Culvert VPNVPN not connecting on Android: a checklist
A VPN that will not connect on Android usually has no internet underneath, a filtering network, a revoked permission or a wrong clock; check in that order.
When a VPN will not connect on Android, the cause is nearly always one of a short list: the phone has no working internet underneath the VPN, the network is filtering the VPN's traffic, the app's VPN permission was revoked or another VPN is holding it, or the phone's clock is wrong. Work through the checklist below in order. Each step rules something out, and the order runs from the most common cause to the least.
The checklist
- Does the internet work with the VPN off? Disconnect and open any website. If nothing loads, the VPN is not your problem. On hotel, café and campus Wi-Fi the usual reason is a sign-in page you have not accepted yet; the captive portal post explains why the VPN cannot connect until you do.
- Try the other network. If you are on Wi-Fi, switch to mobile data and connect; if on data, try Wi-Fi. If it connects on one and not the other, everything on the phone is fine and the failing network is filtering the connection. Skip to the section on filtered networks.
- Check for another VPN. Android allows one VPN at a time. A second VPN app, an always-on profile from a work or school app, or an ad-blocking or DNS app that uses the VPN slot will stop yours from starting. Go to Settings, Network, VPN and look for anything marked always-on or connected.
- Check the permission. The first connect shows a system prompt asking to set up a VPN connection. If it was dismissed, or revoked later, the app cannot create a tunnel. Disconnect and reconnect to see the prompt again, and accept it.
- Check the date and time. Every connection method depends on certificates or keys that are only valid within a window of time. A clock that is minutes off, on a phone with automatic time turned off, fails the handshake. Turn on automatic date and time in Settings.
- Check battery restrictions. If the app is set to restricted background use, Android can stop its service while it is connecting. Set it to unrestricted, or "not optimised", for the VPN app.
- Check Private DNS. If Private DNS is set to a hostname and that provider is unreachable on this network, the phone cannot resolve the VPN server's name and refuses to fall back. Set it to automatic and try again.
- Try a different city. A single city can be full or briefly unhealthy. Pick another, or pick the country and let the app choose.
- Update the app. An old version may use a connection method the servers no longer offer. Update from Google Play; only reinstall if updating does not help.
When the network is filtering
Step 2 is the fork in the road. If the VPN connects on mobile data but not on the Wi-Fi, the Wi-Fi is dropping the VPN's traffic. Office, campus and hotel networks commonly block UDP, block the ports VPN protocols use, or inspect traffic and drop anything that looks like a VPN handshake.
A well-built app does not give up at the first method. It tries a fast UDP-based method first, then slower methods that look like ordinary web traffic on TCP port 443, and keeps whichever one gets through. That takes time, because a network that silently drops packets, rather than refusing them, uses up each method's full time budget before the app moves on. Ten seconds to a minute or two on "connecting" on a restrictive network is the app doing its job, not hanging. What to expect and what to do next is in the Wi-Fi blocks VPN connections.
If every method fails, that network blocks all of them, and the answer is mobile data or a hotspot from your phone.
Reading the error
Some failures come with a message, and the message narrows it down.
| Message | Usual meaning |
|---|---|
| Authentication failed | Expired session or a wrong clock, not a wrong password; see the errors post |
| Handshake timed out | The network dropped the packets; the app should try the next method |
| Permission denied | Step 4 |
| Another VPN is active | Step 3 |
| No network / not connected | Step 1 |
| Certificate or TLS error | Step 5, or a network that intercepts HTTPS |
An app with no message that fails within a second usually has a local problem: permission, another VPN, or a service that was stopped. One that fails after a long wait usually has a network problem.
When it connects and nothing loads
That is a different problem with different causes, mostly DNS and routing, and it has its own checklist in VPN connected but no internet. The distinction matters: a tunnel that came up is past everything on this page.
Culvert VPN tries several connection methods in turn when a network filters one, without asking you to choose a protocol, and is on Google Play.
Questions people also ask
It connects on mobile data but not on this Wi-Fi. What does that tell me?
That the app, your phone and your account are all fine and the Wi-Fi is filtering the connection. Give the app a minute to try its other methods; if none gets through, that network blocks all of them and mobile data is the answer.
Why does it sit on "connecting" for a long time before failing?
Because each connection method gets its own time budget before the app moves to the next, and a network that silently drops packets, rather than refusing them, uses up every budget. A fast failure usually means a local problem; a slow one usually means the network.
Do I need to reinstall the app?
Rarely. Reinstalling only helps when the app's own stored state is damaged, which is uncommon. Work through the rest of the checklist first, and update from Google Play before you reinstall.