In short: if your VPN works fine on mobile data but won't connect over Wi-Fi, the problem is almost always the network itself, not the app. The usual culprits are an unfinished login on a public network (captive portal), port filtering on the router, a bad DNS, a packet size (MTU) that's too large, or an IPv6 conflict. Start simple: switch the protocol and port in the app, set DNS to 1.1.1.1, reboot the router and forget the network — in most cases that brings the connection back within a couple of minutes.
Why does the VPN fail on Wi-Fi but work on mobile data?
If the VPN comes up on mobile data and only fails on Wi-Fi, the source of the problem is that specific Wi-Fi network, not the app or your account. That's the key diagnostic sign: the app, login, server and subscription are fine, otherwise the connection would fail everywhere. So something in this network is stopping VPN traffic from getting out or reaching the server.
Comparing the two channels narrows the search immediately. A mobile carrier usually gives you transparent internet access, while a router and Wi-Fi network can add their own filters, logins and routing quirks. The reverse case — when the VPN fails specifically on cellular — is covered in a separate guide on VPN on mobile internet; here we focus on Wi-Fi.
| Symptom | Likely problem area |
|---|---|
| Works on 4G/5G, fails on Wi-Fi | The specific network: router, portal, DNS, MTU |
| Fails everywhere | The app, account, chosen server or protocol |
| Works on home Wi-Fi, fails on guest Wi-Fi | Port filtering or a captive portal on the other network |
Quick 5-minute diagnosis
Before changing settings, spend five minutes checking step by step — the connection often returns midway through the list. The point is to rule out the most common causes one at a time: network login, protocol, DNS and stuck phone settings.
- Open any site without the VPN. If Wi-Fi doesn't work even without the VPN, the problem is the network or its login, not the app.
- Switch the protocol and port. In the app, move from one protocol to another (for example WireGuard or IKEv2) — many networks pass some ports and block others.
- Set a public DNS. Enter 1.1.1.1 or 8.8.8.8 in the Wi-Fi settings — this fixes cases where server names don't resolve.
- Reboot the router and phone. Power the router off for 30 seconds; restart the phone to clear a stuck network state.
- Forget the network and rejoin. This clears saved Wi-Fi parameters, including a stale DNS and gateway address.
- Reset network settings. If nothing helped, resetting the phone's network settings returns them to factory defaults (Wi-Fi, VPN, cellular).
If the VPN comes back after these steps, you're done. If not, each cause is broken down below so you can tell exactly what's blocking the connection on your network.
Captive portal: the public network wants a login
The most common cause in cafes, hotels and airports is an unfinished captive-portal login. That's the accept-the-terms or enter-your-number page that opens when you join public Wi-Fi. Until you complete it, the network won't let traffic out — and a VPN that immediately tries to build an encrypted tunnel simply can't reach its server.
The fix is simple: first turn the VPN off, open any site in the browser, wait for the login page and complete it, and only then turn the VPN on. If the portal doesn't open on its own, go to http://neverssl.com, which forces the login page to appear. Public networks are risky precisely because traffic is unencrypted before the VPN is on, so don't enter extra data on those pages — how to stay safe is covered in our guide to using VPN on the move.
The router or network blocks VPN ports and the protocol
Some networks — office, guest, hotel — filter non-standard connections and pass only ordinary web traffic. As a result the VPN can't establish a connection on its usual port or protocol, even though websites open. This isn't always deliberate blocking: it's often just how a corporate or guest firewall is configured by default.
The workaround at the settings level is to change the protocol and port in the app. Protocols like WireGuard, IKEv2 and OpenVPN use different ports, and there's almost always one the network will pass; switching from UDP to TCP port 443 helps too, since networks rarely block it because all HTTPS runs over it. How to switch the protocol step by step is shown in our guide on how to change your VPN protocol.
A wrong DNS on the Wi-Fi network
If the VPN connects but sites won't open, DNS is usually to blame. DNS turns site names into IP addresses, and when a Wi-Fi network forces its own broken or filtering DNS server, requests either don't resolve or leak outside the tunnel. It looks like this: the VPN icon is on, but pages hang on "looking up the server."
Set a public DNS in the Wi-Fi settings — 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google). On iPhone it's Settings → Wi-Fi → the i next to the network → Configure DNS → Manual; on Android it's a long press on the network → Modify → Advanced → DNS. A separate issue is a DNS leak, where requests bypass the VPN and expose your provider — worth checking after you change the DNS.
MTU and fragmentation: the connection hangs and drops
If the VPN connects but pages load halfway or drop, the packet size — MTU — may be the reason. A VPN adds overhead to every packet, and if the total size exceeds the Wi-Fi network's limit, packets fragment or get lost. Some sites open while heavy pages and downloads freeze.
The cure is lowering the MTU in the VPN app's settings: a typical value of 1500 should be dropped to 1400 or 1380 and tested for stability. The setting isn't available in every app — then switching the protocol helps, since WireGuard handles fragmentation differently from OpenVPN, and on fussy networks one protocol is often steadier than the other. After the changes, confirm the connection really is working properly.
An IPv6 conflict
Home and ISP networks increasingly hand out IPv6 addresses, and if the VPN only works over IPv4, some traffic can leak around the tunnel or hit a dead end. The symptom is unstable behaviour specifically on one Wi-Fi network where IPv6 is on, while other networks work fine.
If your VPN doesn't fully support IPv6, it's safer to temporarily disable IPv6 for that network or enable IPv6-leak protection in the app if there's such an option. On a home router, IPv6 is turned off in the web panel under the WAN settings. It's not a universal fix for everything, but it's exactly what clears the floating drops on dual-stack networks.
Is it the app or a profile on the phone?
Sometimes the cause really is on the phone side — a stale app, a broken VPN profile or stuck network settings. Check this when the VPN stopped working on all Wi-Fi networks at once, not just one. On iPhone, look in Settings → General → VPN & Device Management and delete old or duplicate configurations; on Android, clear the VPN app's cache and reinstall it from the official store.
The general steps are the same for both systems: update the app to the latest version, fully quit and relaunch it, and if the problem persists, reinstall and sign in again. Only download a VPN from trusted sources so you don't install a fake app.
When the network restricts VPN on the provider side
Sometimes all the settings are correct but the connection still won't come up — then the restriction may be applied at the network or carrier level. In that case the best move is to switch to a protocol and port the network passes, or test the connection on another network to pin down the cause. How network-level VPN restrictions work from a technical standpoint is explained neutrally in our piece on how VPNs get blocked.
It's important to separate technical availability from legality: a service being unreachable on a particular network is about settings and filters, not your rights. Using a VPN as a privacy and data-protection tool remains legal.
How to avoid VPN problems on Wi-Fi
Most Wi-Fi drops are prevented by a reliable service with flexible settings and leak protection turned on. Choose an app where you can change the protocol and port, that has DNS- and IPv6-leak protection and a kill switch that blocks traffic if the tunnel drops, so data doesn't leak into the open network. Then even on a fussy network you'll have something to switch to instead of a single connection option.
LiMP VPN is a data-protection service for iOS and Android billed through a Russian legal entity (OOO LiMP): it encrypts traffic, keeps no connection logs, and lets you pick protocols for different networks. See what it can do on the features page, and plans on the LiMP VPN pricing page. This article is for reference; exact menu items may vary by app version and phone.
Frequently asked questions
Why does the VPN work on mobile data but not on Wi-Fi?
Because the problem is the specific Wi-Fi network, not the app. If the VPN comes up on 4G/5G, your account, server and app are fine. On Wi-Fi the blockers are usually an unfinished login (captive portal), port filtering on the router, a wrong DNS, a large MTU or an IPv6 conflict.
How do I reset network settings on iPhone and Android?
On iPhone: Settings → General → Transfer or Reset iPhone → Reset → Reset Network Settings. On Android: Settings → System → Reset → Reset Wi-Fi, mobile and Bluetooth. The reset removes saved Wi-Fi passwords, so you'll need to re-enter them.
Does changing DNS help when the VPN won't work on Wi-Fi?
Yes, if the VPN connects but sites won't open. A broken DNS forced by the network stops server names from resolving. Set a public DNS — 1.1.1.1 or 8.8.8.8 — in the Wi-Fi settings; it's a common cause when the VPN icon is on but pages hang.
What is MTU and how do I change it?
MTU is the maximum network packet size. A VPN adds overhead, and if the packet exceeds the network's limit it's lost, so pages load halfway. Lower the MTU in the VPN app from 1500 to 1400–1380, or switch the protocol — WireGuard fragments differently from OpenVPN.
Should I disable IPv6 because of the VPN?
If the VPN doesn't support IPv6 and drops specifically on networks that use it, temporarily disabling IPv6 for that network is a working fix. Better still, pick a service with built-in IPv6-leak protection: then you don't need to disable anything and traffic won't leak around the tunnel.