Why does my VPN say 'Authentication Failed' even with the correct password?

Authentication failures with correct credentials usually mean one of three things: the VPN service uses a separate VPN username/password distinct from your account login (check the provider's dashboard), your subscription has lapsed or the account has been flagged for too many failed attempts and temporarily locked, or the client is sending a cached old password rather than the one you think you're entering. Re-entering credentials through the provider's web portal first to confirm they work, then entering the same values fresh in the client, resolves most cases.

Can Windows Firewall really block a VPN connection?

Yes — Windows Firewall can block the VPN client's network adapter driver, block specific VPN protocols (L2TP uses ports 500 and 4500 that Firewall may restrict), or block outbound connections from the VPN application entirely. Third-party security suites (Norton, McAfee, Bitdefender) with network inspection features are even more aggressive. The quickest confirmation is to temporarily disable the firewall or security suite, test the VPN, and re-enable — then add a proper app exception rather than leaving it disabled.

Why does my VPN work on some networks but not others?

Network-level VPN blocking is the cause. Some networks — corporate offices, schools, hotels, public WiFi, and ISPs in certain regions — block common VPN protocols at the gateway. UDP-based protocols (WireGuard, OpenVPN UDP) are easier to block than TCP on port 443, which resembles HTTPS traffic. If your VPN client offers an 'obfuscated' or 'stealth' mode, or the option to use TCP on port 443, enabling this almost always bypasses network-level restrictions.

Do I need to open ports on my router for a VPN to work?

For a VPN client connecting to a remote server (the typical home/work use case), you do not need to open any ports on your router — outbound connections initiate from your PC and don't require inbound port forwarding. Port forwarding is only needed if you're hosting your own VPN server at home and want to connect to it from outside. Commercial VPN clients (NordVPN, ExpressVPN, Mullvad, etc.) work without any router changes.

Windows VPN Won’t Connect? Here’s How to Fix It

Stale credentials and Windows Firewall blocks are the two most common causes. Here’s how to diagnose which one is stopping your connection and fix it.

Quick Answer

✓Re-enter your VPN credentials manually — saved credentials can become stale, especially after a password change or subscription renewal.
✓Temporarily disable Windows Firewall (Settings > Privacy & Security > Windows Security > Firewall) and retry — re-enable immediately after testing.
✓Update your VPN client from the provider's website, then try switching protocol (UDP to TCP or vice versa) in the client's settings.
✓If it fails on your current network but you suspect network-level blocking, test on a mobile hotspot to confirm.

Common Causes

Incorrect credentials or an expired VPN account

Most Likely

The most common reason a VPN refuses to connect is an authentication failure — wrong username, wrong password, or an account that has lapsed. VPN clients often store credentials and silently retry them without prompting; if the password changed after account renewal, the client keeps sending the old one. Re-entering credentials manually (not relying on saved values) eliminates this as a cause immediately.

Windows Firewall or antivirus blocking the VPN connection

Common

Windows Firewall and third-party antivirus products (especially those with network inspection features) frequently block VPN protocols or the VPN client's network adapter. This is particularly common after a Windows update or after installing new security software. The VPN client may show a generic 'connection failed' error rather than a firewall-specific message, making this non-obvious to diagnose without testing.

Outdated VPN client or conflicting protocol setting

Common

VPN client updates often include fixes for connection failures caused by changes in server-side infrastructure. An outdated client may fail silently against updated servers. Protocol conflicts are also common: a client set to use a specific protocol (OpenVPN UDP, L2TP, IKEv2) may fail on certain networks while another protocol succeeds. Most clients allow manual protocol selection in settings.

ISP or network-level blocking of VPN traffic

Less Common

Some networks block VPN traffic at the router or gateway level — this is common on certain public WiFi networks (airports, hotels, schools), some corporate networks, and ISPs in certain regions. The tell-tale sign is that the VPN works fine on your home network or mobile hotspot but fails on a specific network. Switching protocol to TCP on port 443 (which mimics HTTPS traffic) often bypasses this type of blocking.

Step-by-Step Fix

Re-enter VPN credentials manually

Open your VPN client and go to its account or login settings. Clear any saved username and password fields and retype them fresh — don't paste from a clipboard with invisible whitespace. Confirm your subscription is active by logging into the VPN provider's website. If your provider uses a separate VPN username and password (distinct from your account login), check the provider's dashboard for the correct VPN credentials.

Temporarily disable Windows Firewall and test the connection

Go to Settings > Privacy & Security > Windows Security > Firewall & network protection. Click the active network profile (Domain, Private, or Public) and toggle the firewall off. Immediately attempt to connect with your VPN. If it succeeds, the firewall was the cause — re-enable the firewall, then add an exception: Windows Security > Firewall & network protection > Allow an app through firewall and add your VPN client. Re-enable the firewall before continuing normal use.

Pro tip: Never leave Windows Firewall disabled. The test is only to confirm it's the cause — always add a proper exception rather than leaving the firewall off.

Update the VPN client from the provider's website

Avoid updating through in-app prompts alone — go directly to the VPN provider's download page in a browser and download the latest version. Uninstall the current client first (Settings > Apps > your VPN app > Uninstall), restart, then install the fresh download. This ensures you get the full current build rather than a patched incremental update.

Switch VPN protocol in the client settings

In your VPN client's settings, look for a Protocol or Connection section. If currently on UDP, switch to TCP — or vice versa. On networks that block VPNs, try a protocol that uses port 443 (the same port as HTTPS) if your client offers it (often labeled 'TCP port 443' or 'Obfuscated'). WireGuard uses UDP only, so if WireGuard is failing on a restricted network, switch to OpenVPN TCP.

Restart the computer and router

A full Windows restart clears stale VPN adapter state, driver issues, and in-memory routing table conflicts that can accumulate after sleep/wake cycles. After restarting, also restart your router by unplugging it for 30 seconds — this clears any connection-state entries the router may have cached for the previous failed VPN session.

Test on a mobile hotspot to rule out network-level blocking

Enable hotspot on your phone and connect your Windows PC to it via WiFi. Attempt the VPN connection. If it works immediately on the hotspot but not on your regular network, the issue is specific to that network (your home router, your ISP, or a public WiFi restriction) rather than the VPN client or Windows. Contact your router's admin settings or switch VPN protocol to TCP/443 to work around network-side blocking.