In short: If your VPN works on Wi-Fi but not on mobile data, the cause is almost always your phone's settings or a quirk of the cellular network, not a broken service. Five things are usually to blame: battery saver kills the VPN app in the background, the app is denied mobile-data access or data saver is on, the carrier hands out IPv6 while the tunnel runs over IPv4, an oversized packet (MTU) on the cellular network breaks data transfer, or carrier NAT interferes with your protocol. Start simple: reconnect the VPN, allow the app to run without battery limits and to use mobile data, and try a different protocol (WireGuard → OpenVPN on TCP-443). Below is a cause-by-cause breakdown, a symptom → cause → fix table, and separate notes for iPhone and Android.
Why does a VPN work on Wi-Fi but drop on mobile data?
The key to diagnosis is that Wi-Fi and cellular are two different environments with different rules. If the problem shows up only on mobile data while Wi-Fi is fine, it isn't the phone or the VPN service as a whole — it's what differs between the networks: the IP protocol (carriers often run IPv6), packet size, carrier NAT, and the system limits that Android and iOS place specifically on mobile data to save battery and traffic.
That alone rules out half of the pointless steps: reinstalling the app, switching services, or blaming your home Wi-Fi provider is useless — the source is the pair «cellular network + phone settings for mobile data». If the VPN won't connect on any network at all, that's a different case, best worked through with the general guide on what to do when a VPN won't connect.
It's important to tell two symptoms apart, because they're fixed differently. First: the VPN won't connect on mobile data at all — the tunnel never comes up. Second: the app says «connected», the status is green, but pages won't open and there's effectively no internet. The first is usually about the background, permissions and protocol; the second is almost always IPv6 or MTU. We cover both branches below.
Two-minute diagnosis
Before changing settings, spend a couple of minutes narrowing the causes — the problem is often solved at this stage. Go step by step:
- Check the internet without a VPN. Turn the VPN off and open any site on mobile data. If there's no internet even without the VPN, the issue is the cellular connection (signal, balance, APN), not the VPN.
- Reconnect the VPN. Toggle the tunnel off and on, then turn airplane mode on for 5 seconds and off — this resets a stuck cellular registration.
- Compare with Wi-Fi. Confirm the same VPN works over Wi-Fi. If it does, the cause is definitely the «cellular network + mobile-data settings» pair.
- Change server and protocol. Pick another server, then switch protocol (WireGuard → OpenVPN on TCP-443 → IKEv2). If one of them works, it's NAT or network filtering.
- Restart the phone. Trivial, but it clears half of temporary cellular-modem glitches.
No luck? Move on to the cause-by-cause breakdown below — first the table, then the details for each point.
Symptom, cause and fix in one table
The table helps you jump from what you see to what to fix. Find your symptom and go to the matching section.
| Symptom | Likely cause | What to do |
|---|---|---|
| VPN drops when the screen turns off or the app is backgrounded | Battery saver unloads the app | Remove battery limits, allow background work |
| Tunnel won't come up on mobile data at all | App denied mobile data or data saver is on | Allow mobile data, disable data saver for the VPN |
| «Connected», but sites won't load | Carrier IPv6 outside the tunnel or a large MTU | Disable IPv6 for the SIM, lower the MTU |
| Works only on one protocol or port | Carrier NAT throttles UDP or the protocol | Switch protocol to OpenVPN TCP-443 |
| After a system update the VPN stopped connecting on the SIM | Reset permissions or always-on settings | Re-grant permissions, check always-on VPN |
Battery saver unloads the VPN in the background
The most common reason a VPN drops specifically on mobile data is aggressive power saving. On cellular the phone saves battery more aggressively than on Wi-Fi, and the system «sleeps» background apps, the VPN included. It looks like this: while the screen is on everything works, but the moment you pocket the phone the connection drops and traffic goes out directly.
The fix is to take the VPN app out from under battery optimization. On Android open the VPN app's settings, the «Battery» section, and choose «Unrestricted» (on different skins — «Don't optimize», «Allow background activity»). Xiaomi, Huawei, Samsung and Oppo devices have an extra, stricter autostart manager — there the VPN app must be separately added to the exceptions and allowed to autostart, otherwise the system will keep closing it. On iPhone enable «Connect On Demand» or always-on in the VPN settings so the system brings the tunnel up itself.
The app is denied mobile data, or data saver is on
If the VPN won't come up on cellular at all but works fine on Wi-Fi, check whether the app is allowed to use mobile data. On Android each app has a separate mobile-data toggle, and if it's off, the VPN will only work over Wi-Fi. Open the app's settings → «Mobile data» and make sure access is allowed, including in the background.
The second trap is data-saving modes: «Data Saver» on Android and «Low Data Mode» on iOS. They restrict background activity and can stop the VPN from holding a connection. Either turn data saving off for a while, or add the VPN app to the exceptions so the limits don't apply to it. Also check that no mobile-traffic cap is enabled that automatically cuts data at a threshold — we covered VPN data use in detail in VPN and mobile internet.
IPv6 on cellular: the tunnel is up, but there's no internet
The classic «connected but sites won't open» symptom on mobile data is most often caused by IPv6. Many carriers hand a SIM an IPv6 address while the VPN tunnel comes up over IPv4 — so some requests go outside the tunnel and hit nothing, and some are lost. Wi-Fi doesn't have the same issue because a home router usually runs on IPv4.
There are two ways to solve it. First, enable IPv6 leak protection or full IPv6 support in the VPN app if the service can do it: then the tunnel handles both protocols correctly. Second, disable IPv6 for the cellular network at the phone level. On Android this is done in the access point (APN) settings: change the APN protocol type from «IPv4/IPv6» to «IPv4». On iPhone you can't switch IPv6 manually, so rely on leak protection in the VPN app itself. A side effect of such a leak is exposing your real address, which is close in nature to a DNS leak; both are worth checking after setup.
MTU: an oversized packet breaks transfer
Another reason for «the tunnel came up but pages hang» is a wrong MTU, the maximum packet size. Cellular networks add their own headers, and inside the VPN tunnel a standard-size packet (1500 bytes) becomes too big: it won't pass whole, and the mechanism that should split it often doesn't work on mobile. The result — the handshake succeeds, small requests go through, but heavy pages and files hang.
The fix is to lower the MTU. If the VPN app lets you set MTU manually, drop it to around 1400 and test; if that doesn't help, go lower, to 1280. For WireGuard a typical working value on mobile networks is about 1380–1420. On iPhone there's usually no manual MTU for a personal VPN, so switching to a protocol less sensitive to packet size helps here again.
Carrier NAT and protocol: when changing transport helps
If none of the previous steps worked and the VPN stubbornly fails only on cellular, the cause may be how the carrier handles traffic. Mobile carriers widely use CGNAT (shared NAT across many subscribers) and treat UDP — the default for fast protocols like WireGuard — differently. Sometimes UDP traffic is throttled or deprioritized, and the tunnel either won't come up or keeps dropping.
A working trick is to switch transport to TCP over a familiar port. Change the protocol to OpenVPN over TCP on port 443: this port is used for ordinary HTTPS, so the network almost always lets it through. TCP is usually a bit slower than UDP, but the connection is steadier where UDP is filtered. If the service supports several protocols, cycling WireGuard → IKEv2 → OpenVPN TCP-443 quickly shows which transport gets along with your carrier. What sets the protocols apart and how to choose is covered in our article on VPN protocols.
iPhone and Android: where to look
The set of settings differs by platform, so check them differently.
Android
Android has the most levers and therefore the most causes: a separate mobile-data permission per app, the battery and autostart manager (especially strict on Xiaomi, Huawei, Samsung, Oppo), the APN protocol type for disabling IPv6, a manual MTU in some apps, plus «Always-on VPN» and «Block connections without VPN». Check them in that order — from permissions and battery to network parameters.
iPhone
iOS has fewer settings and they're buried deeper: you can't disable IPv6 or set MTU for a personal VPN by hand, but there's «Connect On Demand» and a general always-on. So on iPhone the main levers are enabling auto-connect, turning off «Low Data Mode» for cellular, and — if sites won't load — changing the protocol, relying on built-in leak protection.
Always-on VPN: why you lose service specifically on mobile
A separate situation: on mobile data the connection disappears entirely the moment you enable the VPN, and comes back when you turn it off. A common cause is «Always-on VPN» together with «Block connections without VPN» on Android (a kill-switch analog). It's designed correctly: if the tunnel drops, traffic shouldn't leak onto the open network. But if the tunnel itself won't come up on cellular (due to IPv6, MTU or NAT above), this block leaves the phone with no internet at all — over Wi-Fi the tunnel comes up and there's no problem, but on the SIM it doesn't.
The right fix is not to disable protection for good, but to first fix the reason the tunnel won't come up on mobile (the IPv6, MTU and protocol sections above). As a temporary diagnostic step you can uncheck «Block connections without VPN», confirm that internet on the SIM appears without the block — that proves the tunnel really isn't coming up on cellular. After fixing the cause, turn the block back on — it protects against traffic leaking past the VPN.
How to tell it's the carrier, not the app
To avoid fixing the wrong thing, separate a network problem from an app problem with a simple test. If the same VPN on the same phone works over Wi-Fi and fails on cellular — the app is fine, dig into the network and its settings (IPv6, MTU, NAT, mobile-data permissions). If the VPN works on no network at all — the cause is the app, account or server, and that's a different scenario.
An extra sign of «the carrier's hand» is when the VPN steadily works on TCP-443 and fails on UDP protocols: that's almost always traffic filtering or prioritization on the cellular network, not a fault on your side. The same leak tests as on Wi-Fi help confirm that protection actually works and the IP really changed.
Conclusion
When a VPN works on Wi-Fi but not on mobile data, look for the difference between the networks, not a broken service. Go in order: remove battery limits and allow the app mobile data, disable data saver, deal with IPv6 and MTU if it's «connected but no internet», and switch the protocol to OpenVPN TCP-443 if the carrier throttles UDP. Android has more levers (permissions, autostart, APN, MTU, always-on); on iPhone the main tools are auto-connect and changing the protocol. Change one parameter at a time and check the result — that way you'll find the cause rather than pile up new problems. A stable VPN on your phone pays off: on untrusted and mobile networks it encrypts traffic and hides your real IP. LiMP terms and setup are on the pricing page.
Frequently asked questions
Why does a VPN work on Wi-Fi but not on mobile data?
Wi-Fi and cellular differ in IP protocol, packet size and system limits. On mobile data the phone saves battery and traffic more aggressively, and the carrier often hands out IPv6 and uses its own NAT — any of these breaks the tunnel specifically on the SIM, while everything works over Wi-Fi.
The VPN says «connected» but there's no internet on mobile — what's wrong?
Almost always it's the carrier's IPv6 bypassing the tunnel or an oversized MTU. Enable IPv6 leak protection in the app or switch the APN type to IPv4, then lower the MTU to about 1400, and if that doesn't help, to 1280.
Why does the VPN drop when I pocket the phone?
It's battery saving: on cellular the system sleeps background apps, the VPN included. Take the VPN app out from under battery optimization and allow it to autostart and run in the background; on iPhone enable «Connect On Demand».
The VPN doesn't work on a specific carrier — is it a block?
Not necessarily. More often it's network specifics: CGNAT and UDP filtering, which WireGuard uses. Switch the protocol to OpenVPN over TCP on port 443 — that transport is indistinguishable from ordinary HTTPS and gets through almost always.
Do I need to disable IPv6 for the VPN to work on the phone?
If the service handles IPv6 correctly or protects against its leak, you don't need to disable anything. If there's no such option and sites won't load, on Android switching the APN type to IPv4 helps; on iPhone there's no manual toggle, so you rely on the app's leak protection.
Should I turn off «Block connections without VPN» if the internet is gone?
Only temporarily, for diagnosis. If internet on the SIM returns after unchecking it, the tunnel isn't coming up on the mobile network — fix the cause (IPv6, MTU, protocol), then turn the block back on: it keeps traffic from leaking past the VPN.