Using a VPN on Windows is practically essential these days , both for working remotely and for browsing more securely on public networks, but when the connection fails, the experience becomes a real headache. Authentication errors, messages with incomprehensible numerical codes, or a VPN that connects but then leaves you without internet access are much more common than you might think.
This guide provides comprehensive and practical technical support for diagnosing and resolving VPN connection and configuration issues on Windows (including AOVPN, L2TP/IPsec, SSL, and common errors such as 800, 806, 809, 812, 13801, 13806, etc.). We'll cover everything from the basics (profiles, ports, firewalls) to certificate issues, DNS problems, TAP virtual adapters, dual VPNs, and corrupted profiles, offering step-by-step solutions and recommendations for a smooth and stable connection.
Key concepts of VPN infrastructure in Windows
Before you start tweaking settings, it's helpful to understand what's involved when you connect to a VPN on Windows. Having the full picture will make it much easier to pinpoint what's wrong.
A typical remote access VPN involves at least these elements :
- VPN client (Windows or provider app).
- VPN server or concentrator.
- Firewall/router that controls traffic to that server.
- Network adapters (physical and virtual).
- Protocol/Tunnel Configuration (L2TP/IPsec, SSTP, IKEv2, SSL, etc.).
- Services such as NPS, Active Directory, and certificate infrastructures in corporate environments.
In the specific case of Always On VPN (AOVPN), things get a bit more complicated because the connection is established automatically as soon as Windows starts. This also involves distributed configuration profiles, deployment scripts, conditional access policies, and the computer and server certificates that Windows uses to negotiate IPsec.
The good news is that most connection problems are quite common : blocked ports, invalid certificates, incorrectly chosen protocols, incorrect credentials, misconfigured DNS, corrupted network drivers, or overly protective firewalls. Knowing this will help you get straight to the point.
How to properly create a VPN profile in Windows 10/11
Many errors occur simply because the VPN profile is incorrectly created , with incorrect server data, the wrong VPN type, or an authentication system that doesn't match the server side.
On Windows, the standard method for creating a built-in profile is as follows : Go to Start > Settings > Network & Internet > VPN > Add a VPN connection . Under "VPN provider," choose Windows (built-in) , enter a recognizable name for the connection, enter the server name or address (without http, slashes, or any special symbols), and select the VPN type required by your company or provider (for example, L2TP/IPsec with pre-shared key, IKEv2, PPTP, etc.). For more details on creating a profile, see How to create a VPN on Windows.
The credentials section is also critical : in “Login information type,” select the correct method (username/password, certificate, smart card, or one-time password) and fill in the username and password if you want them saved, using a password manager . If this information changes, you will need to edit it later to avoid authentication errors.
Once the profile is saved, you can go into “Advanced Options” to adjust parameters such as the use of the remote default gateway, proxy settings, allowed protocols, or whether the connection is used for all traffic or only for specific networks.
VPN connection and internet access: basic operation
When Windows marks a VPN as "Connected," it only means the tunnel has been established , not that you have guaranteed internet access. Traffic may still be stuck at any point: DNS, firewall, routing, remote server, etc.
To manually connect to a VPN that already has a profile created , click the Network icon in the taskbar, select the connection name, and click "Connect." If the VPN Settings section opens, choose the connection and click "Connect" there as well.
If the server accepts your credentials, you'll see the status "Connected" under the VPN name. From that point on, depending on your configuration, all your traffic can go through the VPN (full tunnel) or only certain network ranges (split tunnel). If you enabled the "use remote network's default gateway" option, it's normal for all traffic to go through the VPN, which can lead to loss of internet access if the server or its routing isn't configured correctly.
When the VPN connects but there's no internet access , the problem is almost always with DNS, incorrect routing, the local firewall, or the VPN server not properly routing outbound traffic. Below you'll find a section specifically for this scenario, which is one of the most common.
Typical VPN connection errors in Windows (800, 806, 809, 812, 720, 787…)
Windows displays many VPN problems as numerical codes that can be a bit alarming at first. Fortunately, most of them have very specific causes and known solutions.
Error 800: Remote connection could not be established
The 800 code usually indicates that the tunnel isn't even established . This could be due to the VPN server not responding, a firewall blocking the traffic, or missing security parameters for L2TP/IPsec.
Typical steps to correct it : check that the server name or IP is correct and accessible (ping if necessary), check that the necessary ports are open on the router/firewall (for example, TCP 1723 for PPTP, UDP 500/4500 for IPsec, 443 for SSTP or SSL) and validate that the VPN type selected on the client matches that of the server.
Error 806: Connection between your computer and the VPN blocked
Error 806 indicates that something is cutting off the tunnel halfway : it is usually the firewall (Windows or third-party) or, in some cases, an antivirus that inspects the traffic and does not properly understand the GRE protocol or others used by the VPN.
Quick test : Temporarily disable your firewall. If it works, you'll need to create a rule that allows VPN traffic and, very importantly, open TCP port 1723 (PPTP) or the ports used by your specific solution. It's also a good idea to check that your antivirus isn't aggressively filtering this traffic.
Error 809: The remote server is not responding
Error 809 typically occurs when a firewall or intermediate router blocks VPN traffic , especially after NAT or when using IPsec/IKEv2. Even without a third-party firewall, a NAT device can still cause problems.
A commonly used advanced solution is to tweak the Windows Registry adding the key AssumeUDPEncapsulationContextOnSendRule en HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgentby setting a 32-bit DWORD value to 2 and then restarting the computer. Additionally, check that UDP ports 500 and 4500, and the port corresponding to the chosen protocol, are open in the firewall.
Errors 812, 13801, 13806 and certificate codes
In corporate environments with AOVPN, errors related to certificates and policies are very common :
- 812The RAS or VPN server policy prevents the connection because the server's authentication method does not match the client's profile.
- 13806IKE cannot find a valid equipment certificate from the customer.
- 13801: IKE authentication credentials are unacceptable (invalid certificate, expired certificate, untrusted chain, etc.).
- 0 x 80070040The server certificate does not include the use of "Server Authentication".
- 0x800B0109The root certificate is not from a certification authority that the client considers trustworthy.
In all these cases, the PKI must be carefully reviewed : that the server certificate is issued by a trusted CA, in the appropriate store and with the correct uses; that the client has the root and, if applicable, the intermediate certificates installed; and that the AOVPN profile points to the correct certificate, not the first one that RRAS finds in the store.
Other common errors: 720, 787 and problems with MS-CHAPv2
Error 720 usually occurs when the WAN (IP) miniport adapter is not properly bound . Reinstalling the adapter from Device Manager usually resolves this.
Error 787 in L2TP/IPsec connections is usually caused by wildcard server certificates or certificates issued by an unexpected CA. RRAS may choose the first certificate it finds, not necessarily the correct one for L2TP, and this breaks the IPsec Security Association.
In scenarios with L2TP/IPsec using MS-CHAPv2, failures can also occur if the LmCompatibilityLevel value on the domain controller is modified from the defaults, which breaks the authentication.
AOVPN (Always On VPN) connection problems on Windows
AOVPN automates the connection of corporate devices, but it also makes errors more troublesome , because the user doesn't even manually open the VPN: the system tries to set up the tunnel in the background and, if something fails, you just see that you don't have access to the company network.
The most common reasons why AOVPN fails to connect are:
Invalid or missing equipment certificates.
Inconsistent NPS directives.
Poorly executed deployment scripts.
Problems with the Routing and Remote Access service on the server.
Specific AOVPN codes to watch out for : 800, 809, 812, 13801, 13806, and the certificate errors mentioned earlier. A small mistake in the XML profile definition, certificate assignment, or Microsoft Entra's conditional access policy can ruin the entire setup.
It's crucial to review the entire path an AOVPN client takes when attempting to connect: VPN server DNS resolution, certificate validation, IKE/IPsec negotiation, NPS policy application, and finally, IP and routing assignment. Any weak link breaks the chain.
VPN connected but without internet: causes and solutions
This scenario is one of the most frustrating: the VPN says it's connected, but the browser isn't loading anything . The problem is usually with DNS, routing, or a firewall that's blocking the actual traffic even though it allows the tunnel to be established.
- First, check that your "normal" internet connection is working.Disconnect the VPN and browse the internet. If you still can't access the internet, the problem isn't with the VPN, but with your network (router, Wi-Fi, ISP, etc.). Restart your router, check the cables, try a different network, or contact your ISP.
- If you can browse with the VPN disconnected, you need to look within Windows.Verify that your VPN application is up to date, try changing servers within the client itself (many servers become overloaded or go down), and change the protocol if necessary. your supplier It allows it (for example, from UDP to TCP or to a more modern protocol).
- One trick that solves quite a few cases is to clear the Windows DNS cacheOpen Command Prompt as administrator and run
ipconfig /flushdnsThis clears corrupted DNS entries that may be pointing to incorrect resolutions once you enter the tunnel. - Don't forget your antivirus and firewallThey may allow the VPN to connect but block subsequent DNS or HTTP/HTTPS requests. Temporarily disable your antivirus/firewall to test, and if that resolves the issue, create specific rules that allow the VPN app and the involved ports to work without limitations.
Problems with DNS and name resolution using VPN
When Windows displays "domain name resolution" errors when using a VPN, there is usually a conflict between the DNS servers your computer uses and those expected by the VPN tunnel, or the public DNS servers you have configured do not match the VPN's requirements.
The standard solution is to change the DNS servers of the network interface you are using: go to Start > Settings > Network & Internet > Change adapter options , right-click on your network card in use, select “Properties”, select Internet Protocol Version 4 (TCP/IPv4) , click “Properties” and check “Use the following DNS server addresses”.
You can enter reliable public DNS servers like Google's (8.8.8.8 and 8.8.4.4) or Cloudflare's (1.1.1.1 and 1.0.0.1) . Save, disconnect, and reconnect the VPN. In many cases, the resolution error disappears instantly.
If the problem persists, suspect the VPN itself : some free ones don't manage DNS properly, don't provide internal servers in corporate environments, or force DNS resolutions that conflict with your local configuration. Switching providers, ideally to a paid and reputable one, is usually the definitive solution.
Firewall, router and ports: the most common bottleneck
Most 800, 806, and 809 errors can be resolved by targeting the same point: the firewall and the router . Ultimately, a VPN is simply encrypted traffic through specific ports; if those ports are closed, it won't work.
- In the Windows Defender firewall you can create inbound and outbound rules that allow traffic for the VPN application and for the ports used by the selected protocol. For PPTP, ensure that TCP port 1723 and the GRE protocol are authorized; for L2TP/IPsec, check UDP ports 500 and 4500; for SSL or SSTP, TCP port 443 is typically used.
- It may also be necessary on your network router. open or redirect ports to the internal VPN server if it is your own infrastructure. In corporate networks this is usually managed by the systems team, but at home, if you set up your own VPN server or use a router with integrated VPN, you will have to check its port forwarding section.
If you find that the VPN works with the firewall disabled but not with it enabled, that's your test. The best approach is not to completely disable the firewall, but rather to fine-tune the rules until the tunnel works without compromising system security.
TAP-Windows adapter and other virtual adapters
Many VPNs install a virtual adapter called TAP-Windows (or similar) that acts as a "dummy network card" through which encrypted traffic is routed. If this adapter fails, the entire service goes down.
When the TAP adapter gets damaged, you may notice these symptoms :
- The VPN connects but the network is not responding.
- The connection drops after a while.
- Your normal network is affected even without an active tunnel.
This is usually due to corrupted drivers, incomplete Windows updates, or conflicts with other adapters.
Easy first step: restart the adapter . In "Change adapter options," locate TAP-Windows, disable it by right-clicking, and then enable it again. Sometimes that gets things working again.
If that doesn't work, the next step is to reinstall : uninstall the VPN, restart your computer, and reinstall the latest version of the client. If it still doesn't work, go to Device Manager, find the TAP adapter under "Network adapters," uninstall it, and let the VPN installer create it again. In some cases, you can even add a new TAP adapter and use it instead of the old one. To choose a reliable client, check out options and comparisons.
Double VPN that doesn't work on Windows
The so-called "double VPN" adds a second tunneling layer, chaining two VPN servers together to reinforce privacy. It sounds great, but in practice it multiplies the points where something can get stuck.
If the double VPN doesn't connect, or connects but doesn't allow browsing, there are several things to check :
- Automatic connection settings (which may be trying to connect to the first server as if it were the only one).
- Use of custom DNS within the VPN.
- Presence of active proxies in Windows.
Some concrete recommendationsDisable custom DNS in the VPN app if you're using them, and disable any manual proxies. Settings > Network & Internet > Proxyclear the DNS cache with ipconfig /flushdns And try changing the pair of servers used for the double VPN. Often it's a temporary issue with an overloaded server. If you're looking for alternatives to strengthen privacy, also consider what a Decentralized VPN.
It also helps to try other protocols within the same VPN (when possible): some handle chained scenarios better than others, and performance and stability can be significantly improved.
Advanced VPN connection management in Windows: export, import, and delete profiles
In professional environments , it's common to need to migrate VPN profiles between computers or clean up outdated configurations that only cause errors. Windows allows you to export and import connections without relying on external programs.
To Export VPN connections created with the built-in Windows client, access the route %AppData%\Microsoft\Network\Connections (You can paste it into the Explorer address bar). Inside you'll find a folder called PbkSimply copy it to a USB drive or another location, then paste it into the same place on another computer to have the same connections there.
If you need completely delete VPN profiles that you no longer useYou can do this from several places: in Settings > Network & Internet > VPN, select the connection and click “Remove”; from the Control Panel, in Network and Sharing Center > Change adapter settingsby removing the connection; or by using commands such as rasphone -R "Nombre" in Command Prompt (administrator) or Remove-VpnConnection -Name "Nombre" -Force and PowerShell.
With clients like OpenVPN, WireGuard, or specific commercial solutions It's not a good idea to delete virtual interfaces from the Control Panel, because you could delete all your profiles. In those cases, manage the deletion from within the application itself, or, if it's OpenVPN, by deleting the configuration files in the folder. config of user.
Changing and securing your VPN password on Windows
If you use the built-in Windows client to connect to a corporate VPN, at some point you will have to change your password (because it expires, due to company policy, or because you have had an authentication failure).
To change the password stored in a Windows VPN profile, go to Start > Settings > Network & Internet > VPN , select the connection, go to "Advanced" and locate the "Password" field. Enter the new password, save the changes, and test the connection.
From a security standpoint, it's important not to reuse passwords : ideally, your VPN password should be unique, long (at least 12-16 characters), with uppercase and lowercase letters, numbers, and symbols, and not a word or piece of information that directly identifies you. A password manager makes this much easier.
If the VPN is integrated with your domain user (Active Directory), remember that you don't change your password from the VPN profile, but rather from your Windows account or the usual corporate methods . The profile will simply use those new credentials the next time you try to connect.
When to collect traces and contact specialized support
There are situations where, no matter how many typical settings you try, the VPN still refuses to connect . If you work in a Microsoft enterprise environment, it makes sense to gather information before opening a support ticket.
Microsoft recommends using its Troubleshooting Scripts (TSS) to capture detailed information on both the client and server. You must run them with an administrator account, accept the EULA the first time, and ensure that the PowerShell execution policy allows RemoteSigned.
The usual procedure is:
- Download TSS to C:\tss.
- Open an elevated PowerShell window in that folder.
- Launch the cmdlets to start tracking on the client and server.
- Reproduce the problem.
- Complete the collection by entering "Y" when prompted. The logs will be packaged into a ZIP file in C:\MS_DATA, which you can then send to support.
In complex deployments involving AOVPN, NPS, Entra ID and certificates , this type of trace makes the difference between going blind for days or locating a policy or PKI failure in a single review by a second-level technician.
Ultimately , having a stable VPN on Windows comes down to mastering a few fundamentals : creating a proper profile, knowing which ports and protocols your tunnels use, managing your firewall and router, keeping your client and drivers up to date, monitoring DNS settings, and understanding common errors (800, 806, 809, 812, 13801, 13806, TAP issues, inactive SSL, double VPN, etc.). With this foundation, most problems can be resolved in a few minutes, and for more stubborn cases, you can always use advanced traces or, if the service is third-party, seek support from a reliable technical team and a trusted VPN provider.
