Mohammad Montazeri

Most VPN troubleshooting goes wrong in the same predictable way: three things get changed at once, and whatever happens next, nothing has been learned. The alternative is boring and effective — check one layer at a time, in an order that rules things out, and write down what each layer shows.

One boundary before starting: troubleshooting means finding where a problem lives, not working against anyone's rules. On a network you don't control, or a device your organization manages, the policies in place stay in place. If a managed device is part of the picture, your organization's IT function is part of the troubleshooting — and switching off device security tooling is never a troubleshooting step.

1. Device basics first

Start embarrassingly simple, because this layer resolves more than anyone likes to admit.

  • Restart the VPN client.
  • If that changes nothing, restart the device.
  • Confirm that the operating system and the client are updated. An update that has been pending for weeks is a suspect, not background noise.
  • Note whether anything changed around the time the problem started: an update, a new app, different settings, a different location.

2. Does the internet work without the VPN?

Disconnect the VPN entirely and test ordinary browsing.

If the connection is broken without the VPN, this isn't a VPN problem yet. Solve the underlying connection first, because nothing downstream is testable until this layer works.

If the internet is fine without the VPN and wrong with it, you have genuinely narrowed something down. Write that down.

3. Client state: connected to what, exactly?

Open the client and look, rather than assume.

  • Is it actually connected, or still trying?
  • Is the right profile selected — the current one, not an older entry left over from a previous setup?
  • Disconnect and reconnect once, deliberately, and watch what the client reports.

If multiple profiles have accumulated in the client, that is a finding in itself. Stale entries are a classic source of "it connects, but it behaves strangely."

4. Profile freshness: is this the current profile?

A setup that worked for months and then stopped is often a lifecycle event wearing a disguise. Check your provider's panel: is this profile still the active one, and does its status say what you expect?

If the profile has been replaced, or its situation has changed, the fix is the supported flow, done fresh:

  1. Download the current .ovpn file from the panel.
  2. Open OpenVPN Connect.
  3. Choose Upload File and import the profile.
  4. Save the profile and connect.
  5. Remove the superseded file and the stale client entry.

The panel and the current setup instructions are the source of truth for this layer; an old file or a saved note is not. (With Lisar, the panel is where a profile's current status lives.)

5. DNS behavior: connected, but names don't resolve

Sometimes the connection is up and browsing still fails — pages don't load by name, apps can't find their services. Treat that as a pattern to record rather than something to fight blindly:

  • Reconnect once.
  • Try a different site or app, to confirm it isn't one destination.
  • Capture exactly what fails, and how.

Resist the urge to start changing settings based on advice threads. A precise description of DNS-shaped behavior — connected, but names failing — is one of the most useful things you can hand to official support, and one of the easiest things to destroy by changing configuration mid-diagnosis.

6. The different-network test

This is the single most informative check: try the same device and the same setup on a different network — home versus mobile data, office versus home.

The purpose is diagnostic. You are learning whether the problem follows the device or stays with the network.

  • If it follows the device, the earlier layers deserve another pass.
  • If it stays with one network, that network's own behavior or policies are part of the story. On networks you don't control, the answer is choosing a network that works and noting the finding — not contending with the one that doesn't.

7. Notes that make support fast

If the checklist doesn't resolve the problem, you have still done the valuable part: you can hand official support a real report instead of a description.

Device and OS version:
VPN client and version:
When the problem started:
What changed around that time:
Layers checked, and what each showed:
Networks that behave differently:

Enter fullscreen mode Exit fullscreen mode

Check any screenshot for profile-specific details before sending it, and use official support channels rather than public posts.

A five-minute report of that shape usually beats an hour of description, because it says where the problem isn't — which is most of the diagnosis.

Short FAQ

What's the right order to troubleshoot a VPN problem?
One layer at a time: device basics, the internet without the VPN, client state, profile freshness in the panel, DNS-shaped behavior, and a different-network test — noting what each layer shows before moving on.

My VPN worked for months and suddenly stopped. Where do I start?
With the panel. Long-working setups that stop are often profile-lifecycle events: check whether the profile is still active, and if it has been replaced, download the current .ovpn file and set it up again through the supported flow.

It connects, but pages and apps can't find anything.
Capture that pattern precisely: reconnect once, confirm it isn't a single destination, and describe exactly what fails to official support rather than changing settings based on advice threads.

The VPN fails only on one network. What does that mean?
That the network's own behavior or policies are part of the story. The diagnostic value is knowing the problem stays with the network; the practical answer is using a network that works and including the finding in your support notes.

Should I turn off security tools on my device to test the VPN?
No. Switching off device security tooling is never a troubleshooting step, and on a company-managed device the organization's IT function is part of the troubleshooting.

Closing

The order matters more than any single step. Changing one thing at a time is what turns "the VPN is broken" into a statement precise enough to act on — and the notes taken along the way are the part that survives, whether you resolve it yourself or hand it to someone else.

This article was adapted from the original Lisar documentation with AI-assisted editing and human review. No new testing was performed. Originally published at lisar.io.