Fix STATUS_WRONG_COMPARTMENT (0XC000A085) routing error

This error pops up when an app tries to connect to a network in the wrong compartment. It's common with VPNs, containers, or network isolation setups.

You're trying to connect to a remote server through a VPN, or maybe you're running a Docker container that needs network access, and bam — you get the STATUS_WRONG_COMPARTMENT error with code 0XC000A085. I've seen this most often on Windows 10 or 11 machines when a VPN client (like OpenVPN or Cisco AnyConnect) creates a network compartment and then the app you're using tries to talk through the default compartment instead. It also shows up with Hyper-V containers or when you have multiple network interfaces in different routing compartments — the system won't let traffic cross compartments without explicit routing rules.

What's actually happening

Windows uses network compartments to isolate traffic. Think of them like separate rooms — each network interface or VPN tunnel lives in its own compartment. When your app makes a connection request and the system sees that the source (your app) is in compartment A but the destination (the remote server) lives in compartment B, it throws STATUS_WRONG_COMPARTMENT. It's a security feature, but it breaks things when apps don't know about compartment boundaries.

Last month I worked with a small law firm. Their remote access VPN worked fine, but their internal app for document sharing kept failing with this exact error. Turned out the app was binding to the wrong network interface — it was hardcoded to use the physical NIC instead of the VPN tunnel's interface. The fix was straightforward once we knew what to look for.

How to fix it

Here's the real fix — skip the registry hacks some forums suggest. They don't help because compartments are managed by the network stack, not by a registry key.

Step 1: Identify the compartment IDs

Open PowerShell as admin and run:

Get-NetCompartment

This lists all compartments on your machine. You'll see a default compartment (ID 1) and then additional ones for VPNs or containers. Note the CompartmentId for the interface your app should use.

Step 2: Check which interface your app is using

Run this to see which interface belongs to which compartment:

Get-NetAdapter | Select-Object Name, InterfaceIndex, CompartmentId

If your VPN adapter has a different CompartmentId than the default one (like 2 or 3), that's the issue.

Step 3: Force the app to use the right compartment

You have two options:

Option A: Use the VPN's interface directly – Configure your app to bind to the VPN adapter's IP or interface index. For example, in a Python script, you'd set socket.bind((vpn_ip, 0)). For a browser, no can do — use the next option.
Option B: Add a routing policy that bridges compartments – This works when you can't change the app. Run this in PowerShell as admin (replace the IPs with your scenario):
```
New-NetRoute -DestinationPrefix "10.0.0.0/8" -InterfaceIndex (Get-NetAdapter -Name "VPN").InterfaceIndex -PolicyStore ActiveStore
```
This creates a route that sits in the VPN's compartment. The app, if it uses the default compartment, won't follow this route unless you also set the interface metric lower. But the real trick is to use Set-NetConnectionProfile to change the network category, or better yet, use a route that points to the VPN's gateway directly.

Step 4: Reset network stack if needed

If you've been messing with compartments, sometimes they get corrupted. Reset them:

netsh int ip reset
netsh winsock reset

Then restart. This clears all compartment assignments and recreates them from scratch.

What to check if it still fails

VPN client version – Outdated VPN clients often handle compartments badly. I had a client on OpenVPN 2.4 that kept failing; updating to 2.5 fixed it because they added proper compartment support.
Third-party firewall – Some firewalls (looking at you, McAfee) create their own compartments. Disable it temporarily to test.
Containerized app – If you're using Docker or WSL2, each container gets its own compartment. The app inside the container needs to listen on 0.0.0.0 or a specific IP that's routable inside the container's network, not the host's.
Check event logs – Look under System logs for source "Tcpip" with event ID 4201. It'll tell you exactly which application and which compartment mismatch triggered the error.

In my experience, 9 times out of 10 the fix is Option A — just force the app to use the VPN interface directly. The compartment system is designed to prevent accidental leaks, but it's a pain when you actually need that cross-compartment communication. If you're stuck, drop a comment with your specific setup and I'll walk you through it.