Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
If OpenVPN reports Connected but websites will not open, the encrypted handshake has probably succeeded while traffic forwarding has not. Work out whether you need a full-tunnel or split-tunnel connection, then check the route, test an IP address separately from a hostname, and verify the server’s forwarding, NAT, DNS, and firewall rules. A client-side kill switch, pushed DNS setting, IPv6 path, or MTU mismatch can also stop usable access.
What the Connected status actually proves
OpenVPN can authenticate, negotiate encryption, assign a tunnel address, and display Connected even when ordinary web traffic has nowhere to go. The status confirms tunnel negotiation; it does not prove that packets are being forwarded from the VPN server to the public Internet or that replies can return to your device.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallFor a full-tunnel profile, the server must accept client traffic, forward it toward an Internet connection, translate the private VPN source address with NAT or send the traffic through the documented HTTP-proxy path, and allow the reply traffic back. OpenVPN’s routing documentation states: “The server must be configured to deal with this traffic by NATing it to the internet or routing it through the server site’s HTTP proxy.” See the OpenVPN routing guide.
In a split tunnel, only the private networks listed by the profile use the VPN. Public web traffic deliberately stays on your normal Wi-Fi or Ethernet connection, so a successful connection does not by itself change how the public Internet is reached.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Choose the tunnel behavior before changing settings
Many apparent failures are configuration disagreements: the client expects a full tunnel while the server is configured only for private-network access, or the server pushes a full-tunnel route when the user intended split tunneling.
| Goal | Traffic sent through VPN | What must work | Typical failure to look for |
|---|---|---|---|
| Full tunnel | Private networks and ordinary web traffic | Client default route, server forwarding, NAT or proxying, return firewall rules, and a reachable DNS path | redirect-gateway is active but the server has no Internet egress or NAT |
| Split tunnel | Only routes for selected private networks | Those private routes, plus DNS for internal names if required; the local connection keeps public Internet traffic | A full-tunnel push captures web traffic unexpectedly, or required private routes were suppressed |
Record which result you want. Do not use a workaround that hides the problem: removing all pushed routes may restore web browsing while making the internal service you actually need unreachable.
Run a short triage before editing the profile
- Disconnect OpenVPN and test the normal connection. Open several sites or use your normal network check. If Internet access is also broken with the VPN off, repair the Wi-Fi, Ethernet, captive portal, modem, or upstream connection first.
- Reconnect and note the assigned tunnel address. The client log normally shows the virtual interface and address. An address assignment proves that the tunnel interface came up; it does not prove Internet forwarding.
- Try one known public IP address, then one hostname. Use the same browser or command for both tests where possible. A working IP test with a failing hostname points to DNS. Failure of both points toward routing, forwarding, a firewall, a kill switch, or an upstream outage.
- Test one private resource if the VPN is for remote access. If an internal host works but public sites fail, the tunnel may be correctly split-tunneled and the full-tunnel expectation is the real mismatch.
- Change one setting at a time and reconnect. Keeping a before-and-after note prevents a route, DNS, and firewall change from becoming impossible to diagnose.
Inspect the route and the effect of redirect-gateway
When a profile uses redirect-gateway, OpenVPN protects the route to the VPN endpoint, removes or supersedes the old default route, and installs the VPN gateway as the new default. That is what sends ordinary Internet traffic into the tunnel. If the server does not forward or NAT that traffic, the new default route can black-hole web access even though the encrypted session remains healthy.
Confirm what changed
Capture the route table with the VPN disconnected, then capture it again while connected. Look for a new virtual-interface route, a changed default route, and a specific route that keeps the VPN server’s own public address reachable through the original gateway. The exact display varies by operating system:
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
| Platform | Route check | DNS check |
|---|---|---|
| Windows | Run route print in Command Prompt or inspect the active adapter routes in PowerShell. |
Run ipconfig /all and inspect the DNS servers on the VPN adapter; use nslookup for a hostname test. |
| Linux | Run ip route and compare the default route and VPN interface routes. |
Run resolvectl status when systemd-resolved is in use, or inspect the resolver configuration used by the distribution. |
| macOS | Run netstat -rn and compare the default and VPN-interface routes. |
Run scutil --dns to see which resolvers are active. |
If a server unexpectedly pushes a full-tunnel route and you need split tunneling, remove the server-side push or use a profile designed for split routing. The client option route-nopull blocks pushed routes and DNS options, but it also means you must add every required private route and resolver setting yourself. It is not a universal Internet repair switch.
The OpenVPN Connect FAQ describes full-tunnel behavior this way: all traffic routes through the VPN with a profile that uses redirect-gateway, subject to important exceptions. Those exceptions and platform behavior make the actual route table more reliable than the status label alone.
Separate DNS failure from loss of routing
Browsers normally request a DNS answer before they connect to a site. If the resolver supplied by the VPN profile is unreachable, points to an inaccessible internal server, or is blocked by local policy, every hostname can appear offline while direct IP traffic still works.
Interpret the two tests
- IP succeeds, hostname fails: investigate DNS. Check which resolver the profile pushed, whether the resolver address is reachable through the tunnel, and whether the VPN server has a route to that resolver.
- Both IP and hostname fail: investigate the default route, server forwarding and NAT, firewall return traffic, a kill switch, or an upstream connection.
- Internal names fail but public hostnames work: the tunnel may lack the internal DNS route or the resolver may be available only from the remote network.
- Names work intermittently: check whether different DNS servers are being selected on the physical and VPN adapters, and whether IPv6 queries follow a path that the VPN does not carry.
Do not permanently replace an organization’s resolver with a random public resolver merely to make a test pass. Internal names, split-horizon zones, and access controls may depend on the resolver delivered by the VPN. Make a temporary diagnostic change only if your administrator allows it, then restore the intended resolver configuration.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
Verify server-side Internet egress for a full tunnel
If you administer the VPN server, inspect the path after the client enters the tunnel. A full-tunnel setup needs all of the following:
- IP forwarding enabled. The server must route packets between the VPN virtual interface and its Internet-facing interface.
- NAT or the documented proxy path. Most private VPN client subnets are not publicly routable. The server must translate their source addresses to its Internet address or route them through the HTTP proxy arrangement described in the OpenVPN documentation.
- Forwarding policy in both directions. The firewall must permit client-to-Internet forwarding and established return traffic. Allowing only the outbound packet is insufficient when replies are discarded.
- A usable upstream route and DNS path. The server itself must be able to reach the Internet and the resolver it gives to clients, if it supplies one.
- Correct VPN subnet and interface rules. NAT and firewall rules must match the actual tunnel subnet and interface. A stale rule for an old address pool can leave new clients connected but unable to leave the server.
Test from the server first, then from a connected client. If the server cannot reach the destination, fix its upstream connection. If the server can reach it but the client cannot, compare forwarding counters, NAT translations, and firewall logs while making one client request. A private-network connection working at the same time does not prove that the Internet egress path is configured.
Check client security controls and profile options
Kill switches and endpoint firewalls
A VPN kill switch intentionally blocks traffic outside the tunnel. If the tunnel interface is connected but the rule set does not recognize its routes, the result is a deliberate total block. Temporarily disable the kill switch only for a controlled test, then re-enable it; do not leave a protection rule disabled on an untrusted network.
Review host-firewall rules for the OpenVPN process, the virtual adapter, and return traffic. A rule that permits the encrypted UDP or TCP session but blocks traffic originating from the tunnel adapter can produce a green connection indicator with no usable browsing.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
DNS enforcement
On Windows, block-outside-dns can prevent DNS queries from leaving through the physical adapter. That protects against DNS leaks, but it can also stop resolution if the VPN-provided resolver is unreachable. Confirm that the pushed resolver is reachable before treating the option as the culprit. Custom DNS directives and profile scripts can impose similar restrictions on other platforms.
IPv6 and MTU behavior
A profile may carry IPv4 through the tunnel while the operating system still prefers an IPv6 path that the VPN or remote firewall does not support. As a diagnostic, compare behavior with IPv6 temporarily disabled on the affected adapter, following your organization’s policy. If that changes the result, configure a deliberate IPv6 strategy rather than leaving an accidental leak or permanent disablement.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Encapsulation reduces the payload available in each packet. An MTU mismatch can make small requests work while larger pages, TLS handshakes, or downloads stall. Look for profile options supplied by the VPN administrator for tunnel MTU or fragmentation, and change only the documented value. Reconnect after each adjustment and test more than one site.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Repair split-tunnel and full-tunnel profiles safely
When you need split tunneling
- Remove or stop pushing the full-tunnel
redirect-gatewaydirective at the server or use the administrator’s split-tunnel profile. - Keep explicit routes for every private subnet and service that must traverse the VPN.
- If internal names are required, keep a reachable internal resolver route and the corresponding DNS configuration.
- Verify that public web traffic uses the local gateway while an internal resource uses the VPN interface.
Using route-nopull can be appropriate when you have a complete list of routes and DNS settings to add manually. Without that list, it commonly creates a different failure: the Internet works, but remote services disappear.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
When you need a full tunnel
- Use a profile that intentionally installs
redirect-gateway. - Confirm the server’s VPN subnet, forwarding, NAT or proxy path, and return firewall policy.
- Ensure the DNS server delivered to clients is reachable through the tunnel and can answer the names clients need.
- Test a public IP and a hostname from a connected client, then verify that the route remains present after reconnecting.
Use the symptom to choose the next check
| Observed behavior | Most useful next check | Reason |
|---|---|---|
| Nothing loads, including a known public IP | Compare the default route, kill-switch state, and server forwarding/NAT | The failure is below name resolution |
| Public IP works; websites by name fail | Inspect pushed DNS, resolver reachability, and DNS-blocking options | Name lookup is failing while packet routing works |
| Internal resources work; public sites fail | Check whether a full-tunnel route was added and whether the server has egress | Private routing is functioning but Internet forwarding is not |
| Public sites work; internal resources fail | Check private routes, route-nopull, and internal DNS |
Local Internet routing is intact but required VPN routes are missing |
| Only large pages or downloads stall | Review MTU-related profile settings and test after one controlled change | Packet-size handling can fail after the handshake succeeds |
| Internet fails only while the VPN is connected | Compare route, DNS, firewall, and IPv6 state before and after connection | The connection change introduced the broken path |
Collect evidence before escalating
When you do not control the server, send the administrator a concise before-and-after record instead of repeatedly reconnecting. Include:
- OpenVPN client version and operating system;
- the profile’s intended tunnel scope (full or split);
- the client log covering connection, address assignment, pushed routes, and DNS options;
- the server log for the same connection interval, if available;
- the assigned tunnel address and VPN interface name;
- route-table output with the tunnel disconnected and connected;
- active DNS configuration;
- results of one public-IP test, one hostname test, and one internal-resource test; and
- whether the ordinary Internet connection works again immediately after disconnecting.
OpenVPN Support recommends providing client and server logs when the problem cannot be resolved. Redact credentials, private keys, access tokens, and any sensitive internal hostnames before sharing them. Logs can reveal the exact pushed route or DNS option that a generic “connected” message hides.
Prevent the failure from returning
- Document whether each profile is full tunnel or split tunnel and who controls its server.
- Keep the VPN client, profile, server configuration, and firewall rules versioned together when possible.
- After changing the VPN subnet, Internet interface, DNS server, or firewall policy, test both a private resource and public Internet access.
- Do not copy a full-tunnel profile to a server that has not been configured for forwarding and NAT.
- Do not use
route-nopullwithout a maintained list of required private routes and resolver settings. - Keep a documented recovery path for disabling a bad pushed route or kill-switch rule while you repair the server.
The durable fix is the one that matches the intended tunnel scope: a split tunnel needs correct private routes and DNS, while a full tunnel needs a functioning client default route plus server egress, NAT or proxying, and bidirectional firewall policy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
