A VPN client can display “Connected” while websites, apps, or even basic internet checks fail. That status usually confirms that the client has established a tunnel or proxy connection; it does not prove that your device is routing every request correctly or that DNS, the selected server, and the destination are all reachable. Work through the checks below in order, changing one thing at a time. That makes it easier to identify whether the problem is your local network, a device setting, a client configuration, or a particular route.
Identify what is not working before changing settings
Start with a simple comparison. Disconnect the VPN and try to open a familiar website or use an app that normally works. If the internet still fails with the VPN off, the VPN is unlikely to be the only cause. Check whether Wi-Fi or mobile data is connected, whether the router has internet access, and whether other devices on the same network can browse. If those checks also fail, restore the local connection first; changing VPN protocols will not repair an offline router or a mobile data outage.
If internet access works without the VPN but stops immediately after connecting, note what fails. Try a browser and a separate app, and, if practical, test a second website. A single website may be unavailable, require a particular region, or reject a connection for reasons unrelated to the VPN. If only one app fails, its own proxy option, DNS-over-HTTPS setting, firewall permission, or network policy may be involved. If every app fails, focus first on the client’s routing mode, system proxy, DNS, and the selected server.
Also check whether the failure affects all traffic or only some destinations. In a rule-based configuration, some websites may go through the proxy while others connect directly. A rule that sends a domain to the wrong route can make the client appear partly connected. For a quick comparison, temporarily use the client’s global proxy mode if it offers one, test the same destination, and then restore your preferred mode. Treat this as a diagnostic test, not necessarily as a permanent setting.
- ✅ Confirm ordinary internet access with the VPN disconnected.
- ✅ Compare more than one website or app before deciding the whole connection is down.
- ✅ Check whether the problem affects every destination or only traffic handled by a particular rule.
- ❌ Do not change DNS, proxy mode, protocol, and server all at once; doing so hides the cause.
Bottom line: First establish whether the local internet works, then narrow the failure to one app, one route, or all traffic through the VPN.
Check DNS, proxy settings, and traffic routing
DNS translates a domain name into an address a device can connect to. A tunnel may be active while DNS requests are blocked, sent through an unsuitable resolver, or handled differently from the rest of your traffic. One clue is that a service opens when you use an address you already know but fails when you enter its domain name; however, this clue is not conclusive, and testing unfamiliar numeric addresses is not a reliable general fix. A more useful check is to see whether several unrelated domain names fail in the same way and whether the client reports DNS or resolver errors.
Review the client’s DNS option and routing mode. If the client has a documented default DNS setting, use that as a baseline rather than entering a random public resolver. Some clients support encrypted DNS or DNS-over-HTTPS; using those features at the same time as another DNS tool can create competing paths. Temporarily disable a separately installed DNS changer, content filter, or private-DNS app, reconnect, and test again. If access returns, re-enable tools individually to find the conflict.
Next, inspect system proxy settings. A desktop client may configure a system proxy, use a virtual network interface, or offer both modes. A browser may also have its own proxy configuration. If the VPN disconnects unexpectedly, a stale manual proxy can remain enabled and leave the browser sending requests to an address that is no longer available. Check the operating system’s proxy page and the affected app’s network settings. Restore the normal automatic or system-managed option if you did not intentionally configure a separate proxy.
On clients such as Clash Verge or sing-box, confirm that the expected configuration or subscription is active and that the selected outbound is available. A rule-based setup may send DNS through one route and website traffic through another; incompatible rules can cause timeouts even when a proxy node is reachable. Avoid editing unfamiliar rule syntax as a first response. Switch to a known working profile or a documented default mode, then test. If using Shadowrocket on iOS, check that its VPN permission is active and that the selected configuration is enabled rather than merely present in the app.
On Windows or macOS, look for another VPN, proxy, firewall, endpoint-security product, or network filter that may also be controlling traffic. Two clients can compete for the system tunnel or proxy setting. Quit the extra client completely, not just its visible window, then reconnect the intended client. If the device belongs to an employer or school, do not bypass its network controls; ask the administrator whether VPN traffic or a particular app is restricted.
Do not paste a subscription URL, password, access token, or unredacted configuration into a public forum or online converter while diagnosing the problem. These details can grant access to your account. If you share a log with support, remove credentials, account identifiers, and private addresses first.
Follow a safe reconnect checklist
Once you know whether the failure is system-wide or limited to a particular app, use this sequence. It works across desktop and mobile devices because it starts with reversible checks and postpones more disruptive changes. Keep a note of the original settings before adjusting anything, especially if you use a manually maintained profile.
- Test the local connection. Disconnect the VPN and open a normal website. If that fails too, reconnect Wi-Fi or mobile data, check the router or carrier connection, and resolve the local outage before continuing.
- Close competing network tools. Quit other VPN clients, proxy utilities, DNS changers, and network filters that you do not need for the test. On mobile, check whether a separate security or private-DNS app is active.
- Reconnect from a clean client state. Disconnect inside the VPN app, wait until its status changes, then connect again. If the system still shows a VPN indicator after the app reports disconnected, turn the connection off in the operating system’s VPN settings before reconnecting.
- Try a different server or route. Select another available server in a suitable region and repeat the same website and app tests. A single server can be temporarily unreachable or incompatible with a particular destination; changing it helps determine whether the issue is route-specific.
- Check the client mode and profile. Use a documented default or a known working configuration. Verify that the intended profile is enabled, its subscription has refreshed successfully, and the selected outbound is not disabled or unavailable.
- Change one protocol option only if needed. If the client and service offer multiple supported protocols, try another supported option after recording the current setting. Protocol names describe different connection methods; no protocol is guaranteed to work on every network, and changing one does not prove that the old one was defective.
- Repeat the same tests. Use the same app and destination after each change. If you alter several settings together, you will not know which one resolved the issue and may create a second problem.
For a quick decision rule, separate a device problem from a route problem. If another device on the same Wi-Fi can connect through the same service, investigate the affected device’s permissions, proxy, DNS, or security software. If the same device works on mobile data but not on Wi-Fi, the router or local network may be filtering or mishandling the connection. When comparing networks, keep the client profile and server unchanged so the test remains meaningful.
If you are choosing a service for use across networks and devices, review the supported platforms and setup details for VPNRE VPN for Expats in China before changing client settings. Compatibility between the service, operating system, and third-party client matters: an imported profile can be present without being active, and a client can support a protocol in general without supporting every option used by a particular subscription.
Fix device-specific issues on desktop and mobile
Windows and macOS
On Windows, confirm that the VPN app has permission to create or manage its network connection. Check the system proxy page for a manual proxy left behind by another client, and review firewall or endpoint-security notices that appeared around the time the issue started. If you recently installed or updated a network utility, temporarily close it and test the VPN again. Avoid disabling the firewall as a broad fix; if a firewall rule is responsible, use the product’s supported method to allow the VPN client rather than leaving protection off.
On macOS, verify that the VPN configuration is allowed in system settings and that the selected client has the required network permission. A browser-specific proxy or privacy extension can make browser results differ from other apps, so compare with a separate app before changing system-wide settings. If the VPN uses a system extension or network filter, check whether macOS is waiting for approval after an app update. Reinstalling should be a later step, after confirming that you have a safe way to restore the subscription configuration.
Android and iOS
On Android, check the system VPN page for an old connection that may still be active. If Always-on VPN or “block connections without VPN” is enabled, a disconnected or misconfigured client can intentionally prevent ordinary internet access. Turn those options off only if you understand the privacy trade-off, then test the connection and restore your intended protection settings afterward. Also check Private DNS and any battery or background restrictions that may stop the client from maintaining its connection.
On iOS, allow the client to add or manage its VPN configuration when prompted, and inspect system VPN settings if the app and status indicator disagree. A content blocker, DNS profile, or another VPN app can affect traffic separately from the visible client. Test with one network tool active at a time. If the problem began after installing a profile, remove it only when you know what it does and can restore it safely; managed work or school profiles should be handled by their administrator.
For any device, a restart can clear a stuck network state, but it will not correct a wrong profile, expired credentials, incompatible routing rule, or blocked server. Before reinstalling an app, make sure you can access your account and re-import the configuration. Do not delete a profile merely because the connection status looks confusing; first determine whether the profile contains settings you need.
When to switch servers, protocols, or contact support
Try another server when the local internet is working, the client is connected, and failures appear limited to the current route or destination. Choose a location appropriate for the service you are trying to reach, then compare results using the same app and settings. A different route can help distinguish a temporary server issue from a device configuration problem, but it does not guarantee that a website will accept the connection or that every region will behave the same way.
Try a different protocol only when the service and client both support it and you have already checked the simpler causes. Networks may handle transports differently, and a protocol that works on one Wi-Fi network may fail on another. Restore the original option if the alternative makes no difference. If the client shows authentication, subscription refresh, or configuration errors, address those messages rather than repeatedly switching protocols.
Contact support when the local internet works, you have tested a clean client state and another suitable server, and the problem persists across more than one app or destination. Include the device operating system, client name and version, connection mode, selected server region, protocol if visible, and the exact error text. Describe what works with the VPN disconnected and what changes after connecting. Mention whether the issue occurs on Wi-Fi, mobile data, or both. This gives support a useful comparison without requiring a long list of unrelated changes.
Keep the report safe and focused. Do not send passwords, complete subscription links, payment details, or screenshots that expose account credentials. Share a redacted diagnostic log only through the service’s official support channel. If an employer-managed device or network is involved, ask its administrator before changing system profiles or security settings.
Bottom line: When a VPN says connected but apps cannot reach the internet, verify local access first, check DNS and proxy conflicts, then compare a different server with the same client settings. Escalate with a concise, redacted report if the issue remains reproducible.