If your VPN works over mobile data but not over Wi-Fi, the difference is a useful clue: the account and app may be working, while the Wi-Fi network, router, DNS path, or a local permission is interfering. It does not prove that the router is at fault, because switching networks can also change the device’s DNS settings, IP address, and connection route. Troubleshoot one variable at a time so you can identify what actually fixes the connection.
Start by checking whether the Wi-Fi network itself is ready for normal internet access. Then test the VPN app’s permissions, DNS behavior, protocol options, and server selection in that order. Avoid changing several settings at once: if the connection starts working, you otherwise will not know which change mattered or whether it is safe to keep.
Confirm the Wi-Fi baseline before changing VPN settings
Disconnect the VPN and open a few ordinary websites or apps over the same Wi-Fi network. If they do not load, the VPN is not yet the main issue: reconnect to Wi-Fi, check the router’s internet status, and follow the network owner’s normal troubleshooting process. If only one site fails, test another destination before drawing a conclusion; a site can be temporarily unavailable or apply its own access restrictions.
Next, compare the same device on Wi-Fi and mobile data, using the same VPN profile and, where possible, the same server. Record the result and any error message before making changes. If the client reports “connected” but apps cannot reach the internet, the tunnel may have been established while DNS resolution, routing, or a particular destination still fails. A connection indicator alone is not a complete test.
Try another device on the same Wi-Fi network if one is available. If VPN connections fail on several devices but ordinary browsing works, the router or network policy becomes a stronger possibility. If only one device is affected, prioritize its app version, system permissions, DNS configuration, and other networking tools. This comparison helps separate a network-wide problem from a device-specific one.
1
Check ordinary Wi-Fi access
2
Compare mobile data
3
Test another device
4
Change one setting at a time
This short comparison narrows the search; it is not a guarantee that every Wi-Fi network handles VPN traffic in the same way. A workplace, school, hotel, or public hotspot may have rules that differ from a home router, and you should follow the network owner’s policies.
Rule out captive portals and network restrictions
Public Wi-Fi often requires a browser sign-in, an acceptance of terms, or another step before ordinary internet access is allowed. A VPN may prevent that sign-in page from appearing, or the hotspot may block tunnel traffic until you complete it. Disconnect the VPN, open the network’s official sign-in page, complete the required step, and confirm that ordinary browsing works. Then reconnect the VPN. Do not enter account details into a page unless you can verify that it belongs to the venue or network operator.
Some managed networks restrict VPN protocols or require an administrator-approved connection method. A failure on a company or campus network may therefore be intentional rather than a fault in your subscription or device. Ask the network administrator which access methods are permitted. Do not attempt to bypass workplace, school, or venue controls; use an approved connection or a different network when authorized.
On a home network, restart the router only if you are allowed to manage it and other users can tolerate a brief interruption. A restart can clear a temporary router state, but it does not correct a persistent policy, a misconfigured DNS setting, or a network-wide restriction. If ordinary Wi-Fi access works and VPN fails on more than one device, consult the router documentation or internet provider rather than repeatedly resetting settings you do not understand.
Check app permissions and conflicting network tools
Confirm that the VPN client is allowed to create and maintain its local VPN connection. On a phone or tablet, the operating system normally asks for permission when the app first sets up a VPN profile. If that permission was denied, removed, or replaced by another VPN app, the client may not be able to establish its tunnel. Review the system’s VPN settings and make sure the intended profile is selected. The exact menu names vary by operating system and release.
On a computer, check whether a firewall, endpoint-security product, parental-control tool, or another proxy application is filtering network traffic. Do not disable security software as a blanket test, especially on a managed device. Instead, look for an explicit block or prompt in its settings and consult its documentation or administrator. If you have more than one VPN or proxy client installed, close the other client and test with just one active. Competing network extensions or virtual interfaces can produce confusing results.
Also check whether the client has been allowed to run in the background if the connection drops after the screen locks or the device changes networks. Background restrictions are more likely to explain a connection that starts and then stops than one that never connects at all, so match the symptom to the setting rather than changing every permission. If the client offers an automatic reconnect option, confirm its behavior after briefly disconnecting and reconnecting to Wi-Fi.
For a clean comparison, close the VPN app, reconnect to Wi-Fi, and reopen the app. If the client has an existing profile that may be outdated, verify that it is the intended profile before removing or replacing it. On managed devices, do not delete profiles supplied by an organization without checking first.
Test DNS and local network settings
DNS translates a site name into an address. If the VPN connects but websites stall, fail to open by name, or behave differently from direct Wi-Fi access, DNS is one possible cause. Check whether the client has a DNS mode or DNS protection setting and whether it is enabled as intended. Avoid entering an unfamiliar DNS address just to see what happens; changing DNS can affect privacy, filtering, and access to local services, and may violate a managed network’s configuration.
Some devices use a manually configured DNS server, a private DNS option, or a network-wide filtering service. For a controlled test, note the current setting first, then temporarily return to the network’s automatic DNS configuration if that is allowed. Reconnect and test the same destination. If the problem disappears, restore or document the change appropriately and investigate the original DNS configuration rather than assuming that every custom DNS service is incompatible with VPN use.
Local network features can also complicate diagnosis. A work profile, security app, custom proxy, or ad-filtering tool may apply different rules on Wi-Fi than on mobile data. Turn off only a feature you understand and are permitted to change, test once, and restore it if it makes no difference. When the VPN connects and general browsing works but a single service does not, also check that service’s own status, account region, and network requirements before altering DNS.
When you need a reference for the client and service setup options, VPNXG provides the starting point for the available information. Keep your troubleshooting focused on the network that fails: a setting that helps one Wi-Fi connection may be unnecessary or unsuitable on another.
Switch protocols and test a different server
A VPN protocol determines how the encrypted connection is established and carried across the network. Networks do not all treat every protocol the same way: a router or managed hotspot may permit one connection method and restrict another. If the client offers more than one protocol, test an available alternative, reconnect, and repeat the same basic browsing check. Change only the protocol for that test, then restore the original option if the result is unchanged.
Protocol names such as Shadowsocks, VMess, Trojan, Hysteria2, and WireGuard refer to different technologies or implementations; their availability depends on the client and service configuration. Do not assume that every compatible client supports every protocol, or that switching to a protocol with a familiar name will solve a network restriction. Follow the client’s documented options and use the subscription configuration intended for that client.
If the protocol test does not help, select another available server and test again. A particular route can be temporarily unavailable or unsuitable for the current network, but changing servers repeatedly makes results difficult to compare. Keep a simple note of the selected profile, protocol, server label, and outcome. If one server works while another does not under the same conditions, report that distinction to the service’s support team.
| Test | If it helps | Next step |
|---|---|---|
| Complete the Wi-Fi sign-in page first | The hotspot may have required authorization before tunnel traffic | Reconnect after normal internet access is available |
| Try another device on the same Wi-Fi | The issue may be specific to the original device or client | Review permissions, DNS, and competing network tools |
| Try another available protocol | The network may handle connection methods differently | Use the permitted option and keep the test conditions consistent |
| Try another available server | The original route may be temporarily unavailable or unsuitable | Note which route works and share the details if needed |
| Check the same destination without the VPN | The destination or Wi-Fi connection may be the actual problem | Separate service availability from tunnel connectivity |
Do not treat a successful server change as proof that the Wi-Fi router is defective. It may instead indicate a route-specific issue, while a protocol change may point to how that network handles tunnel traffic. The distinction matters if you need to explain the problem to a network administrator or support team.
Use a repeatable troubleshooting sequence
A consistent test is easier to interpret than a series of unrelated setting changes. Keep the Wi-Fi network, device, destination, and client profile constant while changing one variable. After each change, disconnect and reconnect cleanly, then test the same ordinary website or app. If the result is unclear, return to the original setting before beginning another test.
- ✅ Confirm that ordinary browsing works on Wi-Fi with the VPN disconnected.
- ✅ Complete any legitimate hotspot sign-in before starting the VPN.
- ✅ Check the intended VPN profile and the operating system’s connection permission.
- ✅ Test DNS or protocol changes separately and record the result.
- ✅ Compare a different server only after the basic connection checks.
- ❌ Do not disable every firewall or security feature just to make a connection test.
- ❌ Do not change router settings you are not authorized to manage.
- ❌ Do not assume “connected” means every app or destination is reachable.
If none of the tests resolve the issue, collect useful details before asking for help: the device and operating system, client name and version, whether Wi-Fi browsing works without the VPN, the exact error text, and which protocol or server tests you tried. Avoid sharing passwords, private keys, or a full subscription link in a public support request. An administrator or service support team can use the symptom pattern without needing your credentials.
Frequently asked questions
Why does the VPN work on mobile data but not Wi-Fi?
The two networks can use different DNS settings, routes, router policies, and sign-in requirements. A working mobile-data connection shows that the app can connect under at least one set of conditions, but it does not identify which Wi-Fi setting is responsible. Compare ordinary browsing first, then check hotspot authorization, permissions, DNS, and protocol behavior.
The client says connected, but apps do not load. What should I check?
Check whether the same apps work with the VPN disconnected, then test a different ordinary destination. If general access fails only with the VPN enabled, review DNS and routing settings and try one alternate server or protocol if available. If only one app or website fails, investigate its own status and access requirements as well.
Should I change the router firewall to allow the VPN?
Only change router settings if you own or administer the router and understand the effect. On workplace, school, hotel, and public networks, ask the responsible administrator which methods are allowed instead of attempting to bypass restrictions. On a home network, consult the router documentation or internet provider if the issue affects multiple devices.
When should I contact support?
Contact support after confirming that Wi-Fi browsing works without the VPN, checking any required hotspot sign-in, and testing the client’s permissions. Include the device and operating system, the client version, the exact error, and the protocol or server comparisons you performed. Do not include passwords or private subscription credentials.