VPN not working — find the cause in five minutes

What follows is an order of operations that separates one cause from another in a few minutes. It works with any WireGuard client, not only ours. Where a number depends on the specific service, it is named explicitly.

Quick triage: three questions

Answer three questions and the search narrows to a single section.

Does the tunnel come up at all? If it does, is the received-bytes counter growing? Does the problem follow you to a different network?

Symptom	Likely cause	What to do
Error immediately on connect, "could not establish connection"	UDP isn't reaching the server, or your key was revoked	Switch locations, then refresh the configuration
Says Connected, no internet	DNS or MTU	Set DNS to 1.1.1.1, 8.8.8.8 and MTU to 1280
Error mentions subscription, payment or device limit	Account, not network	Check your subscription and connected devices
Works on Wi-Fi, fails on mobile data	Cellular networks pass UDP less reliably	Lower MTU, allow more time to connect
Works on mobile data, fails on one Wi-Fi	That network doesn't pass the protocol	Test on a third network
Drops a minute after connecting	Battery optimisation or a network change	Exclude the app from battery optimisation
Everything works except one app	Split tunnelling	Check your excluded-apps list

It won't connect at all

The handshake never completes

A handshake is the greeting between client and server. The client sends a packet and waits for a reply. No reply, no connection — and you see something like "could not establish connection to the server".

There are exactly two causes, and one action tells them apart.

UDP traffic isn't reaching the server. WireGuard runs over UDP, and some networks — corporate, guest, a few mobile ones — pass it less reliably than ordinary web traffic. Test by switching to a different network.

The server no longer accepts your key. The key may have been revoked, or the server rebuilt. Test by switching locations: different server, same key.

Switching locations is the fastest check available, because it changes exactly one variable. In the OKNO app it is one tap: the client walks through available servers by itself when a normal connection attempt fails, and stays on the city you picked if you tapped one explicitly. The first attempt gets 12 seconds for the handshake, each retry gets 8, and the whole search is capped at 30 seconds and three attempts. So "network or server" is settled in under half a minute.

That 8-second figure isn't arbitrary. It started at 6, and 6 had to go: on mobile networks it produced false connection failures on links that were working perfectly well.

The configuration is stale

A configuration is the file or profile holding your key, the server address and the settings. It stops working when the server is rebuilt, the key is revoked, or the device is removed from your account.

The tell: it used to work, nothing changed, and it broke on one device out of several. In the app, refreshing the configuration is its own menu item. With a manual setup, download the file again and import it over the old one rather than alongside it — two profiles for the same service conflict exactly as two different VPNs do.

The subscription ended, or you hit the device limit

The most common cause, and the one people spend longest chasing, because it looks like a network fault.

Tell it apart by the error text. "No active subscription", "subscription inactive", "subscription not linked to this account" — that's billing. "Device limit reached (10)" — you have connected more devices than your plan allows; disconnect the spares in your account, since old phones and reinstalled systems quietly hold slots.

None of these is fixed by switching servers. If your client shows one of them, cycling through locations is wasted effort.

A second VPN profile is fighting yours

Mobile systems hand the default route to one tunnel. If your VPN settings hold a second profile — from work, from an old service, from an app you installed and forgot — they compete.

Delete the spare profiles in system VPN settings rather than just switching them off inside their apps. Check your router separately: a VPN running there stacks on top of the one on your phone, and that is its own common case.

It connects, but there's no internet

The tunnel is up, the icon is on, the app says Connected, and pages don't open. This is not "the VPN is broken" — everything up to this point works. The problem is what happens to packets afterwards.

DNS

If the DNS server is unreachable through the tunnel, site names never turn into addresses. The symptom is distinctive: the site opens by IP address but not by name.

Set public DNS servers in your configuration and reconnect. OKNO configurations ship with 1.1.1.1 and 8.8.8.8 by default.

MTU

The most underrated cause, and worth checking earlier than most.

MTU is the largest packet size. If it exceeds what the path allows, large packets are silently dropped. Small ones get through, so the handshake succeeds and the connection looks established — but TLS, which means loading any HTTPS site, stalls.

WireGuard's default is 1420, and on some mobile networks that exceeds the real limit. The fix: set MTU = 1280 in the [Interface] section of your configuration and reconnect. The OKNO Android client does this for you, substituting 1280 for the server's value on every connection.

Works on Wi-Fi, fails on mobile — and the reverse

The difference between networks isn't a fault, it's a diagnostic tool. It tells you immediately where to look.

Only mobile fails. Cellular networks pass UDP less reliably and drop large packets more often. Lower MTU to 1280 and allow the connection more time. If your client exposes a timeout setting, raise it.

Only one particular Wi-Fi fails. That network may not pass the protocol. Test on a third network: if mobile data and your home Wi-Fi are both fine while the café or office isn't, the network is the cause — not your device, not your account.

Nothing works anywhere. Then the network is innocent; go back to the subscription and configuration sections.

It drops a minute after connecting

The tunnel comes up and dies on its own. Two causes cover nearly every case.

Battery optimisation. The system suspends the app in the background. Exclude your VPN app from battery optimisation in system settings.

A network change. Moving from Wi-Fi to mobile data changes your device's address. The client should survive that on its own, but on a weak signal it doesn't always manage in time.

It helps to know how an app decides a tunnel is dead at all. WireGuard holds no connection: if the server stops accepting your key, nothing comes back — the interface stays up, the VPN icon stays on, the app keeps saying Connected. So a dead tunnel is inferred from three signals at once: the handshake hasn't renewed in over 150 seconds, sent bytes are increasing, and received bytes are not. The check runs every 15 seconds, and the verdict has to hold for a full minute so a lift ride doesn't tear down a connection that would have recovered by itself.

The practical takeaway, for any client: a live tunnel is one where the received-bytes counter grows. If it's frozen while sent bytes climb, you are transmitting into nothing, and reconnecting is mandatory.

Everything works except one app

Check split tunnelling — the list of apps that bypass the VPN. One app added by accident looks exactly like a selective failure.

The other possibility is that the service itself blocks data-centre addresses. Banking and streaming apps do this routinely, and switching locations sometimes helps.

It works, but it's slow

Slow is not the same as broken, and it's fixed differently: switch to a geographically closer server, measure your speed without the VPN for comparison, and lower the MTU. If the speed is poor without the VPN too, the tunnel isn't the cause.

Nothing helped: what to collect before contacting support

A good support request saves a day of correspondence. Collect five things:

1. The exact error text — as a screenshot, not a paraphrase.
2. Platform and system version, and the app version.
3. The network: home Wi-Fi, mobile data with the carrier named, public Wi-Fi.
4. What you already tried: switching locations, refreshing the configuration, another network.
5. Whether you tested a second device on the same network — this separates a device problem from an account problem immediately.

The fifth is the one people skip, and it's the most useful.

---

OKNO is a WireGuard VPN: up to 10 devices per subscription, unlimited traffic, 30-day refund. See how it works.