A VPN can show “Connected” while websites and apps still fail to load. The status usually confirms that the client established a connection to a server; it does not guarantee that DNS resolution, routing, device permissions, or the destination service is working correctly. The quickest way to find the cause is to change one thing at a time: check the underlying network, compare another app or website, and then test the VPN connection with a controlled sequence of fixes. This guide covers desktop and mobile checks, explains how to undo temporary changes, and helps you decide when to change servers, try another protocol, or ask support for help.
Identify where the connection is failing
First, separate a problem with your internet connection from a problem introduced by the VPN. Disconnect the VPN briefly and try opening a familiar website or using an app that normally works. If nothing loads without the VPN either, the VPN is unlikely to be the main cause. Your Wi-Fi, mobile data, router, captive portal, or internet provider may need attention. Reconnect the VPN after this check rather than leaving it off as a permanent workaround.
If the internet works when the VPN is disconnected but stops working after you connect, focus on the client, selected server, routing mode, DNS, or device permissions. If only one app fails, the issue may instead be that app’s proxy support, its own network settings, or a route rule that sends its traffic differently from the browser. Test more than one destination: a single website can be unavailable or slow for reasons unrelated to your VPN.
5
checks in this guide
2
connection states to compare
3
areas to inspect: DNS, routing, permissions
Keep a short note of what you tested and what changed. For example, record whether ordinary browsing works with the VPN off, whether a second browser has the same issue, and whether reconnecting to a different server changes anything. You do not need to record account passwords, subscription URLs, or private configuration details. A simple sequence helps you avoid repeating steps and makes it easier to explain the issue if you contact support.
Also check for a sign-in page on public, hotel, school, or workplace Wi-Fi. Some networks require you to accept terms or sign in before they allow normal internet access. Disconnect the VPN only long enough to open the network’s legitimate sign-in page, complete the required step, and then reconnect. Do not enter your VPN credentials into a Wi-Fi portal or an unfamiliar page.
Check the network and client state
Before changing advanced settings, refresh the basic connection. Turn Wi-Fi off and back on, or switch between Wi-Fi and mobile data if that option is available. Confirm that the device has not enabled airplane mode, a data limit, or a system-level restriction that blocks background network access. If you are on a managed work or school device, an administrator policy may prevent a VPN or proxy client from changing network settings.
Close and reopen the VPN client, then disconnect and reconnect once. If the client has a connection log or diagnostic view, check the latest entries for a clear error such as a failed DNS lookup, permission denial, or timeout. Do not assume that a large block of unfamiliar log text proves a security problem; look for repeated, recent errors around the time the connection stopped working. Avoid posting unredacted logs publicly, because they may contain server addresses, account identifiers, or other sensitive details.
Check whether another network utility is active. A second VPN, proxy app, firewall, endpoint security tool, DNS filter, or manually configured system proxy can compete with the client for control of traffic. This is especially common after testing multiple clients or changing proxy settings. Quit or disable only the tool you recognize and can restore, then test again. If you are unsure whether an app is managed by your employer or school, ask the administrator before changing it.
Some clients offer different operating modes. A browser-only proxy may affect browser traffic but not every app; a system proxy can cover more applications, while TUN mode uses a virtual network interface to route traffic at a lower level. The exact behavior depends on the operating system, client, and routing rules. A connection indicator in one mode does not prove that all apps use the same route. For diagnosis, use the client’s documented default mode before experimenting with custom rules.
On a device with a kill switch or “block connections without VPN” option, traffic may intentionally remain blocked when the tunnel is unavailable or when the client’s route is incomplete. This can look like a total internet outage. Check whether the feature is enabled and whether the client reports a stable connection. If you temporarily disable a blocking option for diagnosis, do so only while you understand the privacy trade-off, test briefly, and restore the original setting afterward.
Work through five fixes in order
Use the following sequence from least disruptive to more specific. After each fix, reconnect and test the same websites or apps. If access returns, stop there; changing several settings at once can conceal the cause and make it harder to restore a reliable setup. The order also helps you avoid resetting network settings or removing a client before you know that those steps are necessary.
- Refresh the current network. Disconnect the VPN, reconnect to Wi-Fi or mobile data, and confirm that an ordinary website loads. If the device is on a network with a sign-in portal, complete that step first. Then open the client and connect again. If the underlying network still fails with the VPN off, troubleshoot the router, access point, mobile connection, or network provider rather than changing VPN settings.
- Reconnect and choose another available server. Disconnect cleanly, wait for the client to show that it is no longer connected, and then connect to a different server or route that is appropriate for your location and task. A server can be temporarily busy, unreachable from your current network, or unable to reach a particular destination. Do not judge the service from a single attempt or from one website alone. If another route works, the issue may be specific to the original route rather than to your device.
- Check the proxy and routing mode. If the client includes a system proxy, TUN, or rule-based mode, verify that the selected mode is supported on your device and that the relevant traffic is not set to bypass the proxy. For a clean test, use the client’s default configuration rather than hand-editing rules. If you have configured a manual proxy in the operating system, note its current values before changing them and remove only entries you recognize as belonging to a previous test or client.
- Refresh DNS without guessing at new values. DNS translates a domain name into an address. If the tunnel connects but domain names do not resolve, pages may fail even though the device has a network route. Disconnect and reconnect the client first; some clients update DNS automatically when the route changes. If your system has a custom DNS server, filtering profile, or encrypted DNS setting, temporarily return to the documented default and test again. Avoid entering random DNS addresses from a forum, and restore your previous configuration if the change makes no difference.
- Review permissions and try a supported protocol. On desktop, confirm that the client is allowed to create or manage its network interface where the operating system requires permission. On mobile, check whether a VPN profile is installed and whether the system still allows that profile to connect. If the client offers another supported protocol, try it only after recording the original selection. Different protocols can behave differently on restrictive networks, but switching is a diagnostic step, not a guarantee of faster or more reliable service.
As you work through these checks, make sure the destination itself is not the only failing component. Try a second browser, another familiar website, or an app that uses a different type of connection. If one app fails while others work, inspect that app’s proxy, private DNS, firewall, or per-app routing configuration. Some applications do not follow the system proxy, and some clients deliberately route selected destinations directly. The client’s mode and rules determine what “connected” means for each application.
When a route is stable but access to a particular service remains unavailable, consider whether the service is temporarily down, blocks the selected region, or requires a separate sign-in. Switching servers can help distinguish a route-specific problem from a broader device issue. For general information about available service options and supported platforms, see SpaVPN China VPN. This reference is useful for understanding the service context; it does not replace the connection checks above or guarantee access to a particular third-party site.
After a successful test, undo temporary changes that were not responsible for the fix. Restore any custom DNS value you recorded, re-enable security features you intentionally turned off, and remove obsolete proxy entries only if you know they are no longer needed. If the problem returns after restoring a setting, record which setting causes the change and leave unrelated network options untouched.
Apply the checks on desktop and mobile
Windows and macOS
On Windows, check the operating system’s proxy settings as well as the VPN client. A manually configured proxy can remain enabled after another application has been closed. Confirm that the active network is the one you intended to use and review any firewall or security tool that may block the client or its virtual adapter. If a client requests permission to install or enable a network component, use the operating system’s normal authorization flow and confirm that the request comes from the client you installed. Do not disable the firewall wholesale to test connectivity.
On macOS, review the active network service and any VPN or network extension profile associated with the client. System prompts can differ by macOS version and client implementation, so use the client’s current instructions rather than assuming every app needs the same permissions. If the app recently lost permission after an update, quit it, reopen it, and respond to the system prompt if one appears. Do not run commands copied from an unknown source to remove system protections or force a network extension to load.
Android and iOS
On Android, another VPN app may already occupy the system VPN slot, and battery or background restrictions can interrupt a client after the screen locks. Check the system VPN panel, disconnect other VPN clients, and review battery optimization only if the connection repeatedly stops in the background. Private DNS is a separate system setting from the VPN connection; if you changed it, note the current choice before testing the documented default. Menu names vary between device manufacturers and operating system versions.
On iOS, check Settings for an active VPN profile and confirm that the profile belongs to the client you intend to use. If the operating system asks to add or manage a VPN configuration, approve the request only when it is initiated by the trusted client. A device management profile from a workplace or school may also control network behavior, so do not remove a managed profile without permission. If only one app cannot connect, verify that it is not restricted by cellular data settings, content filters, or its own account and network requirements.
- ✅ Test the ordinary internet connection before changing the VPN configuration.
- ✅ Disconnect other VPN or proxy tools before testing the intended client.
- ✅ Record original DNS, proxy, mode, and protocol settings before a temporary change.
- ❌ Do not share a subscription link, full configuration file, password, or unredacted diagnostic log in a public post.
- ❌ Do not turn off device security protections or remove a managed profile just to make a connection test pass.
Know when to stop and contact support
Contact support if the same failure continues after you have confirmed that the underlying network works, restarted the client, tested another suitable server, and checked the device’s permissions and proxy settings. It is also reasonable to ask for help sooner if the client reports repeated authentication or subscription errors, a system permission cannot be granted, or the issue affects multiple networks and applications. If the connection stops after an operating system or client update, mention that timing; it can help identify a compatibility or configuration change.
Provide a concise description of the device and operating system, client version if visible, the selected mode and protocol, whether the VPN-off connection works, and the steps you have already tried. Include the time the issue occurred and the exact error text when available. Describe whether the problem affects every website or only particular apps. These details help support distinguish DNS, route, permission, server, and account issues without asking you to repeat basic tests.
Before sharing a screenshot or log, inspect it for usernames, subscription URLs, authentication strings, private IP details, and destinations you do not want to disclose. Redact sensitive values while preserving the error message and surrounding context. Never send your account password or a complete subscription link through a public forum or an unverified contact channel. If support asks for diagnostic information, use the service’s official support route and share only what is needed to investigate.
Once service is restored, keep the working configuration simple. Use one VPN or proxy client at a time, leave routing rules at their documented defaults unless you need a specific exception, and avoid maintaining several competing DNS or proxy overrides. If the same symptoms return, compare the current setup with your notes rather than resetting every network setting immediately. A measured check is usually safer, easier to reverse, and more informative than making many changes in one session.