> ## Documentation Index > Fetch the complete documentation index at: https://docs.derekdinh.com/llms.txt > Use this file to discover all available pages before exploring further. # Fixing VPN Connection and Authentication Failures Fast > Diagnose and resolve common VPN errors including authentication failures, connection timeouts, and split tunneling issues on Windows and macOS. A VPN (Virtual Private Network) creates an encrypted tunnel between your device and your organization's network, enabling secure remote access to internal resources. When a VPN fails to connect or drops unexpectedly, the root cause is usually one of a small set of well-known problems: wrong credentials, an unreachable server address, a conflicting firewall rule, or a corrupted client installation. Work through the steps below to identify and fix the issue. Most VPN clients display an error code or message when a connection attempt fails. Identifying the error category upfront saves significant diagnostic time. **Common VPN errors and their likely causes:** * Your password has expired or been reset by an administrator. * Multi-factor authentication (MFA) token was entered incorrectly or has expired. * Your account has been locked out after too many failed attempts. * The username format is wrong (e.g., `username` vs. `DOMAIN\username` vs. `username@company.com`). **Immediate check:** Verify your credentials by logging into a company web portal (e.g., Outlook Web Access or your corporate intranet) with the same username and password. * The VPN server hostname or IP address is incorrect. * The VPN server is temporarily down or under maintenance. * A local firewall or security software is blocking the VPN port. * Your ISP is blocking VPN protocols (uncommon but possible on public Wi-Fi or in certain countries). * After connecting, some traffic routes through the VPN while other traffic does not, depending on policy. * Internal resources are accessible but internet-only sites are slow or broken. * DNS resolves internal names correctly but external names fail (or vice versa). * Your assigned VPN IP address is not in a permitted subnet. * Access control policies on the server restrict traffic to specific resources. * The internal resource's DNS name is not resolving through the VPN's DNS server. Always record the exact error message and any error code your VPN client displays. This information is essential for your IT team if you need to escalate. Authentication failures are the most common VPN error and the easiest to resolve. 1. **Confirm your password is current.** Corporate passwords often expire on a 30–90 day cycle. Try logging into another company service (email, HR portal) with the same password to rule out expiry. 2. **Check the username format** required by your VPN. Try each variation: * `username` * `DOMAIN\username` * `username@company.com` 3. **Verify your MFA method.** If your VPN uses a one-time passcode (TOTP), make sure your authenticator app's clock is synchronized. On a smartphone, enable automatic time sync: * iOS: **Settings → General → Date & Time → Set Automatically** * Android: **Settings → General Management → Date and Time → Automatic date and time** 4. **Check for account lockout.** Most corporate environments lock an account after 3–5 failed attempts. Contact your IT helpdesk to unlock it rather than retrying the VPN, which will only extend the lockout. If you recently changed your domain password on a corporate device, you may need to lock and unlock your workstation (or restart it) before the VPN client picks up the new credentials from Windows Credential Manager or macOS Keychain. An incorrect server address causes a connection timeout that can look identical to a firewall block or a server outage. 1. Open your VPN client's settings or profile configuration. 2. Compare the **server address** (hostname or IP) against the value documented in your company's IT onboarding guide or help portal. 3. If the server address is a hostname (e.g., `vpn.company.com`), confirm it resolves correctly: ```bash theme={null} # macOS / Linux nslookup vpn.company.com # Windows (PowerShell) Resolve-DnsName vpn.company.com ``` 4. If nslookup returns no result, the DNS entry may be missing or your current DNS server may not have access to it. Try with a public DNS server: ```bash theme={null} nslookup vpn.company.com 8.8.8.8 ``` 5. Test basic reachability to the server on the VPN port. Common VPN ports are: | Protocol | Default Port | | -------------------------- | --------------- | | OpenVPN (UDP) | 1194 | | OpenVPN (TCP) | 443 | | WireGuard | 51820 | | Cisco AnyConnect / SSL VPN | 443 | | IKEv2 / IPsec | 500, 4500 (UDP) | ```powershell theme={null} # Windows — test TCP connectivity to the VPN server on port 443 Test-NetConnection -ComputerName vpn.company.com -Port 443 ``` ```bash theme={null} # macOS / Linux nc -zv vpn.company.com 443 ``` If your VPN uses UDP (e.g., OpenVPN UDP or WireGuard), `Test-NetConnection` and `nc` test TCP only. A failed TCP test to a UDP-based VPN does not necessarily mean the server is unreachable — contact IT for confirmation. Isolating whether the problem is VPN-specific or affects your general connection helps narrow the cause. 1. **Disconnect from the VPN** completely. 2. Open a browser and confirm you can load external websites such as `google.com`. 3. Run a speed test (see the [Slow Network](/networking/slow-network) guide if needed) to confirm your baseline connection is healthy. 4. If your internet works fine without the VPN but the VPN still cannot connect, the issue is specific to the VPN client, server, or firewall policy. 5. If your internet is also broken without the VPN, address the underlying connectivity issue first by following the [No Internet Connection](/networking/no-internet-connection) guide. **Check whether a different network resolves the issue:** * If you are on a **public Wi-Fi network** (coffee shop, hotel), try switching to your mobile hotspot. Some public networks aggressively block VPN protocols, especially UDP-based ones. * If the VPN works on mobile hotspot but not on the office or home Wi-Fi, the local router's firewall is blocking VPN traffic. Many corporate VPN clients support both UDP and TCP transport. If your client has a setting to **force TCP mode** or use **port 443**, switching to it often bypasses restrictive public Wi-Fi firewalls. Local firewalls and third-party security software are a frequent cause of VPN connection failures, particularly after a software update changes the firewall policy. **Windows Firewall:** 1. Search for **Windows Defender Firewall** in the Start menu and open it. 2. Click **Allow an app or feature through Windows Defender Firewall**. 3. Scroll through the list to find your VPN client and confirm it is checked for both **Private** and **Public** networks. 4. If it is not listed, click **Allow another app** and browse to the VPN client executable. Alternatively, temporarily disable the firewall to test (re-enable it immediately after testing): ```powershell theme={null} # Disable all firewall profiles (run as Administrator — re-enable after testing!) Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False # Re-enable after testing Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True ``` **Third-party antivirus / security suites:** * Temporarily disable features such as **Web Shield**, **Firewall**, or **Network Protection** in your antivirus software. * Test the VPN connection with these features off. * If the VPN connects with security software disabled, add the VPN client as a trusted application or exception in the antivirus settings, then re-enable the security features. Never disable your firewall or antivirus and then leave it disabled, especially on a corporate device. These are temporary diagnostic steps only. Re-enable all security features immediately after your test. If the VPN client configuration files or runtime components have become corrupted — often after an OS update — a clean reinstall usually resolves the issue. **Windows:** 1. Open **Settings → Apps → Installed Apps**, search for your VPN client, and click **Uninstall**. 2. After uninstalling, manually remove any leftover configuration folders: ```powershell theme={null} # Example for a generic VPN client — adjust the path to match your client Remove-Item "$env:APPDATA\VPNClientName" -Recurse -Force Remove-Item "$env:PROGRAMDATA\VPNClientName" -Recurse -Force ``` 3. Restart your computer. 4. Download the latest version of the VPN client from your company's IT portal or the vendor's official website. 5. Install it and re-import your connection profile. **macOS:** 1. Drag the VPN application to the Trash, or use the uninstaller provided by the vendor (common for Cisco AnyConnect and GlobalProtect). 2. Remove keychain entries: * Open **Keychain Access** (Spotlight: **Cmd + Space**, type `Keychain Access`). * Search for your VPN server's hostname and delete any stored entries. 3. Restart your Mac. 4. Download and reinstall the client from your IT portal. Before uninstalling, take a screenshot or note of your current VPN profile settings (server address, authentication type, group name) so you can recreate the configuration after reinstalling. If you have verified credentials, confirmed the server address, ruled out firewall blocks, and performed a clean reinstall without success, the issue requires investigation by your IT or network security team. * **Exact error message and error code** displayed by the VPN client * **VPN client name and version number** (e.g., Cisco AnyConnect 4.10, GlobalProtect 6.1, OpenVPN Connect 3.4) * **Operating system version** (e.g., Windows 11 22H2, macOS 14.3) * **Output of `nslookup vpn.company.com`** and `Test-NetConnection` / `nc` results for the VPN port * **Network you are connecting from** — home broadband, office LAN, mobile hotspot, hotel Wi-Fi * **VPN client log files** — most clients write detailed logs that IT can interpret: * Cisco AnyConnect (Windows): `C:\Users\\AppData\Local\Cisco\Cisco AnyConnect Secure Mobility Client\` * GlobalProtect (Windows): `C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.log` * OpenVPN (Windows): `C:\Users\\OpenVPN\log\` * OpenVPN (macOS/Linux): `~/.config/openvpn/` or `/var/log/openvpn.log` * **Whether the issue is intermittent or persistent** — does it fail every time, or only under specific conditions? Do not share VPN configuration files, certificates, or private keys over email or chat. These are sensitive security artifacts. Hand them directly to your IT support contact through a secure channel.