Most guides to this problem hand you a list of eight fixes and let you work through them. That is backwards, because the first question cuts the list in half and takes ten seconds to answer.
Ask this first: does your internet drop too?
When the VPN disconnects, check whether the connection itself is still working, load a page with the VPN off, or look at whether other devices in the house are fine.
If your internet drops as well, the tunnel is a victim, not a cause. Your link is unstable and the VPN is the first thing to notice. Fix the connection: Wi-Fi channel congestion, distance from the router, a flaky line. Nothing in the VPN client will help.
If your internet stays fine while the tunnel dies, you have eliminated your ISP and your router's connection quality in one step. What remains is a short list of things that kill a tunnel while leaving the network up, and that is what the rest of this page covers.
Cause 1, The operating system is suspending the app (mobile, mostly)
On a phone, this is the most common answer by a wide margin, and it has nothing to do with networking.
Android and iOS suspend background apps to save battery. A VPN client is a background app. When the system freezes it, the tunnel dies, and it typically comes back the moment you unlock the screen, which is exactly the pattern people describe as "it disconnects when I'm not using it".
Fix: exclude the VPN from battery optimisation, and enable Always-On if your client offers it. If your disconnections are on a phone and not on a laptop, start here and go no further until you have ruled it out.
Cause 2, An idle NAT mapping is being dropped
The classic signature: it works for a minute or two, then stops, especially when you are not actively using it.
Your router holds a mapping so replies can find their way back to your device. If nothing crosses the tunnel for a while, it forgets. The server then has nowhere to send packets, and the connection appears to die on its own.
Fix: on WireGuard, set PersistentKeepalive = 25 on the peer that sits behind NAT. It sends a tiny packet every 25 seconds purely to keep the door open. Commercial clients usually do this for you, but self-hosted setups often do not.
Cause 3, The kill switch is amplifying small drops
Worth understanding before you change anything else: a kill switch blocks traffic when the tunnel drops. That is its purpose.
The consequence is that a two-second reconnection you would never have noticed becomes a visible failure, pages stop, downloads die. The tunnel may be dropping far less often than it feels. Before hunting a serious fault, check whether what you are experiencing is a rare, self-healing drop made loud by a setting doing its job.
Cause 4, The server, not you
Thirty-second test: switch to a different server and see whether the pattern follows.
If the disconnections stop, the previous server was overloaded or rotating sessions, and nothing on your device needed changing. If they follow you across several servers, the cause is local. This test costs nothing and eliminates an entire half of the possibilities, so run it early.
Cause 5, You are moving between networks
If drops coincide with leaving the house, or with moving between access points, the handover is the mechanism.
WireGuard is connectionless and can resume after your address changes, which usually makes this quick. OpenVPN maintains a session and more often needs a full reconnection. If your client offers both and you are on OpenVPN, switching is a reasonable test, the same lever that helps when a VPN is slow rather than unstable.
Cause 6, Something local is interfering
Least likely, and last for that reason: a firewall or security suite that inspects traffic can close a tunnel it does not recognise. The signature is a disconnection that is reproducible on one machine and absent on every other device on the same network.
What to do with the answer
If you worked through this and the tunnel still dies on several servers, with battery optimisation off and a keepalive set, the honest conclusion is that the provider's stability on your route is the limit. That is a reason to test another provider: not another setting.
And if the drops turned out to be rare but painful, the setting to revisit is the kill switch, not the tunnel: what a kill switch actually does is block traffic on purpose, and knowing that changes how you read the symptom.
Ruled out your device? Test another provider's stability on your own route - 30-day money-back
Enough servers to switch away from one that drops sessions, plus an always-on option on mobile
Secure your connection with NordVPN
Threat Protection blocks trackers & malware · kill switch · 30-day money-back
