Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →When OpenVPN reports Connected but websites will not load, the encrypted handshake has succeeded; usable Internet access has not. Web traffic still needs a correct client route, a server that forwards and NATs (or proxies) the VPN subnet, working DNS, and firewall rules that allow return traffic. Start by deciding whether you want a full-tunnel VPN or split tunneling, then test routing, raw IP connectivity, DNS, and server egress in that order.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
Do not reinstall OpenVPN or change several settings at once. The sequence below identifies whether the break is on the client, in name resolution, or on the VPN server.
As an Amazon Associate I earn from qualifying purchases.
What “connected” actually proves
OpenVPN can authenticate your profile, negotiate encryption, and assign a tunnel address while ordinary Internet traffic remains unusable. A successful handshake proves that the client reached the server and that the tunnel interface came up. It does not prove that:
- the client installed the routes you intended;
- the server is forwarding packets between the VPN subnet and the Internet;
- NAT or the server’s documented HTTP-proxy path is configured;
- return traffic is permitted by the server firewall;
- the DNS server supplied to the client is reachable through the tunnel; or
- a local kill switch, DNS policy, IPv6 setting, or MTU rule is not discarding traffic.
OpenVPN’s routing documentation states: “The server must be configured to deal with this traffic by NATing it to the internet or routing it through the server site’s HTTP proxy.” Read the official routing guidance.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
That is why a client may reach a home file server through the tunnel yet fail to open a public website. Private-network routing and Internet egress are separate functions.
Choose full tunnel or split tunnel before changing anything
Your troubleshooting target depends on the intended tunnel scope. A full tunnel sends normal web traffic through the VPN. A split tunnel sends only selected private-network ranges through it and leaves ordinary Internet traffic on the local connection. A profile that is correct for one goal can look broken when judged against the other.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Decision point | Full tunnel | Split tunnel |
|---|---|---|
| Traffic scope | Default Internet traffic uses the VPN. | Only pushed or manually added private routes use the VPN. |
| Client route | Usually includes redirect-gateway and a protected route to the VPN endpoint. |
Does not replace the local default route; required private routes must be present. |
| Server responsibility | Forwarding, NAT or the documented proxy path, and return-firewall rules are required. | Server must route the selected private networks; local Internet egress normally remains unchanged. |
| DNS path | DNS may be sent through the tunnel and must be reachable there. | DNS can remain local, or selected internal names can use a tunnel-reachable resolver. |
| Typical symptom when misconfigured | All browsing stops after connection, often because the server cannot provide egress. | Private hosts are unreachable, or an unexpected pushed default route sends traffic into a black hole. |
If a server unexpectedly pushes a full-tunnel route while you want split tunneling, remove that server-side push or use a client profile designed for split routing. Do not try to “fix” a deliberate full tunnel by randomly deleting routes; first establish which behavior the administrator intended.
Follow this repair sequence
1. Establish a baseline with the tunnel off
Disconnect OpenVPN and confirm that the same device can browse normally over Wi-Fi or Ethernet. Test a few unrelated sites and, if possible, another device on the same connection. If Internet access is also broken while OpenVPN is disconnected, repair the underlying network, captive portal, modem, or local firewall first. A VPN profile cannot restore a connection that is already down.
Record whether the failure affects every application or only browsers. A single browser can have its own proxy, secure-DNS, or extension policy; system-wide failures point more strongly to routing, DNS, or firewall state.
2. Record the state before and after connecting
With the tunnel disconnected, note the default gateway, active network interface, DNS servers, and route table. Connect OpenVPN, wait for the “Connected” state, and record the same information again. On Windows, route print shows IPv4 and IPv6 routes; on macOS or Linux, netstat -rn or ip route shows the active table. Use the platform’s equivalent if those commands are unavailable.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
Also note the VPN interface name and assigned tunnel address from the OpenVPN log or client status screen. You are looking for a changed default route, a route to the VPN endpoint that still uses the physical interface, and any private-network routes supplied by the profile. Save the output before making changes so you can compare it later.
3. Inspect redirect-gateway and route-nopull
redirect-gateway changes the default route so ordinary traffic uses the VPN gateway. OpenVPN first creates a protected route to the VPN endpoint through the original gateway, removes or supersedes the old default route, and installs the VPN gateway as the new default. This prevents the tunnel from disconnecting itself, but it also means every Internet packet now depends on server-side forwarding and NAT or proxying.
If the profile should be split tunnel, check whether the server is pushing redirect-gateway. Remove that push under the server administrator’s control, or use a profile that requests only the required private routes.
route-nopull blocks pushed routes and DNS options. It can be useful when you must prevent an unwanted full tunnel, but it transfers responsibility to you: you must add every required private route and configure the appropriate resolver settings yourself. A profile that uses route-nopull without replacement routes can connect successfully while making internal resources unreachable.
Recommended Free Tools
4. Separate raw IP connectivity from DNS
Test a known, trusted public IP address first, then test a hostname. Do this while connected and again with the VPN disconnected. A reachable IP combined with hostname failures is a DNS problem, not proof that the tunnel has no Internet.
Check which DNS servers the profile pushed, whether those addresses are reachable through the tunnel, and whether the VPN server has a route to them. An internal resolver may answer private names but be unable to reach public DNS, while a local resolver may be intentionally blocked by a full-tunnel policy. Flush the client’s DNS cache only after confirming the resolver path; cache clearing cannot repair a missing route or a server firewall rule.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
If both IP and hostname tests fail, inspect the route and server egress next. If only hostnames fail, leave NAT troubleshooting aside until the DNS path is corrected.
5. Verify full-tunnel server egress
For a full tunnel, the server must accept traffic from the VPN client subnet, enable IP forwarding, and provide Internet egress through NAT or the documented HTTP-proxy route. The upstream interface must be able to reach the Internet, and the server firewall must allow forwarding in both directions. Return packets need an established path back to the VPN client; permitting only outbound packets is not enough.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThis is a server-side task. A client user can prove the symptom with route tables, IP tests, and logs, but cannot create NAT on a server they do not administer. Ask the administrator to verify:
- the VPN address pool and the source subnet used for client traffic;
- forwarding between the tunnel interface and the Internet-facing interface;
- NAT (masquerading) for that source subnet, or the supported proxy configuration;
- firewall policies in both directions, including established and related return traffic;
- an upstream route for the VPN subnet if NAT is intentionally not used; and
- that the DNS resolver offered to clients is reachable from the VPN network.
A missing NAT rule commonly produces the exact pattern “connected, private resources work, public websites time out.” The tunnel is functioning; packets simply have no valid Internet egress or return route.
6. Check client firewall, kill-switch, and DNS policies
Endpoint security software can intentionally block traffic outside the VPN. Review any kill switch or “block outside DNS” policy and confirm that its rules match your intended tunnel scope. A kill switch configured for full-tunnel protection may block all traffic when the VPN gateway or DNS server is unavailable, which can look like a general Internet outage.
On Windows profiles, block-outside-dns can force DNS queries to remain inside the tunnel. That is useful when the VPN supplies a reachable resolver, but it can stop name resolution if the tunnel DNS address is wrong or inaccessible. Custom DNS directives can have the same effect on other platforms.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
Temporarily disable only one local security rule at a time, reconnect, and retest. If the change restores access, recreate a narrower rule rather than leaving protection disabled. Record the original setting so it can be restored after diagnosis.
7. Treat IPv6 and MTU as separate checks
A profile may route IPv4 through the tunnel while the operating system continues to prefer an IPv6 path that the VPN does not carry. If some sites load and others hang, or IPv6-capable services fail while IPv4 tests work, compare IPv4 and IPv6 behavior and check whether the profile provides an IPv6 route. Do not assume that disabling IPv6 is a universal fix; coordinate the setting with the network administrator and your local network policy.
MTU-related options can also cause partial connectivity. Oversized packets may be dropped even though small pings or a handshake succeed. Review MTU or fragmentation options supplied by the profile, change one value under administrator guidance, reconnect, and retest the same IP and hostname. Avoid stacking multiple MTU changes because that hides which adjustment mattered.
8. Reconnect after each single change
OpenVPN installs routes, DNS options, and firewall state at connection time. After changing a profile directive, pushed option, local firewall rule, or resolver, disconnect and reconnect before testing. Keep a short log of the change, the exact time, the route table, and the IP-versus-hostname result. This prevents a later successful test from being attributed to the wrong setting.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to interpret the most common symptoms
| Observed result | Most likely area | Next check |
|---|---|---|
| VPN connects; no public IP or hostname works; private hosts may work. | Missing server forwarding, NAT/proxy, or return firewall rule. | Have the server administrator inspect forwarding and egress for the VPN client subnet. |
| Public IP works; hostnames fail. | DNS server, DNS route, or client DNS policy. | Check the resolver pushed by the profile and its reachability through the tunnel. |
| Only private hosts fail; ordinary Internet remains normal. | Missing private route, unwanted route-nopull, or incorrect split-tunnel settings. |
Compare pushed routes with the networks you actually need. |
| Everything fails only while connected, including the VPN endpoint after a profile edit. | Incorrect default route, protected endpoint route, kill switch, or firewall rule. | Compare pre- and post-connection route tables and restore the last known-good profile. |
| Some sites work, large pages stall, or behavior changes with IPv6. | MTU or IPv6 path mismatch. | Test each address family and review the profile’s MTU and IPv6 options. |
| Internet fails even after disconnecting. | Underlying Wi-Fi, Ethernet, gateway, or captive portal. | Repair the local connection before troubleshooting OpenVPN. |
Client and server responsibilities
Many troubleshooting attempts fail because the wrong person changes the wrong layer. Use this division of responsibility:
| Layer | What to verify | Who normally controls it |
|---|---|---|
| Profile and client routes | redirect-gateway, route-nopull, private routes, tunnel address, protected VPN-endpoint route. |
Client user or VPN profile administrator. |
| Client DNS | Pushed resolver, custom DNS directives, block-outside-dns, cache, and reachability. |
Client user plus VPN administrator. |
| Server forwarding | IP forwarding between the tunnel and Internet interfaces. | VPN server administrator. |
| Server egress | NAT or supported HTTP proxy, upstream route, and return traffic. | VPN server and network administrator. |
| Endpoint policy | Kill switch, host firewall, security suite, IPv6 policy, and MTU behavior. | Device administrator or security team. |
If you do not control the server, provide evidence rather than editing server directives yourself. If you do control it, test from a client while watching the server’s tunnel and Internet-facing interfaces so you can see whether packets arrive, leave, and return.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
What to send when you escalate
Support can resolve this faster when the report distinguishes negotiation from forwarding. Include:
- the OpenVPN client log covering one complete connection attempt;
- the corresponding server log, if you administer the server or can request it;
- the assigned tunnel address and VPN interface name;
- route tables from immediately before and after connection;
- DNS servers and relevant client DNS-policy settings;
- the result of a known-IP test and a hostname test, with timestamps;
- whether private VPN resources are reachable;
- whether the same Internet connection works with OpenVPN disconnected; and
- the exact profile options changed, including
redirect-gateway,route-nopull, DNS directives, IPv6 settings, and MTU-related options.
Redact private keys, passwords, authentication tokens, and sensitive internal addresses before sharing logs. OpenVPN Support specifically recommends providing client and server logs when the problem cannot be resolved; those logs show whether the failure occurs during connection setup, route installation, DNS configuration, or packet forwarding.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Safe recovery paths
When a full tunnel was enabled accidentally
Disconnect, restore the last known-good profile, and remove the unexpected pushed redirect-gateway under administrator control. Reconnect and confirm that the local default route is back before adding only the private routes required for split tunneling.
When full tunneling is required but the server has no egress
Keep the client profile unchanged and have the server administrator implement forwarding, NAT or the documented proxy path, and return-firewall rules for the VPN subnet. Switching clients or repeatedly reinstalling the application will not create those server functions.
When DNS alone is broken
Leave routing intact, correct the resolver address or its tunnel route, and then reconnect so the profile can apply the DNS settings cleanly. Verify an IP and a hostname separately after the change.
When a local kill switch is responsible
Use the security product’s documented test mode or temporarily narrow the rule under controlled conditions. Re-enable protection immediately after confirming the cause, then configure the rule for the chosen full- or split-tunnel design.
Quick Recap
Key points to remember
- “Connected” confirms tunnel negotiation, not usable Internet forwarding.
redirect-gatewayreplaces the normal default path and can black-hole traffic when server NAT or forwarding is absent.- Testing a raw IP separately from a hostname distinguishes DNS failure from routing failure.
- Full-tunnel Internet requires server egress, NAT or proxying, and return firewall rules.
- Split tunneling and full tunneling are different designs; select one before changing routes or DNS.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
