Separate VPN connectivity from application access

A VPN client can show a connected state while a particular application remains unreachable. That does not automatically mean the VPN service is broken or that the application is healthy.

Describe which part of the connection works before changing the configuration.

Record the expected route

Identify the destination you want to reach and whether its traffic should pass through the VPN. Check which client profile is active and whether it is the intended one for that device.

Keep a protected copy of the working profile. VPN configuration can contain private keys, so do not publish it with a troubleshooting screenshot.

Test the destination name

If a hostname fails, determine whether it resolves to the expected address. A DNS failure can prevent application access even when the underlying tunnel is established.

Compare a name-resolution symptom with the application's actual endpoint and protocol. Do not replace several DNS settings simply because a browser displays one generic error.

Check the application separately

Verify whether the destination service is running and listening on its expected port. A stopped application cannot answer merely because routing is correct.

Where practical, compare another known destination or a different network. Record the test conditions so the results are useful to support.

Keep the report focused

Include the affected device type, profile identifier, time, destination and exact error. State whether all traffic fails or only one application. Share sensitive profile details only through the appropriate private channel and only when needed.

Use the VPN troubleshooting guide and DNS verification checklist. Layered tests reduce the temptation to change a working tunnel while the real fault is elsewhere.