VPN Won't Connect? 9 Fixes That Actually Work

When a VPN won't connect, the cause is almost always one of a handful of ordinary problems: an overloaded server, a protocol your network is quietly blocking, a firewall, or a system clock that's out of sync. Work through the nine fixes below in order and most people are back online within a few minutes.

The first checkpoint that fails is the only one worth fixing

A VPN connection is not one event. Your device has to clear a sequence of checkpoints: a working local network, any hotel or café login page, a lookup of the server's name, packets actually reaching the server, a certificate handshake, an account check, and finally traffic moving inside the tunnel. Each one depends on the one before it. That is why the nine fixes below are ordered the way they are, and why the error message you see matters more than most guides admit — it usually tells you which checkpoint you are stuck at.

Practical rule:Find the first checkpoint that fails and fix only that one. A fix aimed at a later checkpoint cannot repair an earlier one — new login details will never get you past a hotel Wi-Fi login page.

Start here: the 30-second reset

Before you change any settings, rule out the temporary glitches that cause a surprising share of failures. Network stacks, VPN clients, and routers all cache state that can go stale, and a clean restart clears most of it. This is the single highest-value step, so do it first even if it feels too simple to matter.

1. 1Fully quit the VPN app — don't just disconnect. On Windows, close it from the system tray; on macOS, quit it from the menu bar.
2. 2Toggle your internet off and on: disable Wi-Fi for ten seconds, then re-enable it, or unplug your router, wait ten seconds, and plug it back in.
3. 3Reopen the VPN app and try connecting to your default server again.
4. 4If you're on mobile, toggle Airplane Mode on and off to force the network to re-register.

Also confirm the obvious: is your internet working at all without the VPN? Open a website with the VPN off. If nothing loads, the problem is your connection, not the VPN — and no amount of VPN troubleshooting will help until that's fixed.

Fix 1: Switch to a different server

Individual VPN servers go down, get overloaded at peak hours, or fall out of rotation for maintenance. If your usual server is having a bad day, the app will report a connection failure that has nothing to do with your setup. Switching servers is the fastest test because it isolates the problem to one machine.

• Pick a server in a nearby city or the same country first — closer servers are lower-latency and more likely to connect cleanly.
• If a specific country keeps failing, try a second location in that country before assuming the whole region is blocked.
• Avoid servers flagged as "busy" or showing a high load percentage if your app displays one.
• Use the app's "Quickest" or "Optimal location" option, which routes you to the least-loaded server automatically.

If a fresh server connects instantly, you've found and solved the problem — the original server was the issue. It's also worth checking your provider's status page or social feed for a reported outage before you dig any deeper.

Fix 2: Change the VPN protocol

The protocol is the language your device and the VPN server use to talk. Networks — especially on university, office, and hotel Wi-Fi — sometimes block one protocol while allowing others. If your app is stuck on a protocol the network doesn't like, it will silently fail to handshake no matter which server you pick.

Head into your app's settings and look for a Protocol or Connection option. The usual choices, and when to reach for each:

• Automatic — let the app choose. Try this first; it often solves the problem on its own.
• WireGuard (NordVPN's NordLynx is built on it; ExpressVPN's Lightway is a separate protocol of its own that fills the same role) — modern, fast, and the best default in 2026.
• OpenVPN (UDP) — reliable and quick; a solid fallback when WireGuard is blocked.
• OpenVPN (TCP) — slower but stubborn; it retransmits lost packets and slips through more restrictive networks.
• IKEv2/IPsec — excellent on mobile because it reconnects smoothly when you switch between Wi-Fi and cellular.

Change one protocol at a time and retry the connection after each. If every protocol fails on one network but the VPN works elsewhere, the network itself is doing the blocking — which the next two fixes address.

Fix 3: Move to port 443 or turn on obfuscation

Firewalls block VPN traffic by watching the ports it uses. VPNs typically ride on UDP 1194 (OpenVPN), UDP 500 and 4500 (IKEv2), or a WireGuard port — all of which a restrictive network can shut down. The trick is to route your VPN through a port that can't be blocked without breaking the whole internet.

That port is TCP 443 — the same one every HTTPS website uses. When your VPN runs OpenVPN over TCP 443, its traffic looks like ordinary encrypted web browsing, so a firewall can't single it out. Two ways to get there:

1. 1In your app's protocol settings, choose OpenVPN (TCP) — many clients default it to port 443 automatically, which is the fastest win on a locked-down network.
2. 2Enable your provider's obfuscation, stealth, or camouflage mode. This wraps VPN traffic to disguise it further, defeating deep-packet inspection on networks that block VPNs by signature rather than by port.

Obfuscation is the heavier tool — it's what gets a VPN working on networks that actively hunt for and block VPN traffic. If a plain protocol switch didn't help, this usually does. This is also the setting that most often gets a VPN working from restrictive regions, so it's worth choosing a provider that includes it — something our VPN privacy guide weighs heavily when ranking apps.

Fix 4: Whitelist the VPN in your firewall and antivirus

Security software is a leading cause of silent VPN failures. Firewalls and antivirus suites inspect outbound connections, and an overzealous rule can quietly drop your VPN's traffic before it ever reaches the server. Because the block happens locally, the app just reports a generic timeout with no obvious cause.

• Temporarily disable your third-party firewall or antivirus, then try to connect. If it works, you've found the culprit — re-enable the software immediately and add an exception instead of leaving it off.
• Add your VPN app (and its background service or helper, if it has one) to the allowed-apps list in both your firewall and antivirus.
• On Windows, check Windows Defender Firewall's allowed apps list under Settings, and make sure both private and public network boxes are ticked for your VPN.
• Watch for overlap: two VPNs, or a VPN plus a separate proxy or security tool, can fight over the network adapter and block each other.

Never leave your firewall or antivirus switched off as a permanent fix — that trades a minor annoyance for a real security hole. Whitelisting gives you the connection back while keeping your protection intact.

Fix 5: Correct your system clock

This is the fix nobody expects and it's genuinely common. VPNs use TLS certificates to prove the server is legitimate, and certificate validity is time-based. If your device's clock is wrong — even by a few minutes in some cases, or by hours after a dead battery or timezone glitch — your device may decide the server's certificate is expired or not yet valid, and refuse to connect.

The rule behind this is written down in RFC 5280, the standard for internet certificates. It defines every certificate's validity as a window between two dates, notBefore and notAfter, and has the client compare that window against the time at which it is checking — a time the client takes from its own clock. A laptop whose clock has drifted back a year will reject a certificate issued last month as not yet valid, even though the server did nothing wrong.

• On Windows: Settings → Time & language → Date & time → turn on "Set time automatically" and click "Sync now."
• On macOS: System Settings → General → Date & Time → enable "Set time and date automatically."
• On iPhone and Android: Settings → General/System → Date & Time → enable automatic/network-provided time.
• Double-check the timezone too — a correct clock in the wrong zone can still throw certificate errors.

After syncing to network time, close and reopen the VPN app so it starts a fresh handshake. If a certificate or TLS error was in your logs, this fix often clears it instantly.

Fix 6: Flush your DNS and reset the network stack

Your operating system caches DNS records and network configuration to speed things up, but a stale or corrupted cache can leave the VPN pointing at the wrong address or unable to resolve its server hostname. Flushing the cache and resetting the network stack clears that state without touching your VPN settings.

On Windows

Open Command Prompt as Administrator and run these commands one at a time, then restart your PC:

• ipconfig /flushdns — clears the DNS resolver cache
• netsh winsock reset — resets the network socket catalog
• netsh int ip reset — resets the TCP/IP stack

On macOS

Open Terminal and run: sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder. Enter your password when prompted, then relaunch the VPN. This clears the macOS DNS cache, which resolves a class of "connected but no internet" and hostname-resolution failures.

If your internet works but sites won't load only while the VPN is on, this is frequently the fix. It's also worth confirming the VPN isn't leaking DNS afterward, so your real location stays hidden — our VPN privacy guide walks through how to verify everything's routing correctly.

Fix 7: Update the app, then reinstall if needed

Outdated VPN clients cause more connection failures than almost any other single factor. Providers push frequent updates to keep pace with protocol changes and network blocks, and a client that's a few versions behind can simply stop handshaking. Start with an update; escalate to a clean reinstall only if that fails.

1. 1Update the app from your provider's site or your device's app store, then retry.
2. 2If it still won't connect, fully uninstall the VPN — on Windows, remove it via Settings → Apps, and let it delete its network driver (the TAP or WireGuard adapter) when prompted.
3. 3Restart your device to clear any leftover network adapter state.
4. 4Download the latest installer fresh from the provider and, on Windows, right-click and "Run as administrator" so it can install its driver cleanly.
5. 5Sign in and connect.

A clean reinstall rebuilds the VPN's virtual network adapter from scratch. When you're seeing adapter errors — "no TAP adapters available" or a driver warning — this is the definitive fix, because those errors mean the adapter itself is broken or in use by another app.

Fix 8: Try a different network

If you've worked through everything above and the VPN still won't connect, the fastest way to locate the problem is to change networks entirely. Some networks — corporate, campus, guest, and certain public Wi-Fi — block VPNs at the router level, and nothing you do on your device will override that.

• Switch from home or office Wi-Fi to your phone's mobile hotspot and try connecting.
• If the VPN connects instantly on the hotspot, your original network is the block — go back to Fix 3 (port 443 and obfuscation) to try to bypass it.
• If it fails on both networks, the problem is your device or account, not the network — revisit the reinstall and clock fixes.
• On networks you control, log into the router and check for VPN passthrough settings, which must be enabled for some protocols.

This test cleanly separates "the network is blocking me" from "my setup is broken," which tells you exactly where to spend your remaining effort. Running the VPN on your router is one way to sidestep flaky per-device networks entirely — see our guide to VPN routers.

Fix 9: Check your account, then contact support

If the app opens, servers are up, and your network isn't blocking anything, the issue may be your account or a bug on the provider's end. These are quick to rule out and worth checking before you spend more time on settings you've already verified.

• Confirm your subscription is active and hasn't lapsed or hit a payment failure.
• Make sure you haven't exceeded the simultaneous-device limit — the newest device to connect can knock an older one offline.
• Sign out and back in to refresh your authentication token.
• Check the provider's status page and support channels for a known outage.

Good providers offer 24/7 live chat, and their agents can see server-side logs you can't. Before you reach out, note your protocol, the server you tried, your operating system, and any error message — it turns a long back-and-forth into a two-minute fix. Choosing a provider with strong support is one reason our streaming VPN guide and overall rankings weight reliability so heavily.

Windows numbers its VPN errors, and each number points at one layer

If you connect through Windows' built-in VPN client — the one you use when you add a VPN connection by hand rather than through a provider's app — a failed attempt comes with a number. Those numbers are not arbitrary. Microsoft defines each one in its Routing and Remote Access error list (the raserror.h header), and the definition names the layer that failed. Read the number before you change a single setting: it tells you which of the fixes above is worth your time.

Descriptions are shortened from Microsoft's Routing and Remote Access error list, verified September 2026. The layer column is our reading of what each description points at, and the first-fix column maps it to the fixes earlier in this guide.

Provider apps use words, not numbers

Provider apps generally don't show these numbers, because they don't run through Windows' built-in client. They show plain wording instead, and that wording is documented in their own support libraries. Proton VPN's help pages describe an AUTH FAILED message on manual OpenVPN connections and give two causes: entering your Proton account password instead of the separate OpenVPN credentials, or going over the number of simultaneous sessions your plan allows (one on the free plan, up to ten on Plus). Its macOS guide covers a No connection to the internet message at sign-in, with a Troubleshoot button that walks through network blocks, Wi-Fi faults, antivirus software and system-wide proxies.

What neither NordVPN nor Proton VPN publishes — the two support libraries we read for this section — is a numbered dictionary of app error codes. NordVPN's Windows guide describes symptoms instead, such as the app sitting on its Connecting status. So if you come across a list of numbered error codes for a VPN app, check that the vendor's own help centre uses the same numbers before you act on it.

Hotel and train Wi-Fi fail before the VPN even gets a chance

Wi-Fi in hotels, trains, airports and cafés usually sits behind a captive portal: a login or terms page you have to click through before the network lets any other traffic out. There is a standard for it. RFC 8910 lets a network announce its portal through DHCP — option 114 for IPv4, which replaced the code 160 used by the earlier RFC 7710, and option 103 for IPv6 — and through router advertisements. Until you complete that page, the network drops everything else, including your VPN's handshake. From inside the VPN app, that looks exactly like a server failure, on every server you try.

The trap is that two good security features make it worse. NordVPN's support library spells out both: with auto-connect on, the app connects the moment you join the Wi-Fi and stops the portal from loading; and the kill switch blocks all non-VPN traffic, which is precisely the traffic a portal needs. The way through is a short sequence:

1. 1Turn off auto-connect and, for now, the kill switch.
2. 2Join the Wi-Fi with the VPN fully disconnected.
3. 3If the login page doesn't appear by itself, open a plain http:// address in your browser — NordVPN suggests http://example.com. An https:// address won't trigger the redirect.
4. 4Complete the login and confirm ordinary pages load.
5. 5Reconnect the VPN, then switch the kill switch and auto-connect back on.

Once you're through, run our kill switch test so you know protection is back on before you do anything sensitive on that network. Travelling often? Our travel VPN guide covers what else changes on the road.

Each platform breaks in its own place

The nine fixes apply everywhere, but each operating system has one or two failure modes of its own. The table below is limited to problems a provider or platform vendor documents on its own support pages, and each row names its source. Where we could not find a vendor-documented failure for a platform, it is left out rather than filled with a guess.

Note what Proton VPN says about the Android 13 case: the phone can report a connection that has already dropped. If you rely on the VPN on the move, check it with our VPN check after switching networks rather than trusting the status icon, and see our full testing guide for the leak checks.

Port 443 works for a reason you can look up

Fix 3 tells you to move to TCP 443. The logic is easiest to see in the port registry itself. IANA, the body that assigns port numbers, lists OpenVPN on 1194, IKE key exchange on UDP 500 and IPsec NAT traversal on 4500. A restrictive network can block any of those without affecting ordinary browsing. It cannot block TCP 443 without breaking every HTTPS website its users visit.

Ports and protocols verified against the IANA Service Name and Transport Protocol Port Number Registry and the WireGuard protocol documentation, September 2026. If 443 alone doesn't get you through, the next step is obfuscated servers, and our protocol guide explains the trade-offs between the three.

Still stuck? A quick diagnostic order

If you've landed here mid-troubleshoot, run through the fixes in this priority order — it's roughly how a support technician would work, moving from the fastest, most common causes to the rarest. Each step narrows down where the problem lives.

1. 1Restart the app, internet, and device (the 30-second reset).
2. 2Switch to a different server.
3. 3Change the protocol — try Automatic, then WireGuard, then OpenVPN TCP.
4. 4Move to port 443 and enable obfuscation on restrictive networks.
5. 5Whitelist the VPN in your firewall and antivirus.
6. 6Correct your system clock and timezone.
7. 7Flush DNS and reset the network stack.
8. 8Update or cleanly reinstall the app.
9. 9Test on a different network, then check your account and contact support.

Nine times out of ten the fix is in the first four steps. And if the whole reason you use a VPN is to keep watching your shows while you travel, our best streaming VPN guide and the best VPNs for Netflix pick up where this one leaves off.

Every source behind this guide was re-read in September 2026

• Microsoft — Routing and Remote Access Error Codes
• RFC 8910 — Captive-Portal Identification in DHCP and Router Advertisements
• RFC 5280 — certificate validity (§4.1.2.5) and path validation (§6.1)
• RFC 3948 — UDP Encapsulation of IPsec ESP Packets
• IANA — Service Name and Transport Protocol Port Number Registry
• WireGuard — protocol and quick-start documentation
• NordVPN support — logging in to a captive portal Wi-Fi network and connection problems on Windows
• Proton VPN support — OpenVPN authentication failure, Android 13 connection issues and common macOS issues