The router may also block the VPN's UDP ports if its filtering rules are set up to do so. Compare one phone with one VPN connection, changing only the network. That way we can separate a problem with the home connection from a fault with the service.
What should you compare between the two networks?
First, check your home internet without the tunnel. If blocking of connections outside the VPN is enabled, switching the client off will not, by itself, restore access. The Wi-Fi icon may meanwhile remain in place.
If there is no access in either network, start with the general checklist for when a VPN is connected but there is no internet. If only certain resources fail, the breakdown of problems with individual sites and apps will help.
Where the networks differ, use the following sequence:
| Parameter | How to check on home Wi-Fi | Symptom and action |
|---|---|---|
| Private addresses | Compare the device's address and mask with the VPN subnets | If they overlap, choose a free subnet on your own router |
| IPv6 | Look for IPv6 in the connection properties and in the client's settings | Check whether the tunnel handles this protocol version |
| Packet size | Look at the provider's connection type and the MTU setting | If large transfers stall, check the tunnel's MTU |
| DNS | Check the router's DNS and the private DNS on the phone | If the specified server is unreachable, check automatic mode |
| Device address on the Wi-Fi | Compare it with the addresses permitted in the router's filter | If it fails even without the VPN, fix the device's access to the network |
Change one parameter at a time in order to establish the cause. Public Wi-Fi with a sign-in page in a café or hotel requires separate testing.
How can the router's address interfere with the tunnel?
Home networks use private addresses from three ranges: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255 and 192.168.0.0–192.168.255.255. According to RFC 1918, these addresses may be reused. When overlapping networks are joined, route ambiguity arises.
For example, your phone has received the address 192.168.1.25 with the mask 255.255.255.0, and the remote VPN network also uses 192.168.1.0/24. The system sees two routes to one subnet, and depending on the routes, packets may go to home devices instead of remote ones. This is an example, not CitadelVPN's addresses.
How can the router's address interfere with the tunnel?
When overlapping networks are joined, route ambiguity arises.
This is an example, not CitadelVPN's addresses.
Check the addresses in order:
- Open the Wi-Fi network details, because the device's address and mask or prefix length are needed for comparison.
- Match the subnet against the VPN routes, because identical leading numbers without taking the mask into account do not yet prove a conflict.
- Save your router's settings before changing the subnet, because devices will have to reconnect, and the fixed addresses of printers will need checking.
The new range must not overlap with the tunnel's networks. If the client does not show them, request the details from support.
Why does the presence of IPv6 change the result?
Internet Protocol version 6 (IPv6) can operate at home alongside version 4 (IPv4), even though in another network the device uses only IPv4. If the client does not handle IPv6, the corresponding traffic may go directly, bypassing the tunnel. Such a scenario is described in RFC 7359.
In essence, some connections take a path around the VPN. This is a leak risk, but the mere presence of IPv6 does not explain every stall.
Check IPv6 support in the client's documentation. You can temporarily disable IPv6 on your device for comparison, keeping the original settings. If a difference is confirmed, you need a configuration with correct IPv6 handling.
Why do downloads stall when the connection is up?
The maximum transmission unit (MTU) limits the size of a packet sent without fragmentation. Point-to-Point Protocol over Ethernet (PPPoE), with an Ethernet payload of 1,500 bytes, leaves 1,492 bytes: eight are taken up by service fields. This limitation is described in RFC 2516.
The tunnel adds headers and reduces the usable size further. In essence, packaging has been added to a parcel already filled to capacity. If path MTU discovery does not work, small requests get through while a large transfer stalls.
| Observation | What it suggests | What to check |
|---|---|---|
| A small request goes through, but a file download freezes | A packet size problem is possible | The provider's connection type and the tunnel's MTU |
| The VPN stays in a connecting state for a long time | This sign alone is not enough to conclude it is MTU | The client's log, server availability, filtering |
| The internet disappears even before the VPN starts | The Wi-Fi itself needs restoring first | DNS and the device's access on the router |
Check the connection type on the router. If the client lets you set the tunnel's MTU, save the value and check a reduction as per its instructions. There is no universal number for all VPNs.
What should you check on Android and iPhone?
The Domain Name System (DNS) translates site names into addresses. The DNS servers of the router and the mobile network may differ; the VPN may also set its own.
On Android, check "Private DNS". With a manually specified server name, strict mode applies: if the server is unreachable, the system marks the network as having no internet. Temporarily choose automatic mode and repeat the test. Private DNS does not necessarily conflict with the VPN.
On iPhone, the Private Wi-Fi Address feature changes the hardware (MAC) address of the network interface. If your own router only admits devices on its MAC address list, check it against the phone's address for that network.
If there is no access even without the VPN, Apple recommends first updating the software and reconnecting, and only then considering whether to turn off the private address. Normally the feature does not interfere with the network's operation.
When should you try a different VPN transport?
If local causes have been ruled out, check your router's filtering. The User Datagram Protocol (UDP) may be blocked by individual rules, but this is not a universal router setting. Never, under any circumstances, disable the entire firewall just for a test.
For comparison, if you use CitadelVPN, refresh the subscription in a compatible client and choose a connection with a different transport: the service lists VLESS TCP/gRPC/xhttp and Hysteria2. The buttons depend on the client. Although changing the transport does not guarantee availability or speed, retesting on the same Wi-Fi will help narrow down the cause.
On a work, school or university network, do not change settings to circumvent its rules. For a personal VPN, use your own device and your own network.
Frequently asked questions
Why does everything work on mobile data but not at home?
A successful connection shows that the configuration is capable of working in at least one network. It does not test the home routing and does not prove deliberate blocking by the provider.
Should I disable IPv6 on the router permanently?
No. Even if temporarily disabling it changed the result, it is a reason to check the client's IPv6 handling. Changing the whole router's setting affects the other home devices.
Should I immediately turn off the private Wi-Fi address on iPhone?
No. If the internet works without the VPN, there is little reason to start with this feature. It is checked primarily when the network connection itself fails or when access is restricted by MAC address.
Action plan for the home network
If the VPN fails only at home, check for overlapping subnets, IPv6 handling, MTU and DNS. On an iPhone with a MAC filter, check the private address. Change one parameter at a time, keeping the previous value. Try a different transport only after ruling out local causes; give support the network type, the symptom and the setting that changed the result.