Internet Not Working [ADVANCED]
If your internet has stopped working, don’t panic. Work through these checks in order. Most issues resolve at Step 1 or Step 2.
Step 1: Is Your Vault On?
Look at the Protectli vault. Are the LEDs lit?
LEDs are off: The vault has no power. Check that the power cable is plugged in at both ends. Try a different outlet. If the vault still won’t power on, contact OSS support.
LEDs are on: Move to Step 2.
Step 2: Check Your Cables
Look at the back of the vault. You should see two Ethernet cables plugged in:
- Port 1 (leftmost) goes to your TP-Link access point
- Port 2 (second from left) goes to your modem or ISP equipment
Check both cables. Are they fully seated? Do the ports show a green or amber link light?
Port 2 has no link light: The connection between your vault and your modem is down. Unplug the Ethernet cable from Port 2, wait 5 seconds, and plug it back in. If the link light doesn’t come back, try a different Ethernet cable. If it still doesn’t come back, your modem may be the problem. See Step 3.
Port 1 has no link light: The connection between your vault and your access point is down. This means WiFi is down but wired devices on Port 1 may still work. Unplug and reseat the cable. If Port 1 link light does not come back after reseating the cable, plug a computer directly into Port 4 (rightmost port) instead. This is your backup admin port. If you get internet on Port 4, Port 1 may have a NIC failure. Contact OSS support.
Both link lights are on: Move to Step 3.
Step 3: Is Your ISP Working?
Your vault can only give you internet if your ISP is actually delivering it.
Restart your modem: Unplug your modem (or ISP gateway) from power, wait 30 seconds, and plug it back in. Wait 2-3 minutes for it to fully restart. This fixes the majority of internet outages.
Check for ISP outage: Use your phone’s cellular data (not WiFi) to check your ISP’s status page or search “[your ISP name] outage” in your area. If your ISP is having an outage, your vault is fine. Wait for the ISP to fix it.
Modem is working but vault still has no internet: Move to Step 4.
Step 4: Can You Reach the Vault?
On a device connected to your home WiFi or plugged into Port 1, open a web browser and go to 192.168.1.1
The OPNsense login page loads: Your vault is running and your local network is working. The problem is between your vault and the internet. Move to Step 5.
The page doesn’t load: Try connecting to the vault WiFi network (your Home-Admin SSID). If you still can’t reach 192.168.1.1, try plugging a computer directly into Port 4 (backup admin port) and go to 192.168.2.1 instead. If that works, Port 1 or your access point may have an issue. Contact OSS support.
Step 5: Check the Dashboard
Log into the vault at 192.168.1.1 and look at the dashboard.
Check the Gateway widget. Is the primary gateway (WAN) green or red?
- Green: Your vault has an internet connection. The problem may be DNS. Move to Step 6.
- Red: Your vault is not getting an internet connection from your ISP. Go back to Step 3 and restart your modem. If the gateway stays red after a modem restart, check Interfaces > Overview and confirm the WAN interface has an IP address. If it shows no IP, your ISP may have changed something. Contact your ISP first, then OSS support if they can’t help.
Check the Services widget. Are any services showing red?
- Unbound DNS is red: This is the most common cause of “internet not working” when the gateway is green. Your vault has internet but DNS is down so nothing can resolve domain names. Go to Step 6.
- All services red: Your vault may be rebooting. Wait 5 minutes and refresh.
- Everything green but still no internet: Move to Step 6.
Step 6: Restart Unbound DNS
Unbound is the DNS service on your vault. If it stops running, your devices can’t look up website addresses even though the internet connection itself is fine. This is the most common cause of “internet is connected but nothing loads.”
- Go to Services > Unbound DNS > General
- Uncheck Enable Unbound
- Click Save
- Wait 5 seconds
- Check Enable Unbound
- Click Save
Wait 10 seconds, then try loading a website. If it works, you’re done.
Still not working: Try restarting the vault. Go to Power > Reboot and click Yes. The vault takes about 3-5 minutes to fully restart. Once it’s back up, try loading a website.
Step 7: One Network or All Networks?
If you’ve made it this far, it helps to figure out whether the problem is affecting all your networks or just one.
Test from a different network. If your phone on the Home-Admin WiFi has no internet, try connecting it to the Home-IoT or Home-Guest WiFi instead. Try plugging a computer directly into Port 1.
Only one network is down: The problem is likely a VLAN configuration issue or a firewall rule. Don’t try to fix this yourself. Contact OSS support and tell them which network is affected.
All networks are down: Reboot the vault (Power > Reboot). If that doesn’t fix it, restore from your most recent backup. Go to System > Configuration > Backups, upload your encrypted XML backup, enter your encryption password, and the vault will restore. If you don’t have a backup, contact OSS support.
Step 8: SafeNet Networks Specifically
If devices on your regular networks (Home-Admin, Home-IoT, Home-Guest, Home-Kids) have internet but devices on SafeNet WiFi or SafeNet Port do not, the issue is with the VPN tunnel.
Check WireGuard status: Go to VPN > WireGuard > General. Is WireGuard enabled? If not, enable it and click Save.
Check the tunnel: Go to VPN > WireGuard > Status. Look at the handshake age. If it says “never” or shows a time older than 3 minutes, the tunnel isn’t connecting.
Restart WireGuard:
- Go to VPN > WireGuard > General
- Uncheck Enable WireGuard
- Click Save
- Wait 5 seconds
- Check Enable WireGuard
- Click Save
Wait 30 seconds and check the status page again. If the handshake still won’t establish, your SafeNet subscription may have lapsed or there may be a server-side issue. Contact OSS support.
Quick Reference
| Symptom | Most Likely Cause | First Thing to Try |
|---|---|---|
| Everything is dead | Vault has no power | Check power cable and outlet |
| WiFi gone, wired works | Port 1 cable or AP issue | Reseat Port 1 cable, power cycle AP |
| No internet, vault dashboard works | ISP outage or modem issue | Restart modem, check ISP status |
| Dashboard shows WAN gateway red | No internet from ISP | Restart modem, contact ISP |
| Gateway green but can’t browse | Unbound DNS crashed | Restart Unbound (Step 6) |
| One network down, others fine | VLAN or firewall rule issue | Contact OSS support |
| SafeNet down, everything else works | WireGuard tunnel issue | Restart WireGuard (Step 8) |
| Everything broken, nothing helps | Configuration problem | Restore from backup or contact OSS |
Before You Contact Support
When you reach out to OSS support, it helps to have this information ready:
- Which step you got stuck on in this guide
- Which networks are affected (all of them or specific ones)
- Whether the vault dashboard is accessible at 192.168.1.1
- What the Gateway widget shows (green or red)
- What the Services widget shows (any red services)
- Whether you restarted your modem and what happened
This saves time and helps us get you back online faster.