VPN will not connect: diagnosis order

Internet first, VPN second

Half of «VPN is broken» tickets are broken internet underneath. Open any site with VPN off: if that fails, fix the connection first (Wi-Fi checklist). Hotel and airport portals are classic culprits — authorize in the captive portal, then connect VPN.

Authentication failures

Wrong credentials, expired certificates and outdated clients cause the rest. Update the VPN client before anything else — providers drop old versions silently. Then verify the credentials still work on the portal, and check the certificate dates if the client uses them.

Connected but nothing loads

Tunnel up, traffic dead: usually DNS pushed by the server or a firewall eating UDP. Toggle between UDP and TCP transports in the client settings, and try one different network (phone tethering) to learn whether the fault is your machine or the local network.

Kill-switch surprises

A kill-switch that worked yesterday blocks everything today when the VPN process crashes but the firewall rule stays. Symptom: no internet at all until reboot. If that matches, disable the kill-switch, reconnect cleanly, then re-enable — and update the client, because stale rules on crash is a fixed bug in current releases.

Split tunneling decisions

Full tunnel is simpler and slower; split tunnel keeps video calls and cloud office direct. Decide by policy, not by user mood: company traffic through the tunnel always, everything else direct — except on untrusted networks, where full tunnel wins despite the speed cost.