A VPN that suddenly stops connecting can make it tempting to delete the app, reinstall it, or change several settings at once. That often makes the cause harder to find. Start with the basics: confirm that the device has internet access without the VPN, check the account and subscription, and then test the connection one change at a time. A failed connection can come from the local network, the VPN app, a server, or a device permission—not necessarily from the same cause each time.
Bottom line: Work from the outside in: verify the internet connection, account status, and app permissions before changing protocols or reinstalling. After each change, reconnect and test the same website or app so you can tell whether that step helped.
7
checks in this guide
4
platforms covered
3
connection layers to check
Start with the network and account
Before adjusting VPN settings, establish whether the device can reach the internet at all. Temporarily disconnect the VPN and open a familiar site or app. If that also fails, the VPN is unlikely to be the first problem to fix. Check whether Wi-Fi or mobile data is enabled, whether the device has joined the intended network, and whether a router or mobile connection is showing a sign-in page.
Check internet access without the VPN
Try another site and, if possible, another app. A single website may be unavailable or having a temporary issue, so it is not a dependable test on its own. If nothing loads, reconnect to Wi-Fi, switch briefly to mobile data where available, or restart the router if you control it. Do not change VPN protocols until the underlying connection works. If you are on hotel, airport, campus, or café Wi-Fi, open a browser and complete any network sign-in or terms screen first. Some networks block VPN connections until their access page has been accepted.
If internet access works on one network but the VPN fails only on another, note that difference. A workplace, school, or public hotspot may restrict particular connection types or require a sign-in step. That does not prove the VPN account is faulty. Test on a network you are allowed to use, and follow the network operator’s rules.
Verify the account and subscription
Open the service’s account or subscription page and confirm that you are signed in with the intended account and that the plan is active. A client can remain installed and show saved settings even when the account session has expired or the subscription needs attention. If the service requires you to sign in again, do so in the official app or account page rather than entering credentials into an unfamiliar prompt.
Also check whether you recently changed your password, signed out, or moved to another device. Any of these can require a fresh login or subscription refresh. If account information looks correct but the client reports an authorization error, record the exact wording and the time it appeared. Repeatedly entering different passwords or deleting the app will not resolve an account-side status issue.
- ✅ Confirm that ordinary internet access works with the VPN disconnected.
- ✅ Complete a public Wi-Fi sign-in page before trying to connect.
- ✅ Check the account shown in the client and verify the subscription status.
- ❌ Do not assume that an installed app proves the account is currently authorized.
Check the server and connection settings
Once the internet and account are confirmed, test a different server or location offered in the client. The selected server may be temporarily unavailable, under maintenance, or unreachable from the network you are using. Disconnect first, choose another available option, and connect again. If the app provides a server status or error detail, use it as a clue, not as proof that every other server will behave the same way.
Change one setting at a time. If you switch servers, keep the protocol and other options unchanged for that test. If you change several things together, a successful connection will not tell you which change mattered, and a failure will be harder to diagnose. After connecting, check both the client’s connection status and whether a few ordinary websites or services load. A status label alone does not confirm that all traffic is reaching its intended destination.
Try an available protocol
VPN protocols are different methods for establishing and carrying a tunnel. Some networks handle one method more reliably than another, so a connection failure may improve when you select a different protocol that the client actually offers. Open the connection settings and note the current selection before changing it. If there is an automatic option, you can test that as well. The names and choices vary by provider, platform, and app version; do not assume that a particular protocol must appear on every device.
After changing the protocol, reconnect and wait for the app to finish its attempt. If the result is unchanged, restore the earlier setting before trying another option. Avoid copying configuration values from an unrelated guide: a port, hostname, or protocol parameter must match the service’s own instructions. If the client does not expose protocol settings, do not try to force them through operating-system network menus.
Consider local network restrictions
Some routers, managed networks, or security products can interfere with VPN traffic. If you have permission, test the client on a different trusted connection, such as your own mobile data or home network. If it connects there but not on the original network, the difference points toward a network restriction or configuration issue. On a work or school network, ask the administrator rather than trying to bypass controls. On a home router, review recent changes to firewall or parental-control settings and revert only changes you understand.
A network that allows browsing may still restrict a VPN connection. Conversely, a VPN can connect while a particular service remains inaccessible for reasons unrelated to the tunnel. For general information about selecting a service and its available connections, see Best VPN for China. Keep the diagnosis tied to the actual symptom: failure to connect, loss of internet after connecting, and one blocked website are different problems.
Review device permissions on each platform
Desktop and mobile operating systems ask for permission before an app can create or manage a VPN connection. If a prompt was dismissed, denied, or interrupted by an operating-system update, the client may open normally but fail when it tries to connect. Reopen the official client, start a connection, and carefully read any system prompt. Approve only a request that clearly belongs to the VPN app you intended to use.
Windows and macOS
On Windows, check whether the VPN client is allowed through the firewall or security software you use. If a security alert appeared when the app was installed or updated, review the alert and confirm that it refers to the legitimate client. Also check whether another VPN or proxy application is active. Two tools that both change routing or proxy settings can conflict, so close the other tool before testing again. If the VPN connects but no pages load, disconnect and test normal internet access, then review any kill-switch or traffic-blocking option in the VPN app. Such a feature may intentionally prevent traffic from leaving outside the tunnel.
On macOS, look for a system prompt asking to add or approve a VPN configuration. The wording varies across system versions. If you previously denied the request, open the client’s settings and initiate a new connection so the operating system can present the relevant approval again. Review system VPN configurations for an old or duplicate entry only if you can identify it. Do not remove profiles belonging to work, school, or another service without understanding their purpose.
Android and iPhone
On Android, approve the operating system’s VPN connection request when it appears. If the connection drops when the screen locks or the app is in the background, review battery or background-activity restrictions for the client. Device manufacturers organize these controls differently, so use the settings search rather than relying on a menu path from another model. Check whether Android’s always-on VPN or “block connections without VPN” setting is enabled; these options can block normal traffic when the tunnel is disconnected or cannot start.
On iPhone, accept the system request to add a VPN configuration and check that the VPN status is not being controlled by a work or school management profile. If the app asks for local network or notification access, those permissions are not substitutes for approval of the VPN configuration itself. If you use another VPN app, disable its connection before testing the intended client. When a profile appears unfamiliar or is managed by an organization, ask the administrator before removing or changing it.
Across all four platforms, keep the app current through its official distribution channel and restart the device if a permission prompt or network service appears stuck. Restarting is a useful way to clear a temporary state; it is not a reason to erase accounts or remove system profiles at random.
When the VPN connects but the internet does not
A client may report that the tunnel is connected while websites still fail to load. First disconnect and confirm that ordinary internet works again. If it does, reconnect to a different available server and test several sites. If only one service fails, try another browser or app and check whether the service itself is having an issue. If all traffic fails only while the VPN is active, focus on the client’s routing, DNS, or traffic-blocking settings rather than repeatedly changing the account password.
DNS is the system that translates a website name into a network address. A DNS problem can make a connection look broken even if the VPN tunnel has been established. If the client offers a documented DNS setting or a restore-defaults option, note the existing choice and test only the supported options. Avoid entering a random DNS address from a forum, especially on a managed device or network. If you use a custom proxy, firewall, private DNS feature, or filtering app, temporarily disable it only when permitted and only long enough to compare the result.
Also check whether a kill switch is enabled. A kill switch is designed to block internet traffic if the VPN disconnects, which can protect against unencrypted traffic but may leave the device offline while the tunnel is unavailable. Use the client’s own instructions to test this setting. Do not leave protection disabled if you rely on it; restore your preferred configuration after troubleshooting.
If the usual fixes do not work
Collect a concise record before contacting support. Include the device and operating-system version, the VPN app version if it is visible, the exact error message, whether the internet works with the VPN disconnected, and which network and server options you tested. Note whether the problem began after an app update, operating-system update, password change, or network change. A clear sequence helps distinguish an account problem from an app, device, or network issue.
Do not send passwords, full payment details, or private browsing content in a support request. If the app provides diagnostic logs, check whether they contain personal information and follow the provider’s instructions for sharing them. Use the official support channel. If the client offers a repair, reset, or re-import option, read what it removes before proceeding: some actions may clear saved servers or local preferences.
Reinstalling should come after simpler checks, not before them. If you choose to reinstall, first confirm that you can sign back in and that you know how to restore any settings you need. Remove only the intended VPN app, obtain it from its official source, and approve the operating system’s VPN request during setup. If the same issue returns after a clean setup on more than one permitted network, share your test notes with support instead of making repeated changes without a clear reason.
A practical order to remember: verify internet, verify the account, try another server, test an available protocol, review device permissions, then inspect routing or DNS settings. Keep each test controlled, restore settings that did not help, and use the exact error message to guide the next step.