VPN Connected but No Internet in Windows 11 and 10: Fix

Before you change a single setting, open a browser and load any website. If pages load, you have internet and there is nothing to fix — whatever the taskbar says.

Because Windows is not measuring your connection. It is guessing, and on a VPN it usually guesses wrong.

Here is what that warning actually is. Windows decides whether you are online by trying to download one small text file from a Microsoft server. If that single request completes, you get the normal icon. If it does not, you get "No internet" — and a VPN routes that request down a tunnel where it cannot complete.

So the check fails, Windows announces you are offline, and your connection has been working the entire time. The word "secured" beside it refers to your wifi encryption, which is also fine. Two accurate words and one wrong one, in a message that reads as a fault.

That is the common case. But there is a second situation where the internet genuinely is gone the instant a VPN is involved — and in that one, something is working correctly rather than failing.

The Customer Who Nearly Canceled a Working VPN

A customer came into Jake's shop annoyed about a VPN subscription she had bought a fortnight earlier. Every time she connected, Windows put a warning on the network icon: No internet, secured. She had contacted the VPN's support twice, been sent through a checklist that changed nothing, and had decided the product was faulty. She wanted help canceling it.

Jake asked one question before touching anything: with the VPN on, could she actually browse?

She could. She had been browsing perfectly the whole fortnight. Email worked, video worked, everything worked. She had simply not trusted it, because the icon told her not to, and had spent two weeks assuming the connection was about to fail at any moment.

Nothing was broken. Nothing had ever been broken.

Ethan's response when Jake told him: "That's the expensive kind of wrong. She wasn't confused about a technical detail — she was about to cancel a product that was doing its job, because Windows told her it wasn't. And her VPN's support desk apparently didn't know either, which is the part I'd be annoyed about."

Understanding why the icon behaves that way takes about a minute, and it turns a permanent low-level worry into something you can safely ignore. It also, usefully, tells you how to spot the times when the warning is real — because sometimes it is.

How Windows Decides You Are Offline

The component responsible is the Network Connectivity Status Indicator, and what it does is far simpler than most people assume.

It resolves a Microsoft hostname, then makes a plain HTTP request for a small test file. If the file arrives with the expected content, you are online. If the request fails, times out, or returns something unexpected, you are offline as far as the icon is concerned.

That is the whole test. One name lookup and one small download, repeated periodically.

What the icon is really reporting	What people assume it means
One HTTP request to a Microsoft server succeeded or failed	Windows has tested the internet and found it absent
"Secured" = your wifi encryption is fine	Something about security is being flagged
The probe could not complete through this route	The connection is broken or unreliable
Nothing at all about your actual traffic	A verdict on whether browsing will work

A VPN interferes with that probe for entirely ordinary reasons. It may route the request through the tunnel to a place that answers differently, resolve the name through its own DNS, or block the connection outright as part of preventing leaks. Any of those produces a failed probe and a warning icon, and none of them means your connection is unhealthy.

Which is why the ten-second browser test at the top of this page beats every setting you could change. Your browser is a better connectivity indicator than the connectivity indicator.

If pages did not load, though, then something real is happening — and the most likely explanation is a feature doing its job.

The Kill Switch Looks Exactly Like a Fault

If your internet stops completely the moment the VPN has trouble, that is almost certainly the kill switch.

A kill switch exists for one purpose: the instant the encrypted tunnel drops, it blocks all traffic so nothing escapes over your ordinary connection. Without it, a dropped tunnel means your real address and your unencrypted traffic are exposed for however long it takes to notice — which might be hours.

So total loss of internet after a wobble is the feature succeeding. It looks identical to catastrophic failure, and there is usually nothing on screen explaining which one you are looking at.

To get back online:

1. Reconnect the VPN. The clean route. Traffic returns immediately once the tunnel is up.
2. If it will not connect, open the VPN application and turn the kill switch off, then close and reopen the application.
3. If the block persists with the app closed, the client has left firewall rules behind. Reinstalling it clears them, and that is what a genuinely stuck kill switch usually is.
4. Turn the kill switch back on once you are working. This is the step people skip, and it quietly removes the protection they are paying for.

Kill switches are implemented as firewall rules, which is why they can outlive the application that created them. If you want to understand what is actually blocking you, our guide to allowing and blocking apps through Windows Firewall covers how outbound rules work — and its central point applies directly here: a block rule always beats an allow rule, which is exactly why a leftover kill-switch rule wins against everything else on the machine.

When Names Stop Resolving

There is a distinctive pattern worth learning to recognize: the connection is clearly alive, but no website loads and everything times out slowly rather than failing fast.

That is DNS. Your traffic is reaching the VPN, but website names are not being translated into addresses, so nothing has anywhere to go.

The test takes five seconds. Type 1.1.1.1 into your browser's address bar. If that responds and normal website names do not, DNS is confirmed and you can stop looking anywhere else.

The fix, in order:

1. Open Command Prompt as administrator and run ipconfig /flushdns. This alone often does it.
2. If not, follow with ipconfig /release, then ipconfig /renew, then netsh winsock reset, and restart the machine.
3. In your VPN application, look for a DNS setting — most have one, often described as leak protection or custom DNS. Switching it on, or switching it to the VPN's own servers, usually settles it permanently.
4. If your VPN offers a choice of protocol, try a different one. Some networks handle one protocol badly and another perfectly.

Do that fourth step before anything drastic. It costs one click and it resolves a surprising share of VPN problems that look nothing like a protocol issue.

The IPv6 Half of Your Traffic

Your home network almost certainly offers two kinds of addressing at once, the older IPv4 and the newer IPv6. Many VPNs carry only IPv4 through the tunnel.

The result is traffic that tries a route the VPN does not carry. Depending on the VPN, that traffic either escapes outside the tunnel — which defeats the point of using one — or stalls entirely, which is what you are seeing.

Almost every VPN application has a setting for this, usually described as blocking or disabling IPv6 while connected. Turn it on. That is the right fix, because it applies only while the VPN is running.

You can also disable IPv6 on the network adapter in Windows itself, and plenty of guides suggest it. It works, and it is a heavier hammer than the situation needs: the change is permanent, it affects everything you do, and it is exactly the kind of thing you forget you did when something unrelated misbehaves six months later. Use your VPN's setting first.

The Virtual Adapter Behind It All

When you install a VPN, it creates a virtual network adapter — something Windows treats as a second network card that happens to have a tunnel behind it rather than a cable. You can see it in Device Manager under Network adapters, usually carrying the VPN's name or a protocol name.

If that adapter ends up in a bad state, traffic goes nowhere and every symptom on this page can appear at once. It happens after Windows updates, after a client crash, and after two VPN products have been installed on the same machine.

Reinstalling the VPN client recreates the adapter cleanly, which is why the reinstall that feels like giving up is frequently the correct answer rather than a lazy one. Uninstall properly through Settings, restart, then install fresh.

Two things worth checking while you are in Device Manager. If you see adapters belonging to a VPN you no longer use, remove them — competing virtual adapters cause exactly this class of problem. And if the current VPN's adapter carries a warning triangle, that is a driver issue rather than a VPN issue, and the reinstall is the fix for that too.

Matching the Symptom to the Cause

What you see	Most likely cause	What to do
Warning icon, everything works	The connectivity probe cannot complete through the tunnel	Nothing. Ignore the icon.
Everything stops the moment the VPN wobbles	Kill switch blocking traffic, correctly	Reconnect the VPN
Sites time out, 1.1.1.1 responds	DNS not resolving through the tunnel	Flush DNS, then the VPN's DNS setting
Small pages load, large ones stall	Packet size slightly too large for the link	Lower the MTU in the VPN application
Some apps work, others do not	Split tunneling is on and configured unevenly	Check the split tunneling list in the app
Broke after a Windows update	Virtual adapter or its driver disturbed	Reinstall the VPN client
Only one network is affected	That network blocks VPN protocols — common on hotel and office wifi	Switch protocol, or use a port that is allowed

The last row explains the version of this that only happens at work or in a hotel. Nothing on your machine is wrong; that network is deliberately refusing VPN traffic, and switching protocol inside the app is usually enough to get around an unsophisticated block.

What a VPN Should Actually Do About All This

Almost everything above is a problem the VPN could have handled for you, and the better ones do. It is worth knowing what to expect rather than assuming friction is normal.

A kill switch that releases properly. Blocking traffic when the tunnel drops is table stakes. Restoring it cleanly when you reconnect or switch it off is where products differ, and a kill switch you have to reinstall the client to escape is a poor one.

IPv6 handled without asking you. Either carried through the tunnel or blocked automatically. Leaving it to leak is the failure that matters, because it defeats the purpose silently.

Its own DNS, on by default. If you have to find and enable leak protection yourself, it was off until you did — and most people never look.

More than one protocol, switchable in one click. This is what gets you working on restrictive networks, and it costs nothing to provide.

Ethan's view, which Jake now gives customers before they buy anything: "Everyone compares them on speed and server count, and neither one will ever be your problem. What will be your problem is a hotel wifi that blocks the default protocol and an app with no second option. Buy the one that behaves well when things go wrong, because that's the only day you'll actually notice it."

If you are weighing up privacy tools more broadly, our guide to protecting your privacy in Windows covers what a VPN does and does not do — worth reading, because a VPN is often bought to solve problems it was never going to touch.

What This Page Said in 2020

This post went up in March 2020, when Microsoft had acknowledged a specific bug causing this warning on VPN connections. The point of the page at the time was reassurance: you are not alone, Microsoft knows, a fix is expected.

That was the right thing to publish that month. It has aged into the wrong thing, because that particular bug was fixed years ago while the warning kept appearing — not from a defect, but from the way the connectivity check works and always has.

So a page whose message was "this is a known bug, wait for a patch" was quietly telling people to wait for something that was never coming. Anyone who followed it in 2023 or 2025 got reassurance and no explanation.

The rewrite replaces that with the mechanism, which does not expire: what the check actually is, why a VPN defeats it, and how to tell the false alarm from the three or four causes that are real. The reassurance is still here. It is just true for a durable reason now rather than a temporary one.

Your Questions, Answered Straight

Why does Windows say no internet when my VPN is connected?

Because Windows does not measure your connection, it tests it. It tries to download a small file from a Microsoft server, and if that request does not complete it declares you offline. A VPN routes or blocks that request, so Windows reports no internet while your connection works perfectly.

How do I tell whether the warning is real?

Open a browser and load any website. If pages load, you have internet regardless of what the icon claims, and there is nothing to fix. If nothing loads, the warning is genuine and the cause is usually DNS, a kill switch, or the VPN adapter. That ten-second test decides which half of this page you need.

What is NCSI in Windows?

The Network Connectivity Status Indicator. It is the component that decides whether the taskbar shows you as online. It resolves a Microsoft hostname and fetches a small test file over HTTP, and the outcome of that single check is what the icon reflects. It is a probe rather than a measurement.

Is "No internet, secured" actually a problem?

Often not. The word secured refers to the wifi encryption, which is working. The no internet part is the result of the failed probe. On a VPN the two together frequently describe a connection that is both encrypted and perfectly usable, which is why the message causes far more alarm than it should.

My VPN dropped and now nothing works at all. What happened?

Your kill switch did exactly what it is for. When the tunnel drops, a kill switch blocks all traffic so nothing leaks outside the VPN. Total loss of internet is the intended behavior, not a failure. Reconnect the VPN and traffic returns, or turn the kill switch off temporarily if you cannot reconnect.

How do I get back online if the kill switch will not release?

Reconnect the VPN first, since that is the clean route. If it will not connect, open the VPN application and turn the kill switch off, then close and reopen the application. As a last resort, uninstalling and reinstalling the VPN client clears the firewall rules it left behind, which is what a stuck kill switch usually is.

Why do websites fail but the connection seems fine?

That pattern almost always means DNS. Your traffic is reaching the VPN but names are not being turned into addresses, so nothing resolves. Test it by trying a numeric address such as 1.1.1.1 in a browser: if that responds and names do not, DNS is your problem and the fix is in the VPN's settings.

How do I flush DNS in Windows?

Open Command Prompt as administrator and run ipconfig /flushdns. On a VPN it is worth following with ipconfig /release, ipconfig /renew and netsh winsock reset, then restarting. That sequence clears stale name lookups and resets the networking layer the VPN adapter attached itself to.

Can IPv6 break a VPN connection?

Yes, and it is a common cause on home networks. Many VPNs tunnel IPv4 only, so if your network offers IPv6 as well, some traffic tries a route the VPN does not carry and simply stalls. Most VPN applications have an option to block or disable IPv6, and turning it on usually fixes it immediately.

Should I disable IPv6 in Windows to fix this?

Use your VPN's own IPv6 setting first, because it applies only while the VPN is connected. Disabling IPv6 across the whole adapter in Windows works too, but it is a permanent change affecting everything you do, and it is easy to forget you made it when something unrelated misbehaves months later.

What is the VPN adapter and why does reinstalling help?

Your VPN creates a virtual network adapter that Windows treats like a second network card. If that adapter is in a bad state after an update or a crash, traffic goes nowhere. Reinstalling the VPN client recreates it cleanly, which is why the reinstall that feels like a blunt instrument is often the correct fix.

Why is my VPN connection extremely slow rather than broken?

If pages load partially or stall on larger ones, suspect the packet size setting. VPNs add overhead to every packet, and if the resulting size is slightly too large for your connection, small requests succeed while big ones fail. Most VPN applications expose an MTU setting, and lowering it a little resolves that pattern.

Does my firewall or antivirus interfere with a VPN?

It can. Security suites sometimes block the VPN's virtual adapter or its connection attempts, and the symptom looks identical to a VPN fault. Temporarily pausing third-party protection and reconnecting is a reasonable test that takes a minute, provided you turn it straight back on afterwards.

Should I turn off the kill switch to avoid this problem?

No, not as a general habit. The kill switch is the feature that stops your real address being exposed the moment a tunnel drops, which is the situation you bought a VPN to avoid. Turn it off only to recover a connection, and turn it back on. A VPN without one is providing considerably less than you think.

How do I stop Windows showing the warning when nothing is wrong?

The honest answer is to stop treating the icon as authoritative on a VPN, because the check it runs cannot succeed through many tunnels. Registry changes exist that alter the probe behavior, but they change what Windows reports rather than anything real, and a connectivity indicator you have taught to always say yes is worse than one that is occasionally wrong.

Does this apply to Windows 11 as well as Windows 10?

Yes. The connectivity probe, the commands and the VPN adapter behavior are identical on both. Windows 11 shows the warning in a slightly different place in the taskbar and network flyout, and that is the only difference worth mentioning.

Worth Reading Next

Revision note. Originally published March 28, 2020, when Microsoft had acknowledged a specific bug behind this warning and a fix was expected. Rewritten August 22, 2026 for Windows 11 and Windows 10. That bug was fixed years ago, but the warning kept appearing — because the connectivity check Windows runs simply cannot complete through many VPN tunnels, and never could. A page that said "known bug, wait for a patch" was therefore telling readers to wait for something that was not coming, so the reassurance has been replaced with the mechanism behind it. New here: the ten-second browser test, what the connectivity probe actually does, why a kill switch doing its job looks identical to a failure, and a symptom table covering DNS, IPv6, packet size and restrictive networks. If your VPN behaves differently from anything described here, please write in and say which client and which protocol — those two details explain most of the remainder. And if you have been living with that warning and quietly distrusting a connection that works: it was very probably fine the whole time.