A VPN client can show “Connected” while a browser or app still reports that there is no internet. The status usually confirms that the client has established a tunnel or started its proxy mode; it does not prove that your device can reach every destination through that route. The cause may be your Wi-Fi or mobile connection, a route that is temporarily unreachable, DNS settings, a second proxy, or a permission the client needs to manage traffic.
Work through the checks below in order, changing one thing at a time. That makes it easier to identify the cause and undo a change that does not help. Avoid resetting every network setting or disabling security software as a first response: those steps can create new problems without showing where the original failure occurred.
Confirm where the connection fails
Start by separating a device-wide connection problem from an issue affecting one app or destination. Disconnect the VPN temporarily, then open a familiar website or app. If it still cannot connect, the VPN is unlikely to be the only cause. Check whether Wi-Fi is connected, whether mobile data is available, and whether the router or access point has an internet connection. A device can remain associated with Wi-Fi even when the router has lost its upstream connection.
If the internet works without the VPN but fails as soon as the client connects, focus on the selected route, the client’s traffic mode, DNS, and proxy settings. If only one browser or application fails, check that app’s own proxy configuration, privacy extensions, and network permissions before changing the entire device. Some apps use the operating system’s proxy settings; others make their own connections and may behave differently.
Test more than one destination, such as a general website and the service you originally wanted to use. A single website can be unavailable, require a sign-in, or reject a particular exit location while the rest of the connection is working. If a page loads partly, note what is missing: text loading without images, repeated sign-in prompts, or a stalled video can point to different causes than a complete failure to resolve any address.
- ✅ Check whether the same device can browse with the VPN disconnected.
- ✅ Compare more than one app or destination before changing settings.
- ✅ Record whether the problem starts on connection, after changing routes, or only in one app.
- ❌ Do not assume the word “Connected” confirms that all device traffic is reaching the internet.
Five practical fixes to try
Fix 1: Verify the underlying network
Reconnect to Wi-Fi or mobile data and check that the network itself is usable. If you are on public Wi-Fi, open a browser with the VPN disconnected and see whether the network requires a captive-portal sign-in, such as accepting terms or entering an access code. Complete that sign-in through the network’s normal page before reconnecting. A VPN cannot complete a portal step that the network has not yet allowed your device to reach.
If other devices on the same Wi-Fi also have trouble, restart the router only if you are authorized to manage it and can safely do so. On a work, school, hotel, or shared network, ask the network administrator instead of changing equipment or bypassing its access controls. When possible, compare Wi-Fi with mobile data, or try a different trusted network. A change in results helps distinguish a local network restriction from a device configuration issue.
Fix 2: Change the route and restart the client
Disconnect cleanly from the current route, wait for the client to return to its idle state, then select another available route and connect again. A route may be unreachable from your current network, temporarily busy, or unsuitable for a particular destination. If the client offers connection modes or protocols, use a supported default first; change only one setting between tests and restore it if the result is worse.
Quit and reopen the client if its status appears stuck or traffic counters do not change when you make a request. Make sure there is not another VPN or proxy application active at the same time. Two clients can compete to set a system proxy, create overlapping routes, or manage DNS differently. On a desktop, check the system tray, menu bar, or network settings for another active connection; on mobile, check the VPN indicator and the operating system’s VPN settings.
For a compatible third-party client, confirm that the subscription or configuration has been imported successfully and that the selected profile is enabled. A local proxy client may report that its local service is running even when the remote route has not been tested by a real request. In rule-based mode, a destination may be assigned to a direct connection rather than the proxy. Temporarily use a clearly understood mode, if the client supports one, to compare behavior, then restore your preferred rules after troubleshooting.
Fix 3: Check DNS without weakening protection
DNS translates a domain name, such as a website address, into information needed to reach the destination. If DNS is unavailable or the device is using an unintended resolver, a page may fail by name even when some network traffic is working. Compare a domain-based destination with a service you already know is reachable by another method, but do not treat one successful address test as proof that browsing is fully restored.
First disconnect and reconnect the VPN so the client can apply its intended DNS configuration again. If the client has a DNS option, return it to the documented or automatic setting for that profile rather than entering an arbitrary public resolver. Check whether the operating system, browser, or security application has a separate encrypted-DNS setting that may override the client. Change one setting at a time, and restore the previous value if it does not help.
On Windows, you can use the network settings to disconnect and reconnect the adapter, or clear the local DNS cache from an elevated Command Prompt with ipconfig /flushdns. This clears cached name lookups; it does not repair an unreachable route, change a VPN protocol, or guarantee that DNS requests are using the resolver you expect. On macOS, Android, iOS, and Linux, DNS controls differ by operating-system version and client, so prefer the relevant settings screen or the client’s official instructions over commands copied from an unrelated device.
Fix 4: Remove conflicting proxy or routing settings
A proxy configured in the operating system, browser, or application can send traffic somewhere other than the VPN client expects. Check the system proxy settings for an old manual address or automatic configuration script, and inspect the affected app’s own network settings if it has them. If a proxy is required by your organization, do not remove it without permission; ask the administrator whether it is compatible with the VPN.
For users of Clash Verge, sing-box, Shadowrocket, or another compatible client, check which traffic mode is active and whether the relevant application or domain matches a rule. A rule that sends a request directly can make that request behave differently from one routed through the selected proxy. Review the active profile and recent configuration changes; do not paste unknown configuration snippets into a working profile just to test a connection.
On computers, a virtual network interface or TUN mode can affect routing beyond the browser. If the client offers both a system-proxy mode and a virtual-interface mode, test the documented default with other network tools closed. On phones, avoid leaving an old VPN configuration active alongside the current client. If you remove a profile, make sure you know which app created it and how to restore it before proceeding.
Fix 5: Verify device permissions and client health
Operating systems may ask permission to add a VPN configuration, network extension, or virtual interface. Confirm that the request came from the client you intended to use, then approve the permission through the operating system’s normal prompt if it is required for that client. If the prompt was dismissed, check the device’s VPN or privacy settings and follow the client’s setup instructions. Do not grant unrelated permissions simply because a connection failed.
Update the client through its official distribution channel when an update is available for your device and operating-system version. If you recently updated the operating system, check whether the client has documented compatibility steps. On Windows, a firewall may allow the client to start but block a particular component; review the application-specific rule rather than turning the firewall off globally. On macOS, check for a pending network-extension approval. On Android or iOS, review the VPN profile and any battery or background restrictions that could stop the client from maintaining a connection.
Only reinstall after confirming that you can obtain the app and restore its subscription or configuration. Before removing it, note any custom rules you need to keep and use the client’s documented export or backup feature if available. Reinstalling may clear a damaged local configuration, but it will not fix a router outage, an inaccessible route, or a DNS policy imposed by another administrator.
A step-by-step isolation routine
Use this sequence when you want a clean comparison rather than changing several settings at once. It works on desktop and mobile; the exact menu names vary by operating system and client.
- Disconnect the VPN and confirm that the device has a working Wi-Fi or mobile-data connection. Complete any required public-network sign-in first.
- Close other VPN and proxy clients. Reopen the client you intend to use and connect to one route.
- Test a familiar website in one browser, then test a different destination or app. Note whether the issue affects everything or only one service.
- If the connection still fails, change only the route. Reconnect and repeat the same tests rather than switching routes and DNS settings together.
- Check DNS, proxy, rules, and operating-system permissions in that order. After each change, retest and restore the previous setting if it did not help.
- When browsing works, test the app or task that originally failed. Some services require a fresh sign-in or a new app session after the route changes.
For users comparing client options or setup paths, the X1VPN VPN for China page provides the service context; the troubleshooting steps here remain useful for identifying a local network or device issue. When asking for help, include your operating system, client name, active mode, whether the internet works with the VPN disconnected, and which checks you have already tried. Remove account credentials, subscription links, private keys, and other sensitive configuration details before sharing logs or screenshots.
Interpret the results and choose the next step
If the device cannot browse with the VPN disconnected, troubleshoot the local network first. If browsing works without the VPN and fails across several apps immediately after connection, concentrate on route reachability, client mode, DNS, or a conflicting proxy. If only one app fails, inspect its individual proxy, DNS, and permission settings, and test whether its rules send traffic through the intended route.
If one route fails but another works on the same device and network, keep the working route for the moment and report the unavailable route through the service’s support channel. If every route fails only on one Wi-Fi network but works on mobile data, the difference points toward the network environment; do not try to evade a workplace, school, or public-network policy. If the problem began after an app or operating-system update, mention that timing and check the relevant release guidance.
Stop before making broad changes such as disabling the firewall, removing all network profiles, or resetting the entire device. Those actions can remove protections or erase settings that are difficult to recreate. If the issue remains after the checks above, share a concise description with support: device and operating-system version, client and mode, whether non-VPN browsing works, the route-selection result, and the error shown by the affected app. Never include a password, private key, or complete subscription URL in a public post.