Key takeaways
Classify the failure before changing the network
A hostname that does not resolve, a TLS connection that never establishes, an interface that loads but requests stall, and an explicit account or policy message are different categories. The first three can be investigated as network behavior. A clear policy or account response should not be treated as a transport bug.
Compare the same device and account with the VPN disabled and then on another network. If the same explicit service response appears everywhere, a routing explanation is less likely. If the symptom changes with network path, move to DNS and transport diagnostics.
A loaded page does not prove the entire session works
Interactive web applications use more than a single short request. A longer response can be affected by TCP resets, proxies, filtering, browser extensions, or unstable interface handover. The home page loading successfully therefore does not validate every connection used during a conversation.
Test with a clean browser profile, verify system time and DNS, then repeat the same request. If the browser works but a dedicated client fails, compare proxy and split-tunnel rules for those processes. If one VPN protocol is uniquely affected, record the exact failure stage instead of changing several settings at once.
Check DNS paths without confusing them with policy
Compare name resolution with the VPN on and off and make sure reconnect does not leave a stale resolver state. System Private DNS or browser DoH can create a resolver path separate from the DNS carried by the VPN. That can produce partial site behavior even when the tunnel appears connected.
After each network change, repeat one controlled scenario. The goal is to identify the failing layer. If the service returns an explicit policy or account restriction, changing network parameters is not the correct troubleshooting path.
Continue reading