VPN Connects But No Websites Load — 5 Step Fix

The Quick Fix (30 seconds)

Disconnect the VPN, then reconnect. Wait 10 seconds. If that doesn't work, flush your DNS cache.

ipconfig /flushdns

Then restart your browser. If you're using Chrome, also clear the host resolver rules at chrome://net-internals/#dns. Click the Clear host cache button. This isn't a permanent fix, but it helps when the VPN's DNS servers are stale.

The Moderate Fix (5 minutes) — Fix DNS Leaks

The culprit here is almost always a DNS leak. Your VPN app creates a virtual adapter, but Windows still uses your ISP's DNS servers. Here's how to pin it down.

Check for a DNS leak

While connected to your VPN, go to dnsleaktest.com. Run the standard test. If you see your ISP's DNS servers instead of your VPN provider's, you've got a leak.

Force DNS on the VPN adapter

Open Network Connections (run ncpa.cpl). Find your VPN adapter (it's usually named something like "TAP-Windows Adapter V9" or "WireGuard Tunnel"). Right-click, select Properties.

Select Internet Protocol Version 4 (TCP/IPv4) and click Properties.
Choose Use the following DNS server addresses.
Enter 1.1.1.1 and 1.0.0.1 (Cloudflare) or 8.8.8.8 and 8.8.4.4 (Google).
Click OK and reconnect the VPN.

Run the leak test again. Should be clean now. If not, your VPN app might be overriding these settings.

Note: Some VPN clients (like OpenVPN GUI or NordVPN) have a setting to kill Windows DNS on connect. Check the settings under "Network" or "Advanced".

The Advanced Fix (15+ minutes) — MTU, Routing, and Split Tunneling

If DNS isn't the problem, we're looking at MTU (Maximum Transmission Unit) or routing conflicts. Let's walk through both.

Fix MTU on the VPN adapter

VPN packets can be too large for some networks (especially on PPPoE or cellular hotspots). When packets fragment or drop, websites time out.

Open an elevated Command Prompt (Run as administrator).
Find your VPN adapter's interface index:
```
netsh interface ipv4 show interfaces
```
Look for the VPN adapter (usually a high number like 30 or 40).

Set MTU to 1400:

netsh interface ipv4 set subinterface "[Adapter Name]" mtu=1400 store=persistent

Replace [Adapter Name] with the exact name from the list.

Reconnect the VPN and test. If websites still don't load, drop MTU to 1300. Keep lowering by 100 until they load.

Fix routing conflicts

Sometimes your local network routes overlap with the VPN's routes. If you're on a corporate network using 10.x.x.x addresses, and your VPN uses 10.8.0.x, traffic can get confused.

Check the routing table while VPN is connected:

route print -4

Look for lines with your VPN adapter. If you see multiple entries for the 0.0.0.0 network, you might have double default routes. The fix is to use split tunneling — route only specific traffic through the VPN.

Most VPN clients (OpenVPN, WireGuard, commercial apps) have a split tunneling toggle. Enable it and specify only the IPs or domains that need the VPN. Everything else goes directly to the internet.

Disable IPv6 if it's causing issues

IPv6 is still a mess with VPNs. Some VPN clients don't tunnel IPv6 traffic, so browsers try IPv6, fail, and don't fall back to IPv4 fast enough. The solution? Turn it off on the VPN adapter.

Go to Network Connections (ncpa.cpl).
Right-click your VPN adapter, choose Properties.
Uncheck Internet Protocol Version 6 (TCP/IPv6).
Click OK and reconnect.

When Nothing Works — The Nuclear Option

If you've done all this and websites still won't load, the VPN provider itself might be the problem. Some VPNs (especially cheap ones) have overloaded or misconfigured servers.

Switch to a different server in the same city.
Try a different protocol (OpenVPN UDP vs TCP, or WireGuard).
Check if the VPN has a kill switch enabled — sometimes it blocks all traffic including DNS.
If you're on a corporate VPN, contact your IT department. They might have firewall rules blocking port 53 traffic.

Last resort: reinstall your VPN client or the TAP adapter (for OpenVPN). In Device Manager, under Network adapters, uninstall the TAP-Windows adapter. Reboot, then reinstall the VPN client. It'll recreate the adapter with clean settings.

Real-World Scenario

I had a user on Windows 11 with ExpressVPN. VPN connected fine, but every browser showed "DNS_PROBE_FINISHED_NXDOMAIN". The quick flush didn't help. The moderate DNS fix didn't either — ExpressVPN was overriding. Ended up setting the DNS on the TAP adapter manually and checking the "Block DNS leaks" option in ExpressVPN settings. That killed the leak, and websites loaded immediately.