Why My Internet Worked Only With a VPN—and Failed Again When the Tunnel Dropped

The deployment dashboard stopped loading with 18 minutes left before a client review. Slack messages remained on “sending,” the code repository timed out, and the client’s own website returned a connection error. My laptop still showed a full Wi-Fi signal, so I restarted the browser, disabled an extension and rebooted the router. Nothing changed. Then I turned on a VPN already installed on the laptop. Every tab loaded at once. When I disconnected it, the internet appeared to break again.

The VPN icon was a clue

My first thought was that the VPN had damaged a setting on the laptop.

That explanation was plausible. A VPN kill switch can block internet access whenever the encrypted connection is absent, and an always-on version can continue blocking traffic after a restart or manual disconnect. A broken DNS setting or leftover network route can create a similar symptom.

Then I tried the client website on my phone.

It failed while the phone was connected to the same home Wi-Fi. I turned Wi-Fi off, switched to mobile data and refreshed. The site opened immediately without a VPN.

That small test changed the diagnosis. The laptop was not the common factor. The home internet connection was.

The timing added another clue: a football match had just started.

Research by the Open Observatory of Network Interference documented widespread IP-address blocking on Spanish networks during LALIGA broadcasts. Because unrelated websites often share infrastructure from companies such as Cloudflare, Amazon, Microsoft and Akamai, blocking one address can make thousands of legitimate services disappear with it. OONI found that more than 554,000 domains had been affected at some point between January and June 2026.

My connection was not completely offline. Search still worked, and several large websites opened normally. It only felt as though “the internet” required a VPN because the services I needed were caught behind the provider’s blocked route.

The VPN had not repaired the ISP. It had taken a different road around it.

Why the same sites returned through the VPN

Without the VPN, my provider tried to connect directly to the addresses behind the client dashboard, repository and messaging tools. If those addresses were included in the block, the connection stopped before the websites could answer.

With the VPN on, my laptop first connected to the VPN server. The client services were then reached from that server’s network instead of through the blocked path from my home provider.

The browser made the result look more mysterious than it was:

VPN off: the site timed out.

VPN on: the same site loaded.

Nothing had changed on the website or in my account. Only the route had changed.

Vercel described the same problem after websites on its infrastructure became inaccessible in Spain: entire IP addresses were blocked, taking unrelated services down alongside the intended targets.

A developer caught in one of these blocks described seeing normal requests at the server while Spanish users still could not connect during football matches. That short detail matched the situation perfectly. The service was running. The users were online. The path between them had vanished.

Once I understood that, restarting the browser again made as much sense as restarting a car because a road ahead had closed.

I no longer needed to repair the laptop. I needed a route that would stay open until the deployment finished.

The familiar VPN worked—until the Wi-Fi moved

The established VPN was the obvious first choice.

It had a long public history, a mature desktop app and more server locations than I would ever need. I selected a nearby country, waited a few seconds and watched the dashboard return.

The pending Slack messages sent. The repository opened. I restarted the deployment.

Then the router briefly lost its connection.

It was not a dramatic outage. The Wi-Fi icon disappeared for a few seconds and returned. Normally, a browser tab would pause and continue. This time the VPN remained on Reconnecting, and every work service froze with it.

Because the direct route was still blocked, there was no useful fallback. The tunnel had become the internet connection. When it failed, everything failed.

I changed servers. The app connected again, but the deployment session had expired. I signed in and restarted it. Another short interruption sent the VPN back into the same reconnecting loop.

The app offered plenty of countries to try. None of them answered the problem in front of me.

I did not need a longer server list or a higher laboratory speed. I needed the tunnel to recover before the client session expired.

That distinction became obvious only after the second failed deployment.

The backup recovered before the session expired

I opened OnlydogVPN and chose the preset for an unstable or restrictive connection.

There was no country-by-country experiment. The service connected, and I returned to the deployment page.

The build started again.

At 62 percent, the home Wi-Fi dropped for the third time. Rather than wait for the router, I enabled my phone’s hotspot and joined it from the laptop.

The browser paused.

Then the deployment counter continued.

The encrypted connection recovered across the switch before the client session expired. The build finished, the new version appeared on the client site, and I sent the review link with six minutes left.

Only after the work was delivered did I look at why the second app had behaved differently.

The service uses HTTP/3-based transport and is designed to recover on weak or changing networks. In this situation, that mattered more than the number of locations shown on a map. The home route remained blocked and unstable, but the tunnel survived the change underneath it.

That was the first reason the app fitted this particular failure.

When the internet only works through a VPN, a short tunnel interruption is no longer a small inconvenience. It becomes a complete loss of access. Recovery determines whether the call, upload or login finishes.

The smaller service has fewer server locations, a shorter public history and fewer independent reviews than the established provider I tried first. Those are real limitations. They simply did not decide whether the deployment survived that afternoon.

The major provider had more infrastructure. The smaller app recovered on the connection I actually had.

The smaller reason I kept it running

With the deployment complete, I opened the client site again to check the finished page. A blocked-request counter began increasing as advertising and tracking requests were filtered.

I could not independently inspect every internal filtering rule. What I could see was that fewer background requests completed while I moved through the review pages.

That was not what restored access. The alternate route had already done that.

It solved a smaller problem that appeared once the main one was over. The ISP no longer saw the individual destinations inside the tunnel, while fewer third-party advertising and analytics connections left the browser.

The counter was not the reason I had installed the app. It was the reason I did not remove it as soon as the review link was sent.

When the cause is closer to home

The diagnosis would have been different if the client website had worked normally on my phone over the same Wi-Fi.

When only one device loses all connectivity after a VPN is disconnected, the first place to check is the kill switch or always-on setting. Those features are meant to prevent traffic from leaving outside the tunnel, so they can make the internet appear broken when the VPN is off.

A leftover network adapter, custom DNS setting or damaged route can also affect one device while every other device continues working.

My pattern was different:

Both devices failed on the home network.

The same sites worked over mobile data.

They also worked through a VPN.

The failures matched a documented period of ISP-level blocking.

That pointed away from a damaged laptop and toward partial reachability: the internet connection was alive, but the normal route could not reach the services I needed.

The comparison changed after the diagnosis

The established VPN proved that another route could restore access. Its weakness appeared when that route had to survive a brief loss of Wi-Fi.

The smaller service did not fix the ISP’s blocking system or make the home line more stable. It kept the alternate route alive while I moved between two imperfect connections.

That changed the comparison.

On a clean network, server locations, headline speeds and years of public history all matter. When the ordinary route is selectively broken, the decisive moment is the few seconds after Wi-Fi disappears.

That afternoon, recovery mattered more than peak speed because the deployment did not need the fastest tunnel—it needed one that came back before the client session died.