Why your VPN keeps disconnecting, and how to stop it
A tunnel that drops repeatedly is usually being killed by something outside the VPN client: power management suspending the app, a NAT mapping expiring, the network changing underneath it, or an unstable link losing enough packets that the handshake cannot renew. Each leaves a different signature.
4 min read
"Keeps disconnecting" covers several distinct faults with different fixes, and the fastest way to tell them apart is to notice when it happens. A tunnel that drops when the screen turns off is a different problem from one that drops after exactly two minutes of idling, which is different again from one that drops whenever a large download starts.
It drops when the device sleeps or the screen turns off
Power management is suspending the VPN client.
On Android, exclude the app from battery optimisation: Settings, Apps, the app, Battery, Unrestricted. Then enable Always-on VPN in the system VPN settings, which restarts the tunnel automatically. On manufacturer skins with aggressive power management, both are needed.
On Windows, check that the network adapter is not permitted to be powered down: Device Manager, the adapter, Power Management, and clear "Allow the computer to turn off this device". Also turn off Fast Startup, which leaves the network stack in a partially restored state after shutdown.
On macOS and iOS the client's own reconnect-on-wake setting is the equivalent.
It drops after a fixed idle period
This is a NAT mapping expiring. Your router keeps a translation entry for each outbound flow, and it removes entries that have seen no traffic. Carrier-grade NAT on mobile networks is more aggressive still, sometimes expiring UDP mappings in under a minute.
WireGuard's answer is PersistentKeepalive, which sends an empty packet on an
interval to hold the mapping open:
[Peer]
PersistentKeepalive = 25
Twenty-five seconds is the conventional value because it sits below almost every observed NAT timeout. If your app exposes a keepalive setting and the drops are periodic and idle-related, this is the setting.
It drops when the network changes
Moving from Wi-Fi to mobile data, or between access points, changes the address your packets come from.
WireGuard handles this gracefully — it is stateless between packets, so the server simply updates where that peer is. OpenVPN does not: it maintains a TLS session that has to be torn down and rebuilt, which is the pause you see.
If your client offers both, switching to WireGuard removes this category entirely. If it does not, the client's reconnect logic is all there is.
It drops on a poor connection
A tunnel needs its handshake to renew. WireGuard renegotiates roughly every two minutes while traffic flows, and if enough handshake packets are lost the peer is considered dead.
The distinguishing feature is that the underlying connection is also bad — pages load slowly with the VPN off too. Run the speed test with the tunnel down. If latency is spiky and packet loss is visible without the VPN, the tunnel is a symptom rather than the cause.
It drops when a large transfer starts
This one looks like a disconnection and is usually an MTU problem. Small packets get through, large ones are dropped by a router that also drops the ICMP message that would have reported the correct size, and the transfer stalls until the client gives up and reconnects.
Lower the tunnel MTU to 1412, or 1280 if that does not help. If the drops stop, that was it.
It drops at the same time every day
Some ISPs force a reconnection on the customer line daily, typically overnight, and issue a new address. Your VPN cannot survive that, because the underlying connection genuinely went away.
Nothing fixes this at the VPN layer. A client with auto-reconnect makes it a brief interruption rather than an outage.
It is not dropping, the kill switch is engaging
Worth ruling out. If the client shows connected and traffic is blocked, a kill switch may be responding to a tunnel it considers unhealthy while the interface still reports up. Toggling the connection forces a fresh handshake and clears it.
The diagnostic order
- Note when it drops: on sleep, when idle, on network change, during large transfers, or randomly.
- Sleep or screen-off → power management settings.
- Idle → keepalive.
- Network change → switch protocol if possible.
- Large transfers → MTU.
- Random, with the connection also poor without the VPN → the line.
- Same time daily → the ISP.
What to turn on regardless
A kill switch, so a drop fails closed rather than quietly passing traffic in the clear, and auto-reconnect, so short interruptions heal themselves. Those two together turn most of the causes above from a problem into a two-second pause you never notice.
