Why Does My VPN Keep Disconnecting? How to Fix It

Why does my VPN keep disconnecting? Find what is dropping first

"Disconnected" can mean three different things, and each points to a different fix:

• The tunnel is stopped. The VPN icon disappears and the app shows the VPN as off. Think power management, sleep or another VPN app taking over.
• The tunnel stays up, but traffic stops. The app says connected, yet pages hang until you toggle the VPN. Think handshakes, network changes or MTU.
• The network itself drops. The connection is just as unstable with the VPN off; the VPN only makes it easier to notice.

With WireGuard-based protocols such as AmneziaWG, "connected" means the tunnel interface is active, not that the server is answering. WireGuard keeps no permanent connection open: it sends packets only when there is something to send and renews its session keys with a fresh handshake about every two minutes while traffic flows. If your client shows a last-handshake time or a received-data counter, a counter that stops growing while you browse says more than the status label. VLESS clients are similar: "connected" means the local tunnel is running, not that the server is reachable.

Note when the drops happen, then compare: the same network with the VPN off, another network, and another device with its own key. Drops on one network point to that network; drops on one device point to its settings.

Android: battery optimization and Always-on VPN

On Android, the tunnel runs in the VPN app's background service, and power management decides how much freedom it gets. Aggressive battery settings are the most common reason a VPN drops soon after the screen turns off, and some manufacturers add their own background-app controls on top.

1. Open the VPN app's page in system Settings, go to its battery section and choose unrestricted instead of optimized. The wording varies by Android version and manufacturer.
2. If your phone keeps a separate list of sleeping or auto-closed apps, take the VPN app off it.
3. Turn on Always-on VPN for the app: open the VPN section of the network settings and tap the settings icon next to the app's name. If the app supports it, Android starts the VPN at boot and keeps it running.
4. Lock the screen for longer than it usually takes to drop, then check that the VPN is still connected.

Android allows one active VPN at a time. If another app takes the VPN slot, such as a second VPN client or an ad-filtering, firewall or security app that routes traffic through a local VPN, your VPN disconnects.

Always-on VPN has a companion lockdown option that stops all traffic while the VPN is down, so a drop looks like a full internet outage. Turn it off while you troubleshoot.

iPhone: Low Power Mode, background refresh and the VPN profile

On iOS, the tunnel runs as a system network extension, separately from the app on screen, which is why the VPN keeps working after you swipe the app away. If an iPhone drops the VPN, check:

• Low Power Mode cuts back background activity across the system. If drops start when it is on, leave it off for a day to confirm.
• Background App Refresh does not keep the tunnel alive, but some clients use it to refresh a subscription, so keep it on for your VPN app.
• Duplicate VPN profiles. Each VPN app adds its own configuration to the VPN section of Settings, and only one can be active, so starting one stops the other. Delete the ones you no longer use.
• Connect On Demand. Some apps add this toggle to the profile's details in the VPN settings; with it on, iOS reconnects according to the app's rules.

If the drops continue, update iOS and the VPN app, then delete the VPN profile and import your key again.

Windows and Mac: sleep, adapters and other VPN clients

Windows

1. In Device Manager, open the properties of your Wi-Fi or Ethernet adapter. If it has a Power Management tab, clear the option that lets Windows turn the device off to save power.
2. Check the sleep settings: when the PC sleeps, the adapter goes down and the tunnel with it. If the client says connected after waking but nothing loads, toggle the VPN once.
3. Uninstall VPN clients you no longer use. Each adds virtual adapters, routes and DNS settings, and two active clients compete for them, which can leave a tunnel up but carrying no traffic.
4. If security software filters your network traffic, pause that feature briefly. If the drops stop, turn it back on and add the VPN app to its exceptions.

Mac

macOS suspends most network activity during sleep, and a MacBook on battery sleeps sooner by default, so check the Battery or Energy settings if the VPN must stay up with the display off. VPN clients and some security tools install network extensions: keep one VPN active at a time and remove leftovers from apps you have deleted.

Switching between Wi-Fi and mobile data

Every network switch changes your public IP address, and the tunnel has to adapt. How it adapts depends on the protocol:

• AmneziaWG (WireGuard-based, over UDP). WireGuard was designed for roaming: once the client sends an authenticated packet from its new address, the server sends replies there. You usually notice a brief pause, not a disconnect.
• VLESS + Reality (over TCP/TLS). TCP connections are tied to the old address, so they break and the client opens new ones. A download or call in progress may stop, while new pages load normally.

Trouble starts when the phone keeps flipping between networks at the edge of Wi-Fi range, or when the system moves to mobile data because Wi-Fi is weak (Wi-Fi Assist on iPhone, similar options on Android). Turn off auto-join for weak networks you pass often, or switch Wi-Fi off while on mobile data.

On public Wi-Fi with a sign-in page, the VPN cannot connect until you sign in, and many hotspots end sessions after a set time, which looks exactly like a VPN drop: sign in again and reconnect. More on hotspots in our guide to hotel and airport Wi-Fi.

MTU and handshake problems with WireGuard-based protocols

WireGuard MTU: the tunnel is up, but large transfers stall

The MTU (maximum transmission unit) is the largest packet a link can carry: 1500 bytes on most Ethernet and Wi-Fi networks. WireGuard adds 60 bytes of headers to every packet over IPv4 and 80 over IPv6, which is why 1420 (1500 minus 80) is a common default for WireGuard interfaces. When a link on the path has a smaller MTU, as PPPoE broadband and some mobile connections do, full-size tunnel packets get lost while small ones get through: messages send, but pages load halfway and downloads freeze. AmneziaWG can add a few bytes of padding depending on its version and settings, so leave a small margin.

There is no universal VPN MTU, so measure yours from a computer on that network:

1. With the VPN off, ping a public host that answers ping, with the don't-fragment flag set and a 1472-byte payload: ping -f -l 1472 host on Windows, ping -D -s 1472 host on macOS, ping -M do -s 1472 host on Linux.
2. If the reply says the packet needs to be fragmented or the message is too long, lower the payload until replies come back. If no size gets a reply, that host does not answer ping, so pick another.
3. Add 28 bytes (IPv4 and ICMP headers) to the largest payload that worked to get the path MTU, then subtract 80 for a tunnel MTU that suits both IPv4 and IPv6. A 1492-byte path, for example, gives 1412.
4. If your client lets you edit the profile's MTU, set that value and reconnect. If it does not, send the value to support.

Lower the MTU in small steps and never below 1280, the minimum IPv6 requires: below that, IPv6 traffic inside the tunnel stops working.

WireGuard handshake failures and idle timeouts

The handshake is the short key exchange that opens a session. Session keys expire after about three minutes, so a client that cannot complete a new handshake stops passing traffic while still showing as connected; its log shows the attempts being retried. The usual causes apply to AmneziaWG too (see how WireGuard works):

• One key on two devices. A key is a single peer on the server, which tracks one address and session per peer, so two devices sharing it keep taking over each other's session. Flex-VPN recommends a separate key for every device.
• A clock that jumped backwards. Each handshake carries a timestamp, and the server rejects one older than the last it accepted for that key. Set date and time to automatic.
• Idle NAT timeouts. Routers and mobile networks forget idle UDP mappings. The tunnel recovers as soon as your device sends something, but meanwhile incoming traffic such as notifications cannot arrive. WireGuard's PersistentKeepalive sends a small packet at a set interval to keep the mapping open; its documentation suggests 25 seconds.
• An expired subscription. When access ends, the profile stops working; after renewal, existing profiles usually work again without a new key.

When to switch protocol and what to send support

Flex-VPN offers two profile types: AmneziaWG (WireGuard-based, over UDP) and VLESS + Reality (over TCP/TLS). If one profile is unstable on a particular network but fine elsewhere, and power settings and MTU are ruled out, try the other one there. The AmneziaWG vs VLESS + Reality comparison explains how they differ. You can keep both installed with only one active, but update your client first: current apps are on the download page.

If the drops continue, contact support with:

• device model, OS version, app name and version, and profile type;
• network type and whether drops also happen on another network;
• the pattern (screen lock, regular intervals, moving around, waking from sleep);
• the time of a recent drop with your time zone, plus a screenshot or log excerpt;
• your measured path MTU, if you ran the test.

Never post your key or logs in public chats or forums: anyone who has the key can use your profile.