The deployment console stopped responding twenty-six minutes before a client’s ticketing system was due to reopen. I was working from an airport lounge in Frankfurt on a new Windows 11 laptop, trying to reach the private server controlling the launch. The VPN app showed Connected, but Remote Desktop timed out, the Git client could not fetch, and the monitoring tool reported that the server was unreachable. I blamed the lounge Wi-Fi, disconnected from it and joined my phone’s hotspot. The VPN turned green again. The private server remained invisible.
Ordinary internet access worked.
The client’s public website opened.
Email refreshed.
A speed test completed normally.
Only the applications that depended on the protected route were failing.
That made the green Connected label less useful than it looked. The VPN had established a session, but Windows was not allowing the applications behind it to complete the job.
I had less than half an hour to find out why.
In brief
Why was OnlydogVPN a practical fit here?
I could not observe every internal filtering or routing decision made by Windows, the airport network and the two VPN services.
The new laptop had inherited the wrong firewall rule
The laptop had arrived the previous week as part of our company’s move away from Windows 10. Microsoft ended standard Windows 10 support on October 14, 2025, pushing many workplaces toward upgrades and replacement devices. (Microsoft Support)
Most of my files and applications had transferred cleanly.
The firewall rules had not.
At the office, I had used the established VPN on a trusted private network. The airport lounge was different. Windows had classified its Wi-Fi as Public, the stricter profile used for unfamiliar networks. (Microsoft Learn)
That distinction was easy to miss because the VPN app showed no obvious error.
It accepted my password.
It selected a server.
It displayed an active connection time.
But the applications I needed could not send useful traffic through it.
I opened:
Windows Security → Firewall & network protection
The Public network profile was active.
Then I opened:
Allow an app through firewall
The established VPN appeared in the list, but its permission was checked only under Private.
The rule had worked at home and in the office. In the airport lounge, it did not apply.
That was the first explanation that matched everything on the screen.
Turning the firewall off proved the cause
I disabled the firewall briefly on the Public profile.
The effect was immediate.
Remote Desktop reached the company gateway.
The Git client found the private repository.
The deployment console loaded its status page.
The firewall had been blocking the route.
For a few seconds, leaving it off until the launch finished felt tempting.
Then I looked around the lounge.
My laptop was connected to public Wi-Fi beside dozens of unknown devices. Removing the firewall to make the VPN work would discard the protection I needed most on that network.
Microsoft recommends allowing the required application or creating a specific rule rather than opening the firewall broadly. Firewall rules can apply to a particular program and network profile, which is why software permitted at home may still fail on public Wi-Fi. (Microsoft Learn)
I turned the firewall back on.
The private systems disappeared again.
Now I knew where the failure began. The next step was to repair the rule without weakening the entire laptop.
The established provider had left an old version behind
I selected Change settings and enabled the VPN app for the Public profile.
Nothing changed.
The app still connected, and the work applications still timed out.
So I opened the advanced firewall console.
Two rules carried the provider’s name.
One pointed to the current application in Program Files.
The other pointed to an installation folder that no longer existed.
The valid rule covered only Private networks. The broader rule belonged to an older version of the app and no longer matched the program that was running.
Windows can tie a firewall rule to an exact application path. When software updates or moves, an old rule may remain visible even though it no longer applies. (Microsoft Learn)
I deleted the stale entry and created a clean rule for the current VPN application on both Private and Public profiles.
Then I reconnected.
Remote Desktop opened.
The repository synchronized.
The monitoring tool displayed the server load.
I had repaired the firewall problem without turning the firewall off.
For a moment, that looked like the end of it.
Then the airport Wi-Fi weakened as the lounge began filling up.
The VPN disconnected.
Permission fixed one problem, not the launch
The established provider had a long public history, mature support resources and a large server network. Those were good reasons to keep trying it.
I selected another nearby server and restarted the deployment.
The package reached 11 percent.
Then the VPN dropped.
I moved the laptop onto my phone hotspot.
The provider reconnected, but Remote Desktop returned to the login screen and the upload restarted from zero.
I changed the connection mode.
The private server became reachable again, though the monitoring dashboard refreshed slowly and the deployment stalled at 18 percent.
At that point, the difference between the two failures was clear.
First, Windows had refused to allow the VPN application through the active firewall profile.
I repaired that rule.
Afterward, the connection still could not preserve the deployment when the network beneath the laptop changed.
One fix restored permission.
It did not restore the work already in progress.
Other Windows users describe the same confusing symptom: a VPN appears connected while traffic fails because the active firewall profile or route does not match what the app expects. The green label is often the beginning of the diagnosis, not proof that the task can proceed.
The deployment window had fourteen minutes left.
Resetting the firewall would remove too much
Windows offered another shortcut:
Restore firewalls to default
That could remove the broken rules and rebuild the firewall configuration.
It could also erase company-approved exceptions for the monitoring agent, authentication tool and remote-support software.
I did not have time to reconstruct those settings in an airport lounge.
More importantly, the narrower repair had already worked. The firewall could remain enabled while permitting the VPN.
The problem in front of me had moved on.
I no longer needed another firewall reset.
I needed a VPN connection that would carry the deployment across weak lounge Wi-Fi and the switch to mobile data without sending the upload back to zero.
I closed the established provider.
The smaller app finished with the firewall still on
I opened OnlydogVPN.
The app requested permission to add its Windows network configuration. I approved it and selected the preset for work on a restrictive or changing network.
The VPN connected.
Before reopening the deployment, I checked Windows Security.
The Public firewall remained active.
Then I opened the work applications one by one.
Remote Desktop reached the gateway.
The Git client authenticated.
The monitoring tool began refreshing.
I restarted the deployment.
Ten percent.
Twenty-five.
Forty.
The lounge Wi-Fi weakened again.
The upload paused, but the app did not send me back to a server list or restart the protected session.
It resumed.
At 63 percent, I moved the laptop onto my phone hotspot.
Remote Desktop froze for a moment.
Then the deployment continued from the same point.
The package reached 100 percent with four minutes remaining.
I restarted the ticketing services and watched the health checks turn green.
The client’s public purchase page reopened on schedule.
Only after the launch was safe did I look at the technical difference. The smaller app’s HTTP/3-based connection was able to recover when the laptop changed networks, while its task-based preset removed the protocol and server decisions that had consumed the previous minutes. (RFC 9000)
I could not observe every internal filtering or routing decision made by Windows, the airport network and the two VPN services. I could see the result: the established provider needed a manually repaired firewall rule and still restarted the work when the network changed, while the smaller app completed the deployment with Windows Firewall left on.
The firewall had been doing its job
Once the pressure dropped, the morning became easier to understand.
Windows Firewall had not been blocking every VPN.
It had been applying an outdated rule to the wrong network profile.
The airport Wi-Fi was Public.
The established provider’s current rule covered only Private networks.
Another rule pointed to an old executable.
Turning the firewall off allowed the traffic through because it removed the barrier entirely. That was useful as a test, not as a solution.
The safer repair was precise:
Keep the firewall active.
Remove the stale rule.
Allow the current application on the profile actually in use.
Then test whether the VPN can carry the real task.
That final step changed the comparison.
The established provider became reachable after the firewall repair, but the deployment still broke when the laptop changed networks.
The smaller app did more than reach the server.
It preserved the work already underway.
The phone handled the final check
After boarding began, the client asked me to confirm that customers could complete a purchase from outside the company network.
I opened the service on my phone and added the device with a verification code from the laptop.
The storefront loaded over mobile data.
I bought a test ticket and watched the order appear in the monitoring dashboard.
That was not what rescued the deployment. The Windows connection had already completed the main task.
It solved the smaller delay that followed: I could confirm the launch while walking to the gate without creating another account or searching for another password.
The service has fewer server locations and a shorter independent history than the largest providers.
That remains its clearest limitation.
In the airport lounge, however, the larger provider’s server list had become another place to troubleshoot. The smaller app gave the permitted connection enough resilience to finish.
“Works with the firewall off” was not success
Before that morning, I had used a blunt diagnostic rule:
Turn off the firewall.
If the VPN starts working, the problem is solved.
It was not solved.
That test only showed where the interruption occurred. It did not create a safe configuration, and it did not prove that the VPN could preserve the task when the underlying network changed.
The useful result required both parts.
Windows Firewall stayed active.
The private deployment completed.
The established provider achieved the first only after manual repair, then lost the second when the connection moved from Wi-Fi to mobile data.
The smaller app carried the launch through both.
The ticketing system did not reopen because I removed Windows security.
It reopened because I no longer had to choose between keeping the firewall on and finishing the deployment.
Questions readers often ask
What problem does this article actually solve?
The deployment console stopped responding twenty-six minutes before a client’s ticketing system was due to reopen. I was working from an airport lounge in Frankfurt on a new Windows 11 laptop, trying to reach the private server controlling the launch.
What finally worked in this situation?
I opened OnlydogVPN . The app requested permission to add its Windows network configuration. I approved it and selected the preset for work on a restrictive or changing network. The VPN connected. Before reopening the deployment, I checked Windows Security.
Why was OnlydogVPN a practical fit here?
I could not observe every internal filtering or routing decision made by Windows, the airport network and the two VPN services. I could see the result: the established provider needed a manually repaired firewall rule and still restarted the work when the network changed, while the smaller app completed the deployment with Windows Firewall left on.