OpenVPN showing Connected proves that authentication and tunnel negotiation succeeded; it does not prove that web traffic can leave the VPN server. Internet access also requires the right client routes, working DNS, server forwarding and NAT (or a proxy), and firewall rules that allow return traffic. Decide whether you want a full tunnel or split tunnel, then test in this order: compare the connection with the VPN off, inspect routes, test an IP address separately from a hostname, and verify the server’s egress configuration.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
What “connected” actually proves
During a successful OpenVPN connection, the client authenticates, negotiates encryption, creates a virtual tunnel interface, and receives an address on the VPN network. The status message describes that control-plane exchange. It does not confirm that packets destined for the public internet are being routed beyond the server.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →A browser request has several independent stages:
- The client chooses a route for the destination.
- The packet enters the encrypted tunnel.
- The VPN server forwards it toward an upstream network.
- Network address translation (NAT), or an HTTP proxy, gives the packet a usable path back to the internet.
- Firewall policy permits the outbound packet and its return traffic.
- DNS, if a hostname was used, resolves through a reachable resolver.
Failure at any one stage can leave the OpenVPN status green while websites time out. OpenVPN’s routing documentation states that a server carrying clients’ web traffic must either NAT that traffic to the internet or route it through the server site’s HTTP proxy: OpenVPN community routing documentation.
First choose: full tunnel or split tunnel
Do not change settings until you know which behavior you want. The two designs intentionally send different traffic through the VPN.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
| Design | Traffic sent through VPN | Server requirements | Typical reason |
|---|---|---|---|
| Full tunnel | Ordinary web traffic and private-network traffic | Forwarding, NAT or a documented proxy path, and return-firewall rules | Use the VPN for all internet access, policy enforcement, or a trusted egress location |
| Split tunnel | Only the private subnets and services listed by the profile | Routes to those private networks; public internet remains on the normal connection | Reach a home or office network without moving general browsing through it |
A profile using redirect-gateway requests full-tunnel behavior. A profile that pushes only private routes is split tunnel. If a server unexpectedly pushes redirect-gateway, the client may appear to lose internet access because all traffic is now sent to a server that was never configured as an internet gateway.
Run a quick triage before changing the profile
- Disconnect OpenVPN and test the same device. Open a few sites or run your normal connectivity check. If internet access is also broken with the VPN off, repair Wi-Fi, Ethernet, captive-portal login, or the upstream router first.
- Reconnect and record the exact symptom. Note whether every site fails, only names fail, private resources work, or traffic is merely slow. A working internal application is evidence that the tunnel itself is usable, not that public egress is configured.
- Test one known IP address and one hostname. Use an IP belonging to a service you are authorized to test, then access that service by name. Do not rely on a browser error alone.
- Capture state before and after connection. Save the route table, DNS configuration, assigned tunnel address, and OpenVPN client log while disconnected and connected. The differences usually identify the failing layer.
- Change one setting at a time. Reconnect after each route, DNS, firewall, or MTU change so that a successful result has a clear cause.
Inspect the route table and the effect of redirect-gateway
When full tunneling is requested, OpenVPN protects the VPN server’s own endpoint with a more-specific route, removes or supersedes the previous default route, and installs the VPN gateway as the new default. Without the protected endpoint route, the tunnel can deadlock; without a functioning server gateway, ordinary traffic can be black-holed.
Recommended Free Tools
Windows
Open a Command Prompt and save the route table before and after connecting:
route printIn PowerShell, the same information can be filtered to active routes:
Get-NetRoute -AddressFamily IPv4 | Sort-Object DestinationPrefix,RouteMetricLook for a new default route (0.0.0.0/0) through the OpenVPN adapter and a specific route to the VPN server’s public address through your ordinary gateway. If the default route points at the tunnel but the server cannot forward traffic, every website will fail until you disconnect.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
Linux
ip routeCheck the line beginning default, the route to the VPN endpoint, and routes for private subnets. ip rule and ip route show table all are useful when policy routing is in use.
macOS
netstat -rn
route -n get defaultConfirm which interface owns the default route and whether a host route keeps the VPN endpoint reachable through the physical interface.
When you need split tunneling
route-nopull prevents pushed routes and DNS options from being applied. That can stop an unwanted full-tunnel redirect, but it also means you must add every required private route and resolver setting yourself. A profile with route-nopull can therefore connect successfully while providing no path to the network you actually need. Add only the documented private routes, then verify them in the operating system’s route table.
Separate DNS failure from an internet-routing failure
Browsers usually display “no internet” for both DNS errors and unreachable networks. Test the two cases independently:
- If an authorized, known IP responds but its hostname does not resolve, the route is probably usable and DNS is the immediate problem.
- If both the IP and hostname fail, investigate the default route, server forwarding/NAT, firewall, or MTU before changing DNS.
Windows tests
nslookup example.internal
ipconfig /allUse a hostname that your organization expects to resolve; replace example.internal with that name. In ipconfig /all, identify the DNS servers assigned to the active adapter and the OpenVPN adapter. If the profile pushes a private resolver, it must be reachable through the tunnel and the VPN server must have a route to it.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
Linux and macOS tests
dig example.internal
cat /etc/resolv.confSystems using a local resolver manager may not show the effective servers in /etc/resolv.conf; inspect the resolver manager’s active configuration as well. A successful lookup against the resolver’s address is more useful than simply seeing a DNS server listed.
Common DNS-specific blockers
- Unreachable pushed resolver: The server advertises a DNS address that is not routed over the tunnel.
block-outside-dns: On Windows, this option can deliberately prevent DNS queries from leaving through the non-VPN interface. If the VPN DNS path is broken, name resolution appears completely dead.- Custom DNS directives: A locally forced resolver can override the profile or send queries to a network that is inaccessible after the route changes.
- IPv6 mismatch: IPv6 addresses may remain preferred while only IPv4 is routed through the VPN. Test both families and either provide an intentional IPv6 path or apply the organization’s documented IPv6 policy.
Reconnect after correcting DNS settings. Do not treat changing to an arbitrary public resolver as a universal fix: private names still require the organization’s resolver, and a resolver change cannot repair missing server NAT.
Verify server-side forwarding and NAT for a full tunnel
If your goal is full tunneling and the client’s default route is correct, the decisive checks are on the VPN server and its upstream firewall. The VPN server must accept packets from the client subnet, forward them to its internet-facing interface, translate the source address when required, and allow return traffic back to the tunnel.
Forwarding
Enable IP forwarding according to the server operating system and your organization’s security policy. Verify that forwarding remains enabled after a reboot. A disabled forwarding setting lets the server receive tunnel packets but prevents them from crossing between interfaces.
NAT or proxy egress
The upstream network normally knows nothing about the private addresses assigned to VPN clients. Add a source-NAT/masquerade rule for the VPN client subnet on the server’s internet-facing interface, or use the documented HTTP-proxy design. The exact interface name, client subnet, and firewall syntax depend on the server platform; use the values in the OpenVPN profile and the server’s network configuration rather than copying an example unchanged.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
Firewall and return traffic
Permit forwarding in both directions for the VPN client subnet and the intended outbound interface. Stateful firewalls must allow established return packets. Also check upstream security groups, cloud network ACLs, and the physical router: a host firewall rule can be correct while an upstream policy still drops forwarded traffic.
| Observed result | Most likely layer | Next check |
|---|---|---|
| Private VPN resources work; public IP tests fail | Server egress | Forwarding, NAT/proxy, and return-firewall rules |
| Public IP works; hostnames fail | DNS path | Pushed resolver, route to resolver, and DNS blocking options |
| Nothing works, including private resources | Client route, tunnel address, or firewall | Route table, adapter state, and client/server logs |
| Only IPv6 destinations fail | IPv6 policy | Whether IPv6 is intentionally tunneled, excluded, or blocked |
| Traffic starts then stalls | MTU or fragmentation | Profile MTU settings and path testing |
Check local firewall, kill-switch, and endpoint policies
A kill-switch is designed to block non-VPN traffic when the tunnel is absent or not yet trusted. If its rules are too broad, it can continue blocking traffic after connection or reject the OpenVPN adapter’s traffic. Temporarily test with the organization-approved firewall profile, not by permanently disabling protection.
- Review rules that reference the physical interface, the OpenVPN adapter, or the tunnel subnet.
- Check whether the profile is allowed to create routes and set DNS.
- Look for endpoint-security policies that block forwarding, unknown virtual adapters, or UDP/TCP ports used by the profile.
- After changing a rule, reconnect and confirm that the rule applies to the correct network profile.
If a managed computer receives policy from an administrator, collect the policy name and timestamp rather than repeatedly overriding it. The administrator may need to permit the tunnel interface or correct the centralized kill-switch configuration.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Investigate MTU and fragmentation when connections partly work
MTU problems often produce a distinctive pattern: DNS may succeed, small pages may open, and larger HTTPS responses or downloads may hang. Encryption adds overhead, reducing the largest packet that can traverse the path without fragmentation.
- Compare a small request with a larger page or download.
- Check whether the profile specifies a tunnel MTU, link-mtu, or related fragmentation option.
- Test from the client using the operating system’s packet-size and “do not fragment” controls, reducing the payload until it passes consistently.
- Apply the value prescribed by the VPN administrator or hosting network; do not guess a permanent MTU from a single path test.
MTU tuning cannot substitute for a missing default route or NAT rule. Resolve basic routing and forwarding first.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Use a platform-specific recovery sequence
Windows client
- Disconnect the profile and verify normal browsing.
- Run
route printandipconfig /all, then connect and run them again. - Check the OpenVPN adapter’s address, the new default route, the protected route to the VPN endpoint, and DNS servers.
- Review
block-outside-dns, kill-switch rules, and Windows Firewall entries associated with the VPN adapter. - Test an authorized IP address, then
nslookupfor the corresponding hostname. - If split tunneling is intended, remove the unwanted pushed redirect through the server configuration or use
route-nopullonly with manually defined routes and DNS.
Linux client
- Save
ip addr,ip route, resolver status, and the OpenVPN log while disconnected. - Reconnect and compare the default route, endpoint route, tunnel address, and private-network routes.
- Use
digagainst the expected resolver and test an authorized IP independently. - Inspect host firewall forwarding rules and policy-routing tables if the route looks correct but packets do not leave.
- Ask the server administrator to verify forwarding, NAT, and return rules for the client subnet.
macOS client
- Record
netstat -rnandroute -n get defaultbefore and after connection. - Confirm that the VPN endpoint remains reachable through the physical gateway while the default route moves to the tunnel.
- Check the active DNS configuration and test a name with
dig. - Review macOS firewall, content-filter, and security software rules affecting the VPN interface.
- Use the same IP-versus-hostname and server-egress tests as on other platforms.
Interpret common combinations of symptoms
“I can reach my home or office network, but not websites”
The tunnel and private routes are functioning. If the profile is meant to be full tunnel, the server probably lacks forwarding, NAT/proxy egress, or a return-firewall rule. If it is meant to be split tunnel, this is expected behavior: keep the local default route and use only the private routes.
“The VPN connects, then all internet access disappears”
Check whether redirect-gateway replaced the normal default route. If so, confirm that the server is configured as an internet gateway. A kill-switch can produce the same symptom if it blocks the new tunnel interface.
Free tools Windows power users keep installed
One-click scans. No signup required.
“IP addresses work but every website name fails”
Focus on DNS rather than NAT. Verify the resolver pushed by the profile, its route through the tunnel, block-outside-dns, custom DNS settings, and IPv4/IPv6 selection.
“Only large sites or downloads hang”
After confirming routes and DNS, investigate MTU and fragmentation. A path that carries small packets can still discard larger encrypted packets.
“It fails only on one Wi-Fi network”
Compare the network’s firewall, captive portal, DNS interception, and permitted VPN transport with a network where the profile works. Do not modify server NAT until you establish whether the failure follows the client or the access network.
Collect evidence before escalating
When the basic checks do not isolate the fault, send a reproducible evidence bundle to the VPN administrator. OpenVPN Support recommends providing client and server logs when the issue cannot be resolved.
- OpenVPN client log covering one failed connection attempt, with passwords, private keys, and tokens removed.
- Relevant server log for the same timestamp and client session.
- Operating system and OpenVPN client version, connection protocol, and whether the device is managed.
- Assigned tunnel address and VPN client subnet, if your administrator permits sharing them.
- Route tables before and after connection.
- Effective DNS configuration before and after connection.
- Results of an authorized IP test versus the matching hostname test.
- Whether private resources work, whether the VPN-off connection works, and which network you were using.
- Any firewall, kill-switch, IPv6, or MTU change already tested and its exact result.
Include timestamps and the profile name so the administrator can match client and server events. Redact credentials and keys, but do not remove the route, DNS, forwarding, or error lines needed to diagnose the failure.
Quick Recap
What not to do
- Do not assume the word “Connected” means internet forwarding is operational.
- Do not switch providers to fix a self-hosted server that has no NAT, forwarding, or DNS route; a different client cannot repair that server configuration.
- Do not leave a kill-switch or firewall disabled as a permanent workaround.
- Do not use
route-nopullwithout adding the private routes and DNS settings your application requires. - Do not publish client or server logs containing private keys, passwords, access tokens, or personally identifying data.
A concise decision path
- VPN off fails too: repair the underlying connection.
- VPN off works; private routes fail: inspect tunnel address, pushed routes, and client firewall.
- Private routes work; public IP fails: verify full-tunnel intent, server forwarding, NAT/proxy, and return rules.
- Public IP works; hostname fails: repair the DNS path and resolver reachability.
- Only large transfers fail: investigate MTU after the preceding checks.
- No clear cause: provide synchronized client/server logs, routes, DNS state, and test results to the administrator.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
