Unable to access the internet after configuring a VPN on Windows is typically caused by routing conflicts where the system directs all traffic through the tunnel, including local network resources, or by incorrect DNS settings. Resolving this requires adjusting the VPN client’s "Split Tunneling" options to allow local LAN access while keeping external traffic secure, and verifying that the Network Adapter properties are correctly prioritized.
Understanding Routing Conflicts
When you connect to a Virtual Private Network (VPN), your operating system creates a new virtual network interface. By default, many corporate or security-focused VPN clients are configured to route all internet traffic through this tunnel. This is known as "Full Tunneling." While this enhances security for work data, it often breaks your ability to access local resources like printers, shared drives, or even the public internet if the VPN gateway itself has connectivity issues. The core problem arises because your computer no longer knows how to reach devices on your local subnet directly. Instead of sending packets to your home router, it sends them to the VPN server. If the VPN server does not have a route back to your local network, or if your ISP connection is somehow blocked by the tunnel configuration, you lose internet access entirely. This is distinct from a general network failure; your physical adapter works, but the logical path is misdirected. For users who frequently switch between remote work environments and local networks, this full-tunnel approach can be frustrating. It forces you to disconnect the VPN just to check a local file share or update a local printer driver. Understanding this behavior is the first step toward fixing the issue without compromising your security posture unnecessarily.Configuring Split Tunneling
The most effective solution for most users is to enable Split Tunneling. This feature allows you to specify which traffic goes through the VPN and which traffic goes through your regular internet connection. To implement this, you must modify the settings within your specific VPN client software, as the exact location of these options varies by provider. If you are using a standard OpenVPN client or a similar open-source tool, look for the connection profile settings. You will often find an option labeled "Use only remote network," "Force all traffic," or "Route all traffic through VPN." Unchecking this box enables split tunneling. This tells Windows to send traffic destined for the company’s private IP ranges through the VPN, while all other traffic (like Google.com or YouTube) flows through your normal Ethernet or Wi-Fi adapter. For enterprise solutions, the process might differ slightly. If you are dealing with complex conflicts, such as those between ExpressVPN and a work client, you may need to adjust the metrics of your network adapters. However, in most cases, simply disabling the "force all traffic" setting in the client application resolves the immediate connectivity loss. For more information on handling service conflicts that might interfere with these settings, you can refer to our guide on Resolving Conflicts Between ExpressVPN and Work VPN Client on Windows.Adjusting DNS Settings
Even if your routing is correct, you may still fail to load websites if the DNS resolution is broken. VPNs often push their own DNS servers to your machine. If these servers are unreachable or misconfigured, you will see errors like "DNS_PROBE_FINISHED_NO_INTERNET" despite having a valid IP connection. To fix this, open your VPN client’s advanced settings and look for DNS configuration options. You can choose to use the DNS servers provided by your ISP rather than the ones pushed by the VPN. Alternatively, you can manually set your preferred DNS to public resolvers like Google Public DNS (8.8.8.8) or Cloudflare (1.1.1.1). This ensures that name resolution works reliably regardless of the VPN’s internal state. After changing these settings, it is crucial to flush your DNS cache. Open Command Prompt as an administrator and runipconfig /flushdns. Then, restart your web browser and test your connection. This step clears out any stale records that might be pointing to the broken VPN DNS servers.
Verifying Network Adapter Priorities
In some rare cases, the issue lies with the metric values of your network adapters. Windows uses a metric value to determine which interface to prioritize when multiple connections are active. A lower metric means higher priority. If your VPN adapter has a lower metric than your Wi-Fi or Ethernet adapter, Windows might attempt to route traffic through the VPN even if it should go elsewhere. You can check this by navigating to the Network Connections panel in Control Panel. Right-click your primary internet adapter (Wi-Fi or Ethernet) and select Properties. Double-click on Internet Protocol Version 4 (TCP/IPv4), then click Advanced. Note the metric value. Do the same for your VPN adapter. If the VPN adapter has a significantly lower number, consider increasing its metric or decreasing the primary adapter's metric, though most modern clients handle this automatically via split tunneling. If you are experiencing broader network isolation issues where one device cannot talk to another, ensure that your firewall settings are not blocking local traffic. A quick reference for wireless troubleshooting can be found here: Unable to Access One Device on Another Network: A Wireless Troubleshooting Guide.Resetting the Network Stack
If the above steps do not resolve the issue, the underlying TCP/IP stack may be corrupted. This is common after repeated connection attempts or failed updates. You can reset the network stack by opening Command Prompt as Administrator and running the following commands sequentially:netsh winsock reset
netsh int ip reset
ipconfig /release
ipconfig /renew
ipconfig /flushdnsFrequently Asked Questions
Why does my internet work on mobile but not on Windows?
Mobile devices often use different background processes and may automatically bypass VPN restrictions for certain apps. Windows treats the VPN as a system-wide change, so if the routing table is corrupted, all applications will fail simultaneously. Resetting the Winsock catalog usually fixes this discrepancy.Can I keep my VPN connected and still access local printers?
Yes, by enabling Split Tunneling. Ensure that the IP address range of your local network (e.g., 192.168.1.x) is excluded from the "Remote Network" routes in your VPN client settings. This allows traffic to flow locally while keeping other traffic encrypted.What if the VPN client doesn't have a split tunneling option?
Some basic or older VPN clients lack this feature. In such cases, you may need to uninstall the current client and switch to a more robust alternative like OpenVPN Connect or Windscribe, which offer granular control over routing rules.Does resetting the network stack delete my saved Wi-Fi passwords?
No, resetting the TCP/IP stack and Winsock catalog does not remove saved network profiles or passwords. It only resets the low-level networking protocols. Your saved Wi-Fi SSIDs and credentials remain intact after a reboot.How do I know if my DNS is causing the issue?
Try pinging a public IP address likeping 8.8.8.8. If this succeeds but ping google.com fails, your DNS is the culprit. Check your VPN client’s DNS settings and switch to manual DNS entry to resolve the name lookup failure.