VPN Won’t Connect on Wi-Fi? 5 Fixes When Mobile Data Works

Start with a controlled test

Before changing settings, confirm that you are comparing like with like. Connect to Wi-Fi, note the selected server and protocol if the client displays them, and try to connect. Then switch to mobile data and test again without changing the server, client mode, or target app. If the connection works on mobile data, return to Wi-Fi and repeat the test once. A brief network interruption or a temporary service issue can otherwise look like a consistent Wi-Fi failure.

Check what “not connecting” means in your case. The client may fail before it establishes a tunnel, show a connected state while websites do not load, or connect successfully while only some apps fail. These are different symptoms. A failed handshake points toward reachability, protocol, or configuration. A connected tunnel with no browsing may involve DNS, routing rules, or the destination app. If only one app is affected, test a second website or app before changing router settings.

Write down the exact error message and whether the client ever reaches “connected.” Also note whether the Wi-Fi is at home, work, school, a hotel, or a public venue. Managed networks can apply restrictions that you cannot change yourself; home routers offer more settings, but their menus and available controls vary by model. Avoid resetting the router or deleting a working configuration before you have captured the details you may need to restore it.

Fix 1: Complete the Wi-Fi sign-in page

Hotels, airports, campuses, cafés, and some workplace networks use a captive portal. The device first joins Wi-Fi, but the network requires you to accept terms, enter a room or access code, or sign in through a web page before normal internet access is allowed. A VPN may not be able to reach its server until this step is complete, so the client can appear stuck even though the Wi-Fi icon shows a connection.

1. Disconnect the VPN, then connect the device to the Wi-Fi network.
2. Open a browser and visit a familiar website that does not require you to sign in. If the network redirects you to an access page, complete its instructions.
3. Wait for the page to confirm access, close and reopen the VPN client, and try the connection again.
4. If no sign-in page appears, disconnect and rejoin Wi-Fi, then check the network’s welcome instructions or ask its administrator whether access must be activated manually.

Do not enter your VPN account password into a Wi-Fi portal unless the page is clearly the service’s own sign-in page. A network access page and a VPN dashboard serve different purposes. On managed or public Wi-Fi, the portal may also expire after a period of inactivity. If the VPN stops working after reconnecting to that network, first check whether the portal requires another sign-in.

On a phone, temporarily pause the VPN and open the browser rather than repeatedly tapping connect. On a computer, check whether the browser is already waiting behind another window or whether the operating system has displayed a network sign-in notification. If the portal itself will not load, the issue may be the Wi-Fi’s internet access rather than VPN settings.

Fix 2: Check router and network restrictions

Some Wi-Fi networks restrict traffic used to establish VPN connections. A home router, a managed office network, or a public hotspot may have firewall rules, access controls, or security features that interfere with a particular connection method. This does not mean that every router blocks VPNs, and menu names differ between manufacturers. If you are on a network you do not manage, ask the network administrator whether VPN traffic is allowed rather than trying to bypass the network’s policy.

For a home network, first restart the router using its normal controls and wait for the Wi-Fi connection to return. Then test the VPN again. If it still fails, review the router’s documented security and access settings. Look for rules that explicitly block VPN or tunnel traffic, parental controls that restrict the device, or a guest-network option that has different access rules. Change only a setting you understand, record its original value, and restore it if the test makes no difference.

Also check whether another device on the same Wi-Fi can connect with the same VPN service. If it can, the issue is more likely to be specific to the original device, its client configuration, or its local network settings. If several devices fail on that Wi-Fi but work on mobile data or another network, the router or network policy becomes a stronger suspect. This comparison is more useful than changing several device settings at once.

When comparing general VPN services or connection options for a restrictive network, start from the service’s official information rather than assuming that every provider or protocol behaves alike. For an overview of the service and supported platforms, see Best VPN for China. Availability of a specific protocol or setting depends on the client and configuration you are using; check those details before following a protocol-specific suggestion.

• ✅ Test another device on the same Wi-Fi before changing the router.
• ✅ Ask the network administrator whether VPN connections are permitted on managed Wi-Fi.
• ✅ Record the original router setting before making a reversible change.
• ❌ Do not disable the router firewall wholesale just to see whether the VPN connects.

Fix 3: Review DNS and device network settings

DNS translates a domain name into an address that a device can use to make a connection. A Wi-Fi network may provide DNS settings that differ from those used on mobile data. If the VPN reports that it is connected but websites fail to open, or if the failure affects only some destinations, DNS or routing deserves attention. DNS is not the only possible cause: an incorrect proxy setting, a stale network configuration, or an app-specific rule can produce similar symptoms.

Start with low-risk checks. Turn Wi-Fi off and on, reconnect to the network, and check whether the device has a manually configured proxy or DNS server that you did not intend to use. If you recently changed those settings, restore the previous values and test again. On a network that requires a particular proxy configuration, do not remove it without checking with the administrator. If your VPN client offers a DNS option, note its current state before changing it and use the client’s documentation to understand what the option does.

On Windows, open the Wi-Fi connection’s network settings and review any manually assigned DNS or proxy values. On macOS, check the active Wi-Fi service in Network settings, including its DNS and proxy sections. On Android and iOS, review the selected Wi-Fi network’s details and any installed VPN, DNS, or device-management profile. The wording and location of controls vary by operating-system version, and a work or school device may not let you change managed settings.

After a change, disconnect and reconnect the VPN, then test more than one destination. If the VPN says it is connected but only a domain name fails, compare with a different website and check the client’s connection or DNS logs if available. Avoid entering unfamiliar DNS addresses from forum posts: an untrusted resolver can create privacy and reliability risks, and it may not address the underlying network block.

Fix 4: Test a compatible VPN protocol

A VPN protocol defines how the client and server establish and carry a connection. Different protocols can use different transports and network behavior, so a network may allow one connection method while interfering with another. This is a possible explanation when Wi-Fi fails but mobile data works, not a guarantee that changing protocols will solve it. The client must support the protocol, and the service configuration must provide a compatible option.

Open the VPN client’s settings and see whether it offers a protocol selection or an automatic mode. If the client is managed by a subscription configuration, check the client’s documentation before editing the configuration manually. Change one option only, reconnect, and record the result. If the connection becomes less reliable or stops working on other networks, restore the original setting. Do not assume that protocols such as WireGuard, Shadowsocks, VMess, Trojan, or Hysteria2 are interchangeable: support depends on the client core and the server configuration.

If the client offers automatic selection, try it before making a manual change. If automatic mode is already in use and the client exposes other supported options, test them individually. Keep the same server while comparing, where possible, so that the protocol is the only changed variable. If you change both server and protocol at once, a successful result will not tell you which change mattered.

On a work or school network, protocol selection may be controlled by policy, and attempts to use an unapproved connection method may violate the network’s rules. Ask the administrator for permitted options. On a personal Wi-Fi network, consult the router documentation or your internet provider if the network consistently blocks a connection method and you cannot identify a relevant setting.

Fix 5: Refresh the client and try another server

Once you have checked access to Wi-Fi, basic network settings, and protocol compatibility, confirm that the client has a current configuration. If you use a subscription, refresh it through the client’s normal update function and check for an error message. A successful subscription update and a successful VPN connection are separate steps: the update supplies configuration, while the client still has to use a compatible server entry and establish the connection.

Then select another available server in the client and test again, keeping the protocol and other settings unchanged. One server entry may be temporarily unreachable from a particular network, while another may take a different route. A server switch is a useful diagnostic comparison, not proof that the original server or the Wi-Fi is permanently faulty. If several servers fail in the same way on one Wi-Fi network but work on mobile data, return to investigating the Wi-Fi path.

If you use a third-party client such as Clash Verge, sing-box, or Shadowrocket, check that it has imported the latest subscription and that the selected profile is active. Confirm that the client supports the protocol used by the selected configuration. Review routing rules as well: a direct-connection rule can send an app or domain outside the VPN even when a server is selected. Do not paste a private subscription URL into a public troubleshooting page; it can contain account access information.

For platform-specific setup, you can follow the quick start guide. If you are unsure whether a symptom comes from the client or the network, first test the official client on the same device and Wi-Fi, if one is available to you. Avoid running multiple VPN clients simultaneously: competing network interfaces or routing rules can make the outcome difficult to interpret.

When to contact support

If the five checks do not resolve the problem, gather enough information for someone else to reproduce the pattern. Include the device and operating system, the client name and version if visible, the Wi-Fi type, whether mobile data works, the selected server, the selected protocol if shown, and the exact error message. State whether the client fails to connect or connects but cannot load websites. Do not include passwords, one-time codes, or a full subscription URL.

Try to describe the comparison precisely: for example, “this device connects on mobile data, fails on my home Wi-Fi, and another device also fails on that Wi-Fi.” That is more actionable than “the VPN is broken.” If the problem occurs only on a managed network, contact its administrator as well as the VPN service; the administrator can confirm whether the network permits VPN traffic, while service support can check configuration and client-specific errors.

Keep a short record of the tests you performed and their results. Note which setting you changed and whether restoring it changed the behavior. This prevents support from asking you to repeat the same steps and reduces the risk of leaving a temporary test setting in place. If the connection begins working after a server or protocol change, mention the original and working options rather than describing only the final state.

FAQ

In short, establish whether the Wi-Fi has internet access, check for a sign-in portal, compare another device, and then inspect DNS, protocol, and client configuration in a controlled order. If only one network fails, preserve that distinction when you ask the network administrator or service support for help.