Home/Guides/VPN Issues
VPN

VPN Keeps Disconnecting

VPN drops randomly, won't connect, or shows authentication errors? Work through these steps in order — most drops are fixed by step 2 or step 4.

Advertisement · 728×90
🔒

VPN Keeps Disconnecting

VPN drops randomly, won't connect, or shows authentication errors

⚠ Common symptoms

  • VPN connects but drops within seconds or minutes
  • "Authentication failed" or "Credential error" messages
  • VPN shows connected but company resources aren't accessible
  • Works at home but fails on hotel, cafe, or guest Wi-Fi
  • 1

    Confirm your credentials — and which type of VPN you're using

    Sign in via browser instead of the VPN app to rule out an account problem.

    Personal VPN (NordVPN, ExpressVPN, ProtonVPN, etc.): log into your account on the provider's website — expired subscriptions fail exactly like connection errors.

    Company-managed VPN (Cisco AnyConnect, GlobalProtect, Zscaler): sign into your work email or company portal → if that fails too, contact IT or HR self-service before troubleshooting the VPN client.

  • 2

    Switch the VPN tunnel protocol

    Some networks (hotels, airports, corporate guest Wi-Fi) block VPN protocols like PPTP and L2TP. In VPN client settings, switch to one of:
    • IKEv2
    • WireGuard
    • SSL/TLS (TCP port 443) — almost never blocked since it's the standard HTTPS port.

  • 3

    Temporarily disable antivirus and firewall

    Third-party security tools with "network protection" features can kill VPN tunnels. Disable yours → try connecting → if it works, add your VPN executable and virtual adapter as exceptions in the security software settings.

  • 4

    Fix your system clock — time sync is required for authentication

    VPN protocols like IKEv2 and Kerberos need your clock within a few minutes of the server's time. Right-click the clock → Adjust date/time → toggle Set time automatically off → on.

  • 5

    Reinstall the VPN client completely

    Corrupted TAP/TUN drivers or broken config files cause persistent failures. Uninstall the VPN client → restart → download a fresh installer from your company's IT portal or the vendor's site. A clean install replaces the virtual network adapter the VPN depends on.

  • 6

    Connected but can't reach company resources? Check split DNS and routing

    If the VPN shows connected but you can't reach internal servers or shares (e.g. fileserver.company.local), the tunnel is up but DNS requests or the corporate subnet aren't being routed through it. Check your VPN client for a "split DNS" or "DNS leak protection" setting and enable it, or ask IT for your company's internal DNS server IP to add manually. Then confirm the corporate subnet actually has a route through the VPN adapter:

    # Look for the corporate subnet routed via the VPN adapter
    route print
  • 1

    Confirm your credentials — and which type of VPN you're using

    Open Safari and sign in there instead of the VPN app to rule out an account problem.

    Personal VPN (NordVPN, ExpressVPN, ProtonVPN, etc.): log into your account on the provider's website — expired subscriptions fail exactly like connection errors.

    Company-managed VPN: sign into your work webmail or company portal → if that fails too, contact IT or use your company's self-service password reset before troubleshooting the VPN client.

  • 2

    Switch the VPN tunnel protocol

    Some networks (hotels, airports, corporate guest Wi-Fi) block common VPN protocols.

    macOS built-in VPN: System Settings → VPN → edit your connection → change type to IKEv2 if available.

    Third-party clients (Cisco AnyConnect, GlobalProtect, Mullvad): find the protocol option in app settings → switch to SSL/TLS or TCP port 443 — almost never blocked since it's also used for all HTTPS traffic.

  • 3

    Temporarily disable the macOS firewall

    System Settings → Network → Firewall → toggle off temporarily → try the VPN connection. If it works, re-enable the firewall → click Options → add your VPN app to the allowed list with Allow incoming connections.

    Third-party security tools with "network protection" features (Little Snitch, Cisco Secure Endpoint) can also intercept VPN tunnels — add the VPN executable as an exception there too.

  • 4

    Sync your system clock — time drift breaks VPN authentication

    IKEv2 and Kerberos-based VPNs need your Mac's clock within 5 minutes of the server's time. Enable automatic sync: System Settings → General → Date & Time → Set time and date automatically. To force an immediate re-sync, open Terminal and run:

    sudo sntp -sS time.apple.com
  • 5

    Reinstall the VPN client cleanly

    Corrupted config files or broken kernel extensions cause persistent drops. Uninstall the VPN client: drag app to Trash → Finder's ⌘⇧G → check ~/Library/Application Support/ and /Library/LaunchDaemons/ for leftover vendor folders, delete them → empty Trash → restart Mac → download and install a fresh copy from your company's IT portal or the vendor's site.

  • 6

    Connected but can't reach company resources? Check split DNS and routing

    If the VPN shows connected but you can't reach internal servers or shares (e.g. fileserver.company.local), the tunnel is up but DNS requests or the corporate subnet aren't being routed through it. Check your VPN client for a "split DNS" or "DNS leak protection" setting and enable it, or ask IT for your company's internal DNS server IP to add manually. Then confirm the corporate subnet actually has a route through the VPN adapter:

    # Look for the corporate subnet routed via the VPN's utun interface
    netstat -rn
  • 1

    Confirm your credentials are valid

    # Test VPN connectivity manually (OpenVPN example)
    sudo openvpn --config /path/to/your.ovpn --auth-retry interact

    # Check VPN service logs
    journalctl -u NetworkManager -f
  • 2

    Switch the VPN protocol

    # Install WireGuard (faster and less likely to be blocked)
    sudo apt install wireguard -y

    # Or install OpenVPN if not present
    sudo apt install openvpn network-manager-openvpn -y

    # Restart NetworkManager to pick up new plugins
    sudo systemctl restart NetworkManager
  • 3

    Check if a firewall is blocking VPN ports

    # Check UFW (Ubuntu's firewall) status
    sudo ufw status verbose

    # Allow OpenVPN port (UDP 1194)
    sudo ufw allow 1194/udp

    # Allow WireGuard port (UDP 51820)
    sudo ufw allow 51820/udp

    # Check iptables rules
    sudo iptables -L -n | grep -E "1194|51820|443"
  • 4

    Sync your system clock

    # Check current time sync status
    timedatectl status

    # Enable automatic time sync via NTP
    sudo timedatectl set-ntp true

    # Force immediate sync
    sudo systemctl restart systemd-timesyncd
    timedatectl show-timesync
  • 5

    Reinstall the VPN client completely

    # Remove and reinstall OpenVPN + NM plugin
    sudo apt remove --purge openvpn network-manager-openvpn -y
    sudo apt autoremove -y
    sudo apt install openvpn network-manager-openvpn network-manager-openvpn-gnome -y
    sudo systemctl restart NetworkManager
  • 6

    Connected but can't reach company resources? Check split DNS and routing

    If the VPN shows connected but you can't reach internal servers or shares, the tunnel is up but DNS requests or the corporate subnet aren't being routed through it. Check your VPN client for a "split DNS" or "DNS leak protection" setting, or ask IT for your company's internal DNS server IP. Then confirm the corporate subnet actually has a route through the VPN interface:

    # Look for the corporate subnet routed via tun0/wg0
    ip route

    # Check which DNS servers are actually in use
    resolvectl status
💡

Still stuck? Enable VPN logging (usually in Settings → Logs) and share the log file with your IT help desk. The log contains the exact error code, which cuts diagnosis time from hours to minutes.

Advertisement · 728×90
❓

Related Questions

Quick answers for this issue

Common causes include expired credentials, a blocked VPN protocol on the network, antivirus interference, or a system clock that's out of sync. Try switching protocols (IKEv2 or WireGuard), temporarily disabling your firewall, and ensuring your system time is set automatically.
The tunnel is up but your DNS requests aren't being sent through it, so your PC can't resolve internal server names like fileserver.company.local. Check your VPN client settings for a "split DNS" or "DNS leak protection" option. You may also need to manually enter your company's internal DNS server IP in your network adapter settings — ask your IT team for this address.
Both are often caused by the same root issue — clock drift or stale cached credentials — but the fixes are applied in different places. If you're also seeing login failures in Slack, Teams, or a network share, see our Authentication Errors guide, which covers Credential Manager and certificate issues in more depth.
🧑‍💻

VPN still dropping? A technician can read the logs you can't.

Firewall rules, split DNS, and VPN server configuration often need IT-level access to diagnose. Connect with a verified technician for remote support.

Talk to a Technician
Related

VPN trouble often overlaps with these.

🔑

Authentication Errors

Login failures, MFA issues, and clock drift.

Fix it →
🔌

App Not Connecting

Slack, Teams, or Zoom can't reach their servers.

Fix it →
🌐

No Internet / Network Down

A VPN needs a working internet connection first.

Fix it →
Advertisement · 728×90