My Linux VPN Protected the Internet—and Cut Me Off From Everything at Home

The release archive I needed was six feet away from me and completely unreachable. It sat on the NAS beside my desk, ready for a 6 p.m. client handoff. On my Linux laptop, the file manager kept spinning beside nas.local. The backup dashboard was blank. Even the network printer had disappeared. I blamed the NAS, checked its lights and restarted the file-sharing service from its front panel. Nothing changed.

I returned to the laptop and tried the NAS by its local IP address.

No response.

Then I disconnected the VPN.

The shared folders appeared immediately. The backup dashboard refreshed, and the printer returned before I had closed the network settings.

The NAS had never been down. My VPN had protected the laptop from the internet by cutting it off from the room.

The problem arrived with my move to Linux

I had installed Linux on an older desktop after Windows 10 support ended in October 2025. I was not alone in looking for a useful second life for ageing hardware. Zorin OS, one of the distributions aimed at people moving from Windows, reported more than 3.3 million downloads for version 18 within its first six months. (Zorin Group, “Zorin OS 18.1 Is Released,”)

The migration itself had gone better than expected. My browser profiles returned. The printer appeared automatically. The NAS was available in the file manager, and the old machine felt responsive again.

Then I installed the VPN.

At first, the result looked ideal. My public IP changed, browsing worked and the kill switch prevented traffic from escaping when I tested a manual disconnect.

Only later did I notice what else had vanished.

The printer could not be found while the VPN was active. The NAS worked only after I disconnected. A local development page hosted on a Raspberry Pi timed out, and the media server on the television behaved as though the laptop had left the house.

Four devices had not failed at the same moment. The VPN was treating my local network as part of the threat.

A full tunnel can be too complete

Linux uses routes to decide where traffic should go. Devices such as a NAS or printer usually remain inside a private home network, while ordinary web traffic follows the route to the internet.

A VPN changes those paths. It may also add firewall rules to prevent traffic from escaping outside the encrypted tunnel. NetworkManager supports separate routing tables and rules because VPN routing often needs more nuance than replacing one default connection.

The security logic makes sense on unknown Wi-Fi. A laptop in an airport lounge should not automatically trust every nearby device.

I was not in an airport lounge.

I was at home, trying to reach storage, printers and development devices that I owned. The strict setup made no useful distinction between an unknown computer in a café and the NAS sitting beside my desk.

Other Linux and desktop VPN users describe the same practical result: the VPN connects, but printers, file shares or remote machines disappear until it is turned off.

That brief pattern was enough to explain my situation. The deadline made it urgent.

I could disconnect the VPN and retrieve the release archive, but the browser, messaging app and client upload would then continue outside the protected connection. Or I could leave the VPN active and remain securely separated from the file I needed to send.

Neither option completed the handoff.

The established provider made me manage the exceptions

I started with the provider’s Linux support pages.

That was the reasonable first move. The company had years of public history, a large server network and considerably more documentation than most smaller services. I trusted it and assumed the correct setting was hidden somewhere in the app.

The desktop client offered a kill switch and several protocol choices, but no simple way to say: this is my trusted home network; keep it reachable.

The documentation led me toward route exclusions, split tunnelling and manual firewall changes.

I added an exception for the NAS subnet.

The IP address began responding.

The hostname still did not.

After another adjustment, nas.local returned, but the printer remained missing because its discovery traffic followed a different path. I repaired that, reconnected the VPN and lost the NAS route again.

By 5:25 p.m., I had three terminal windows open and a growing collection of commands copied from support pages and forum discussions.

The provider’s documentation had helped me identify the pieces. It had also made me responsible for assembling them correctly.

Every fix created another question. Would it survive a reboot? Would the same rule remain active on public Wi-Fi? Had I allowed only the NAS, or accidentally opened the whole local subnet? Would the kill switch erase the exception after the next connection?

I had installed a VPN to manage traffic safely.

Instead, traffic management had become the job standing between me and the client.

The browser extension avoided too much

A free browser VPN offered what looked like an easy shortcut.

Because it protected only browser traffic, Linux left the rest of the local routing untouched. The NAS returned, and I could open its dashboard while the extension changed the browser’s apparent location.

For a few minutes, that seemed clever.

Then I downloaded the release archive and opened the terminal to verify it. The browser used the encrypted proxy connection. The terminal, file-sync client and messaging app did not.

The extension preserved local access by avoiding most of the computer.

That was not the balance I needed. I wanted public internet traffic protected and local devices reachable at the same time. I did not want to remember which applications belonged to which side of the setup.

The failed shortcut made the real standard clear: the VPN needed to understand that the public internet and a trusted local network were not the same destination.

The smaller app kept the room connected

I opened OnlydogVPN and selected the preset for working on a trusted local network.

Then I connected.

Before checking my public IP, I returned to the file manager.

The NAS folders opened.

The backup dashboard showed its normal green status. The printer remained visible, and the Raspberry Pi development page loaded at its local address.

Only then did I check the external connection. The browser was still using the VPN route.

That was the arrangement I had been trying to build manually: devices inside the room stayed reachable, while public internet traffic remained protected.

I copied the release archive from the NAS, verified its checksum in the terminal and uploaded it to the client’s review folder. The messaging app stayed connected throughout the transfer.

At 5:47 p.m., the upload completed.

The result was more persuasive than another settings page. I had retrieved a local file, verified it and sent it through the protected connection without disabling the VPN or editing the routing table.

A few minutes later, I printed the shipping label for the same project. The printer started behind me while the browser remained inside the tunnel.

The laptop finally behaved as though local access and internet protection were parts of one workflow rather than competing modes.

The explanation fit into one routing decision

The trusted-network preset kept private local destinations on the home connection and sent public destinations through the VPN.

That was all I needed to understand.

WireGuard describes the same underlying routing principle: selected address ranges determine which traffic belongs inside a tunnel. The useful question is not whether every packet can be encrypted. It is whether each packet is being sent along the route that matches its destination.

I could not see which internal routing or firewall rule in the first client discarded the local traffic. The visible difference was clear: its blanket setup repeatedly removed the devices I needed, while the smaller app preserved them and completed the handoff.

“Route everything” had sounded safer until “everything” included the storage device holding my work.

Linux flexibility was not the same as usability

Linux gave me enough control to solve the problem myself.

With more time, I could have built custom route tables, firewall chains and scripts triggered whenever the VPN connected. An experienced network administrator might even prefer that approach.

But the ability to repair a setup is not the same as the setup fitting the task.

The established provider gave me enough documentation to become responsible for every exception. The smaller app turned the exception into a situation I could select.

That distinction matters on a Linux desktop. Home users often depend on NAS devices, printers, media servers, development boards and other machines that should remain inside the private network.

A VPN that makes those devices disappear may still protect public traffic. It is simply drawing the security boundary in the wrong place for the room it is being used in.

The compromise is the smaller public record

The service has fewer server locations than the established provider. It also has a shorter public history, fewer ratings and less independent testing.

Those limitations matter when someone needs a particular country, an unusual city or the reassurance of many years of public scrutiny.

The larger provider clearly offered broader geographic choice and deeper troubleshooting material.

Neither advantage addressed the failure in front of me. London, New York and Frankfurt all sat beyond the same broken local route. Changing the destination server could not restore a NAS the VPN had blocked before the traffic left my desk.

For this task, preserving the network I was already inside mattered more than offering another place to exit from.

The safest connection was not the one that blocked the most

I began by treating the kill switch as a simple measure of protection.

If nothing could escape the VPN, the setup must be working.

That definition ignored what I needed the computer to do. Public traffic had to remain protected, but the laptop also had to reach the private devices that made it useful.

The browser extension preserved local access by leaving most applications outside its protection. The established provider protected the full system but forced me to reconstruct local access manually. The trusted-network preset kept both sides working without turning the handoff into a routing exercise.

The file reached the client because the VPN stopped treating my own desk as part of the public internet.