VPN and proxy problems

A VPN is not a transparent tunnel. It replaces four things at once - Your apparent address, your route, your DNS resolver and frequently your effective packet size - And each of those replacements breaks a different category of website.

Which is why the single most useful troubleshooting step for anyone using one is also the simplest: Turn it off for one request.

Blocked exit addresses

The biggest category. Commercial VPN exit nodes are shared by thousands of people and carry an extremely mixed traffic profile. Services that care about abuse block them, and you inherit the reputation of everyone else on that address.

The symptoms:

• 403 Forbidden on sites that work fine otherwise.
• Endless captchas that never accept a correct answer.
• "Unusual traffic from your network" interstitials.
• Banks refusing to log you in, or demanding extra verification.
• Streaming services showing a proxy detection message.

Banks and payment services are the strictest, and reasonably so: A login from an address in a different country to your usual one is exactly what account takeover looks like. Payment platforms in particular will often let you browse and then fail at the transaction.

Switching to a different server sometimes helps, because you land on a different address that may not be listed. Residential-IP services avoid the problem almost entirely and are considerably more expensive for that exact reason.

DNS problems

VPN clients usually push their own resolver. When that works it is good for privacy; when it does not, you get name resolution failures across the board while the tunnel itself is perfectly healthy.

Two distinct failures. A DNS leak means queries are still going to your ISP outside the tunnel - A privacy problem rather than a connectivity one. A broken tunnel resolver means the VPN's DNS server is unreachable or misconfigured, and nothing resolves.

Testing is the same as always: If https://1.1.1.1 loads while names do not, DNS is the problem. The DNS guide applies, with the extra option of configuring the VPN client to use a public resolver instead of its own.

MTU and the half-loading page

The most distinctive failure a VPN produces, and the one people misdiagnose most often.

A VPN wraps your traffic in an outer packet, which means less room inside for your actual data. If the effective maximum packet size is not negotiated correctly, large packets are dropped silently and small ones get through.

The result is unmistakable once you know it: Small pages load instantly, large pages stall halfway, file downloads die at the same point every attempt, and SSH sessions freeze the moment output gets long. Nothing errors - It just stops.

Speed

A VPN costs some throughput unavoidably - Encryption overhead, a longer path, and the capacity of the exit server. A modest loss is normal.

A large loss usually means one of three things: An exit server that is overloaded, a geographically absurd route (connecting to Singapore to reach a site two miles away), or an older protocol. WireGuard is materially faster than OpenVPN on most hardware, and if your provider offers it, switching is the single biggest speed improvement available.

Corporate VPNs and split tunnelling

Company VPNs add problems consumer ones do not have.

Full tunnelling sends all your traffic through the company network, so every site you visit is subject to their filtering and their bandwidth. Split tunnelling sends only company traffic through, which is faster but sometimes disallowed by policy.

TLS inspection is the one that breaks things: The company decrypts and re-encrypts your HTTPS traffic to inspect it, using a root certificate installed on your managed device. Sites using certificate pinning refuse to work through it at all, and that is by design rather than a fault.

Corporate DNS also typically resolves internal names and may block a great deal of the public internet. If a site works on your phone and not on your work laptop, this is usually why, and it is not something you can fix.

Diagnosing in order

1. Disconnect the VPN and retry. Works? The VPN is the cause. Continue below.
2. Try a different server. Fixes it? A blocked exit address.
3. Try a different country. Fixes it? Geographic blocking, either of your exit country or of the VPN generally.
4. Small pages fine, large ones stall? MTU. Lower it.
5. Nothing resolves? DNS. Switch to a public resolver in the client.
6. Only HTTPS fails? TLS interception, or a client that needs updating.

The killswitch

Worth knowing about because it causes a specific confusion. A killswitch blocks all traffic when the tunnel drops, so that nothing leaks outside it. When it activates, your internet appears to be completely dead - And the VPN client may not say so prominently.

If everything stops working at once and you use a VPN, check whether the tunnel has dropped before you start diagnosing your router. This is a surprisingly common ten-minute detour.