A VPN connection failure usually means the client cannot complete the tunnel handshake with the gateway. Fix it by verifying credentials, switching protocol (WireGuard, OpenVPN, IKEv2), allowing UDP 500/4500 or TCP 443 through the firewall, flushing DNS, and updating the client. Work outward from the endpoint to the server.
Symptoms
- Client hangs at "Connecting…" then drops with a timeout or handshake error
- Tunnel establishes but no traffic passes; internal hosts unreachable
- Repeated authentication prompts despite correct username and password
- Frequent disconnects every few minutes on Wi-Fi or LTE
- Error codes such as 691, 800, 809, 812, or 13868 on Windows RAS clients
Common Causes
Blocked UDP ports or deep packet inspection
Corporate, hotel, and mobile networks often block UDP 500/4500 (IPsec) or the OpenVPN port. DPI can also identify and drop tunnels even when the ports are open.
Expired or mismatched credentials and certificates
Domain password changes, revoked machine certificates, or a rotated pre-shared key will fail the phase-1 exchange, producing authentication errors that look like connectivity issues.
MTU or fragmentation problems
Encapsulation adds overhead. If the path MTU is too high, large packets get silently dropped, so the tunnel connects but nothing loads.
Local firewall or endpoint security
Windows Defender Firewall, third-party AV, or EDR agents may block the VPN adapter, IKE service, or the TAP/WireGuard driver from binding.
Outdated client or protocol mismatch
Server-side upgrades (for example dropping IKEv1 or old TLS ciphers) leave older clients unable to negotiate a compatible cipher suite.
Step-by-Step Fix
- Confirm the failure is VPN-specific, not general connectivity
Disconnect the VPN and browse normally. Run a ping to 1.1.1.1 and a DNS lookup against a public resolver. If plain internet works, the fault sits between your client and the VPN gateway, which narrows the search considerably. - Re-authenticate and verify the account status
Sign out of the VPN client, then sign back in with freshly typed credentials. Check with your admin whether the account is locked, MFA is enrolled, or a client certificate has expired. Authentication failures are the single most common cause in enterprise deployments. - Switch protocol and try an alternate gateway
In the client settings, change the protocol order: try WireGuard first, then OpenVPN over TCP 443, then IKEv2/IPsec. TCP 443 usually traverses restrictive networks because it looks like HTTPS. If the provider offers multiple gateways, connect to a different region to isolate a single-server outage. - Open the required ports on the local firewall
IPsec needs UDP 500 and UDP 4500 plus ESP (protocol 50). OpenVPN typically uses UDP 1194 or TCP 443. WireGuard uses a custom UDP port defined in the config. Add the VPN executable and its virtual adapter as allowed apps in Windows Defender Firewall or the macOS firewall. - Flush DNS and reset the IP stack
Run ipconfig /flushdns, ipconfig /release, ipconfig /renew, then netsh winsock reset and netsh int ip reset on Windows. On macOS use sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder. Reboot afterwards so the network stack rebuilds cleanly. - Test and adjust the MTU
From the command line run ping -f -l 1400 <gateway> on Windows or ping -D -s 1400 <gateway> on Linux/macOS, lowering the size until packets stop fragmenting. Set the tunnel interface MTU accordingly (often 1380–1420 for IPsec, 1420 for WireGuard). - Reinstall the VPN client and virtual adapter
Uninstall the client, remove leftover TAP or WireGuard adapters from Device Manager, then reboot and install the latest signed release from the vendor. A corrupted virtual adapter is a frequent culprit after Windows feature updates. - Read the client log and correlate with the gateway
Every serious VPN client writes a log: %ProgramData%\OpenVPN Connect\log, /var/log/wireguard, or Event Viewer for Windows RAS. Match timestamps with the gateway log. Error codes like IKE_AUTH failed or TLS handshake failed point directly to the layer to fix.
Common VPN error codes and the action they point to
| Code / message | Layer | Likely cause | Action |
|---|---|---|---|
| Error 691 | Authentication | Wrong credentials or disabled account | Reset password, verify account in directory |
| Error 800 / 809 | Transport | UDP 500/4500 blocked by firewall or NAT | Open ports or switch to TCP 443 |
| Error 812 | Policy | Server policy rejects the auth method | Align client protocol with server config |
| TLS handshake failed | Encryption | Cipher or certificate mismatch | Update client, reissue certificate |
| IKE_AUTH failed | IPsec phase 2 | PSK or certificate mismatch | Re-enter PSK, reimport machine cert |
| Connected, no traffic | Routing / MTU | Split-tunnel misconfig or MTU too high | Check routes, lower tunnel MTU |
Prevention
- Enable auto-update for the VPN client and push versions centrally through MDM or GPO
- Monitor certificate expiry dates and rotate PSKs on a documented schedule
- Standardise on a modern protocol (WireGuard or IKEv2) and retire IKEv1/PPTP
- Document allowed ports and add them to the standard workstation firewall baseline
FAQ
Why does my VPN connect but no websites load?
The tunnel is up but traffic is not flowing. Usually this is a DNS problem (the client did not receive the internal resolver), a routing conflict with the local subnet, or an MTU mismatch dropping large packets. Flush DNS, check the pushed routes with route print, and lower the tunnel MTU to around 1400.
Is it safe to disable the firewall to test the VPN?
Only briefly and only on a trusted network. Disable, test the connection, then immediately re-enable and add a permanent exception for the VPN client and its virtual adapter. Never leave endpoint protection off, and never disable it on public Wi-Fi.
Which VPN protocol should I choose when connections keep failing?
WireGuard is fast and lightweight, IKEv2/IPsec handles mobile roaming well, and OpenVPN over TCP 443 is the most likely to pass through restrictive firewalls and hotel networks. Try them in that order. Avoid PPTP entirely; it is deprecated and insecure.
Contact our IT support team to review your VPN configuration and stabilise remote access.