A connected VPN tunnel can still leave websites unreachable because DNS, default route or remote subnet selection is wrong.
Before you change anything
This is a diagnostic entry point. The source supports the general check, not a confirmed root cause for your device.
What to check first
Are DNS and allowed routes working independently?
Record the exact model, hardware revision, firmware and recent change before adjusting settings. If you cannot answer the question, keep the cause open.
Narrow the likely path
| Observation | Next check |
|---|---|
| Client will not connect | Check profile, protocol and model firmware without sharing keys. |
| Server cannot be reached | Classify WAN addressing, CGNAT and firewall before port changes. |
| Tunnel connects without traffic | Check route, DNS and overlapping LAN subnet ranges. |
Decision after the first test
Test an IP-only connection and a domain lookup through the tunnel, then compare routes without exposing keys or client profiles.
Use a documented next step
Verify before escalating
After each change, repeat the exact failed task. If the result is unchanged, restore the previous setting and use the official support link for your exact hardware revision. Don’t assume a menu or capability from a related model.
Official sources
- TP-Link no-internet: WAN address and cabling checks (full_text; checked 2026-11-01)
Check your exact US model, hardware revision, and firmware on the linked support page before changing settings.