Partial loading, an address lookup error and an inaccessible home printer call for checking network settings. For a bank or a streaming service it is usually enough to turn the VPN off temporarily or to exclude the app from the tunnel, if the client supports it.
How to tell a website's refusal from a network fault
The website sees the VPN's outgoing address, which may be shared with other people. Google states that some VPNs and tunnel services cause all traffic to be blocked. In essence, the tunnel is working, but the service refuses to accept the connection.
We start with the error text and a comparison: open the same page on the same device with the VPN and without it. Although regaining access once the VPN is off shows that the problem is linked to the tunnel, this alone does not prove a block.
How to tell a website's refusal from a network fault
The website sees the VPN's outgoing address, which may be shared with other people.
In essence, the tunnel is working, but the service refuses to accept the connection.
| What does not work | Likely cause and sign | First action | Source |
|---|---|---|---|
| Google Search | Shared address check: a captcha or a message about unusual traffic | Complete the suggested check | Google Help |
| Netflix | Service restriction: error E106 | Turn the VPN off for viewing | Netflix Help |
| Part of a page | Failure to transmit large packets: loading stalls | Check the packet size | RFC 2923 |
| A site by name | Name resolution error: the browser cannot find the address | Check the tunnel's DNS settings | wg-quick guide |
| An Android app | Direct outgoing traffic is forbidden by the system | Check the blocking of connections without a VPN | Android documentation |
If all pages have stopped opening, use the check sequence for the case when the VPN is connected but there is no internet. Here we are interested in a partial failure.
What can you do about service restrictions?
Google states outright that some VPNs and tunnelling services may lead to the blocking of all traffic in its search. The check is also affected by the activity of other users of the shared address.
For Netflix, error E106 means the following: "You seem to be using a VPN or proxy. Please turn off any of these services and try again." Netflix's ad-supported plans do not support VPNs. The right course of action here is to disable the tunnel for that service. There is no need to try server after server in order to circumvent the restriction.
For banks and government services, act in the same way: open them directly and comply with the sign-in requirements. Never, under any circumstances, attempt to bypass identity checks or anti-fraud measures.
How to leave a single app outside the VPN
Split tunnelling leaves the chosen app outside the tunnel. On Android, apps on the exclusion list use the network as if the VPN were not running. The rest of the traffic may continue to go through the tunnel.
Choose the action according to the scale of the task:
| Method | When it suits | What changes |
|---|---|---|
| Turn the VPN off temporarily | You need to open a service once | All of the device's traffic may go direct |
| Exclude the app | A bank regularly refuses while the VPN is on | All of that app's network traffic bypasses the tunnel |
| Allow access to the home network | A printer, camera or storage is inaccessible | Local traffic stays within the home network, if the client supports such a rule |
To leave a bank outside the tunnel, I recommend using CitadelVPN's split tunnelling. The service includes this capability, but the rules depend on the client and the platform. Check whether per-app exclusions are available; if the setting is unclear, give support the name of the client and the device's system. The bank will see your ordinary connection address.
On Android there is an important caveat: the "Block connections without VPN" mode forbids direct connections. It can leave both an excluded app and an app tied to a particular network without connectivity. Exclusion from the tunnel does not lift the system-wide prohibition. Restrictions on a work device must be changed by the administrator.
Why does a page load only halfway?
The maximum transmission unit (MTU) limits the size of a single packet on a segment of the path. The tunnel adds headers, and a packet, once encapsulated, may no longer fit. If notification of this fails to reach the sender, small packets get through whilst the transfer of large ones stalls. This case is described in RFC 2923.
In essence, the beginning of a page may load whilst the rest remains stuck. This is a reason to check the MTU, although similar stalling can occur for other reasons too.
For a technical check, proceed step by step:
- Save the original MTU value before changing it, because the result needs to be compared on the same page and the change undone if necessary. There is no universal number for all tunnels.
- Check the Domain Name System (DNS), which translates a site's name into a network address, because the method of name resolution may change when a VPN is enabled. An address lookup error calls for this check before changing the MTU.
- Check how the client handles Internet Protocol version 6 (IPv6), because the availability of routes for IPv4 and IPv6 may differ. Permanently disabling IPv6 is no substitute for proper tunnel configuration.
If the failure depends on the network, use the VPN check on a particular Wi-Fi network. When sharing via a mobile hotspot, likewise distinguish between a website's refusal and a lack of connectivity on the connected device.
Why do home devices disappear?
With a full tunnel, traffic to the local address of a printer, network-attached storage (NAS) or camera may mistakenly be sent into the VPN or blocked by the client. Meanwhile external websites continue to work.
Allow access to your home network, if the client supports it, and try printing again. The request to the printer should stay within your home network. Excluding an app helps only when it is precisely that app's traffic which needs to go direct.
Why do home devices disappear?
The request to the printer should stay within your home network.
Frequently asked questions
What should I do if the Google captcha keeps coming back?
Complete the reCAPTCHA. If it recurs, Google recommends checking the device for malware, disabling or changing the VPN, or contacting its provider. Changing services does not guarantee the checks will disappear.
If fast.com does not open, is the VPN broken?
No, a single inaccessible site is not enough for such a conclusion. Netflix suggests checking the country shown on fast.com in the detailed test, but a failure of the test itself must be judged by its symptoms: a restriction message, an address error or a stall.
What should I check if Netflix shows E106 even without a VPN?
Check whether a VPN is built into your antivirus software or on the router. Netflix also lists, among the possible causes, the device's network settings and the configuration of the internet provider.
Choosing an action by symptom
If a service is clearly refusing, turn the VPN off for it or exclude the app. If a page loads partially, check the MTU; if there is an address lookup error, check the DNS. A home printer needs access to the local network. On Android, check separately the ban on connections without a VPN: whilst it is in force, excluding an app will not give it direct internet access.