wait for its internet connection to return, and then test the VPN again. Avoid pressing a factory-reset button as a troubleshooting shortcut: a reset can erase the network name, password, and provider-specific configuration without addressing the cause.
Try another Wi-Fi network if one is available and appropriate to use. This comparison is particularly useful when you suspect router filtering: if the VPN connects on a different Wi-Fi network, the original network is a stronger suspect. If it fails in the same way on multiple networks, focus on the device and client. When checking another network, do not connect to an unknown open hotspot for sensitive activity.
Review Wi-Fi-specific controls
On Windows, temporarily disconnect from the Wi-Fi and reconnect, then check whether Windows reports internet access. If the computer is managed by an organization, security software or policy may control network connections; do not disable company protections without approval. On Android and iPhone, forget-and-rejoin can help when the saved network profile is stale, but first make sure you know the Wi-Fi password and have permission to rejoin.
Some routers offer separate guest and main networks, or different bands under one network name. If you can safely test another band or the main network, do so without changing several router options at once. A result that changes between network segments suggests a local network configuration difference, not necessarily a problem with the VPN account. Restore any temporary setting after the test.
DNS settings are another possible source of confusing symptoms. A device may appear connected while names fail to resolve, or filtering software may direct requests differently on Wi-Fi than on mobile data. First test whether the issue affects all websites or only some names. If you have manually configured DNS on the device or router, note the current values before changing them, and restore the original configuration if the test makes no difference.
Fix 2: Remove device and client conflicts
Only one VPN app or system tunnel should normally control a device’s VPN route at a time. Quit or disconnect other VPN clients, proxy tools, traffic filters, and security apps that install local network extensions. On Windows, check the system tray and the VPN section of network settings. On Android, review VPN settings for an always-on connection or a second app. On iPhone, inspect VPN and device-management settings for profiles that you recognize. Do not remove a work or school profile unless its administrator tells you to.
Also check whether a firewall, endpoint security product, or “safe browsing” feature has recently changed. Such tools can block a client’s network process or alter DNS behavior. If the device is managed, request help from the administrator instead of turning protections off. On a personal device, use the security product’s documented controls and make only a temporary, limited test if its guidance permits it. Re-enable protection immediately afterward.
Restart the VPN client and the device after checking for conflicts. Confirm that the app is up to date using its official distribution channel, and make sure the configuration or subscription has refreshed successfully if the client uses one. A stale configuration can leave a client attempting a server or connection method that is no longer available. Refreshing configuration is different from deleting it: keep a safe recovery route and never share the configuration link publicly.
- ✅ Disconnect other VPN or proxy apps before testing
- ✅ Check for a captive-portal sign-in on the Wi-Fi
- ✅ Record the exact error and which network was in use
- ✅ Change one setting, test, and restore it if there is no improvement
- ❌ Delete a managed VPN profile without permission
- ❌ Share a subscription link or account credential when requesting help
If you are choosing a service or checking which platforms its client supports, the VPNLP home page provides a starting point. For the connection problem itself, continue with the server and protocol tests below; those tests help determine whether the failure follows one route or affects the whole client.
Fix 3: Try another server and check the connection mode
A server can be temporarily unavailable, busy, or unreachable from a particular network. Select another server in the same general region first, if the client offers one, and wait for the connection attempt to finish before switching again. Then try a different region if appropriate for your task. Avoid rapidly cycling through many servers: repeated attempts make it harder to tell whether the result changed because of the server, the network, or a temporary service condition.
Check the client’s mode as well. Rule-based mode, global mode, and direct mode can route traffic differently. In a direct mode, the VPN may show a connection state while the traffic you are testing does not use the tunnel. In rule-based mode, some apps or destinations may be excluded. For diagnosis, use the client’s documented full-tunnel or global option temporarily if available, then restore your preferred mode after the test. Do not assume that the connected indicator alone proves that every application is using the VPN.
After connecting, test more than one kind of traffic: open a website, try a different app, and use the client’s built-in connection or route diagnostic if it provides one. If only one app fails, check that app’s proxy, private DNS, or network permissions before changing the VPN server again. If all traffic fails despite a connected status, disconnect cleanly, restart the client, and repeat a single controlled test.
A useful conclusion is whether the failure follows the server or follows the Wi-Fi. If another server works on the same Wi-Fi, the first server or route may be the issue. If no server works on that Wi-Fi but the same client works on mobile data, network filtering or router behavior becomes more likely. Keep those observations for support; they are more actionable than a general report that the VPN is broken.
Fix 4: Switch protocols only after basic checks
VPN protocols describe how the client establishes and carries the encrypted connection. A Wi-Fi network may allow one connection method while restricting another, so changing protocol can be a useful diagnostic step. Common options vary by provider and client and can include WireGuard, OpenVPN, IKEv2, Shadowsocks, VMess, Trojan, or Hysteria2. These are not interchangeable labels: the server and client must support the selected protocol and its required settings.
Open the client’s documented connection settings and note the current protocol before changing it. Choose a different supported option, reconnect, and test the same server and the same destination. Changing the protocol and server simultaneously can produce a successful connection without revealing which change mattered. If the alternative protocol fails, restore the original setting rather than leaving an unknown configuration in place.
Some clients select a protocol automatically. If the app provides an automatic mode, use its documented behavior first; manual options may expose parameters intended for advanced users. Do not copy port numbers or transport values from an unrelated guide, because the correct combination depends on the service and server configuration. If a network administrator confirms that certain connection types are blocked, follow the network’s rules and use an approved connection instead of attempting to evade them.
On mobile devices, confirm that the operating system has granted the VPN permission requested by the client. Android may display a system dialog when the tunnel starts; iPhone may require approval to add or enable a VPN configuration. If permission is denied or an existing profile conflicts, the app may fail before it can establish a route. Review system VPN settings and the client’s official setup instructions, then retry without removing profiles you do not recognize.
Fix 5: Apply the platform-specific final checks
Windows
Check that Windows has not switched to a different Wi-Fi adapter or saved network while the VPN client was starting. Reconnect to the intended network and verify that ordinary browsing works before opening the client. If the client reports a permission or driver error, restart Windows and the app, then check for updates from the provider. Avoid manually deleting virtual adapters or editing the registry based on generic instructions; those actions can damage network connectivity and make diagnosis harder.
If the VPN connects but applications cannot reach the internet, disconnect it and confirm that normal Wi-Fi browsing returns. Then connect again and test the client’s route or DNS diagnostics, if available. A managed firewall, endpoint security tool, or another network adapter can affect the result, so record the exact status message and consult the device administrator when applicable.
Android
Review Android’s VPN settings for an always-on VPN, a blocked connection without VPN, or another active VPN app. These controls can prevent ordinary traffic when the selected tunnel cannot connect. If you change an always-on setting for diagnosis, note its original state and restore it after the test. Also check whether battery or background restrictions are stopping the client during connection attempts; use the client’s documented recommendations for your Android version rather than granting unrelated permissions.
On a phone that changes between Wi-Fi and mobile data, test while the device is clearly connected to the intended Wi-Fi network. A brief transition between networks can make the client’s status misleading. Disconnect, wait until Wi-Fi is stable, and start a fresh connection. If the problem occurs only on a particular saved network, forget and rejoin it only when you can safely recover the password and network access.
iPhone
Check that the VPN profile shown in iPhone settings belongs to the client you are using and that no other VPN or management profile is taking control. If iOS prompts you to add a VPN configuration, review the prompt and approve it only for an app and service you trust. Restart the app and iPhone if the permission appears correct but the connection still stalls. For a managed phone, ask the administrator before changing profiles or security settings.
Private Relay, content filters, and other privacy or network features can affect how traffic is handled, but they are not themselves substitutes for a VPN. If you suspect an interaction, test one feature at a time using its official settings and restore it after the comparison. Do not disable multiple protections at once: the result would be difficult to interpret and could expose traffic unnecessarily.
When to contact support
Contact the VPN provider if the client fails across multiple permitted networks, if every supported server produces the same error, or if the app reports an account, configuration, certificate, or protocol problem. Contact the router or network administrator if ordinary internet works but VPN connections fail only on that network, especially when the network is managed. These are different support paths: the provider can investigate the client and service configuration, while the network administrator can explain local access rules.
Include the device model or platform, operating-system version, client version, exact error text, approximate time of the attempt, selected server or region, selected protocol, and whether the same client works on mobile data or another Wi-Fi network. Describe the steps already tried and the outcome of each one. If the client offers a diagnostic log, follow the provider’s instructions for exporting it and review it for personal data before sending.
Never send a password, one-time code, full subscription URL, private key, or unredacted configuration file in a public post or ordinary support screenshot. A support agent generally needs the error and relevant connection details, not the secret that grants access. If you accidentally exposed a credential, use the provider’s official account tools or support channel to replace or revoke it.
Once the VPN connects, verify that it remains usable after briefly changing networks or restarting the client, then restore any temporary troubleshooting settings. Keep the final configuration simple: one active VPN client, a supported protocol, a working server, and only the network permissions required by the app. If the issue returns, the notes from these controlled tests will help narrow it down without repeating every step.