Can't connect to internet when vpn is turned on

General Help
1

I freshly installed Mint 23 and this problem of not being able to connect to the internet started when the vpn is turned on started. I have installed Zorin and Mint 23 on 4 computers several times before and never had any issue.
So, I thought it was a mint problem and installed Zorin 18. The same problem has happened again.

I contacted pia-vpn about the problem and they were unable to find a fix.

This has to be an issue with mint and zorin because I have 3 other computers running the same vpn and have never had this problem before.

I suspect, Mozilla may be a possible problem, or possible the brave browser which comes installed with Zorin but not on Mint. I'm doubtful on this being part of the solution.
I suspect a network management problem or an adapter problem.
It could also be a fire wall problem but I turned the firewall off and it still has the same problem.
The router is a xfinity, but it is working without any problems on this computer that I am using to post this message.
My computer is ASUS z170e with 32gb ddr4 2400 ram. All turbo's are turned off on cpu and ram. Secure boot is on. Fast boot is on. OS is mounted on M.2 2tb, 2 -2tb SSD mounted on RAID0. CPU is i7 3.6 ghz.

2

Hey MIchael! Welcome to the forum.

I note that the ASUS Z170-E motherboard features an Intel I219V Gigabit LAN controller (ethernet), but it does not come with an onboard wireless chipset.

Are you using a PCIe card or USB dongle? If so, might Mint and Zorin be missing the specific driver for that card?

I also see that you have secure boot and fast boot on.
these are often "connection killers" in Linux.

The first prevents Linux from loading "unsigned" drivers. Many Wi-Fi drivers (especially for TP-Link, Realtek, or Broadcom adapters) are considered unsigned. When Secure Boot is on, the OS simply ignores the driver, and your Wi-Fi card "disappears."

The second can leave hardware in a "Windows-only" state or a low-power sleep mode that Linux cannot wake it from.

Try going into your BIOS and setting Secure Boot to "Disabled" or "Other OS," and turn Fast Boot to "Disabled."

1 Like
3

Welcome to the Forum!

When the VPN is disabled, does Your Internet works then?

That could be a Point, too. Did You tried it with disabled Secure Boot?

4

I disabled secure boot and fast boot. it still doesn't work. I am on a wired connection.

5

What of the above questions?

6

PIA app > Settings > Privacy
Is "Kill switch" and "Advanced Kill switch" enabled? Try disabling them - these are configured to kill the net access if it does not like your router or DNS.

If those are already disabled, it might be ipv6... If so, try:

sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1

7

The sudo sysctl command worked with nord but not with pia-vpn.
2 fresh installs of mint zena and zorin produced the same problem.
This has to be a linux issue. the vpn always worked before.
I uninstalled pia vpn and re installed it and it still doesn't work. Their app is exactly the same as the one running on all my other mint machines.

the above fix did make nord vpn work. I was going to get nord vpn anyway but I think this proves that something is wrong on the OS side.

8

In PIA Settings > Network, is there a setting for "Allow LAN"?
Is there a setting for using "PIA DNS"? Have you tried toggling it, if so?

Under Settings > Protocol, have you tried switching from WireGuard to OpenVPN or the reverse?

9

I have tried turning off lan, turning it on but I don't know what that has to do with anything? it is hard wired to the router. Should I try wifi? I have tried every dns setting that I can check, try and uncheck again. Brave browser is spitting out all kinds of solutions but I'm tired after trying to talk to pia help for an hour and getting nowhere. I'm going to try to get the bug report to them.

10

Wifi will not make any difference and I do not recommend Random Settings changes.

What is your Terminal output for

resolvectl status

and for

sudo iptables -L

11

first, I tried resolvectl status and it came back failed to get global data connection timed out. i tried this before I saw your possible solution. This should have worked since the vpn isn't on. I can always connect when the vpn is turned off.

9:08 PM (0 minutes ago)

to me
tropic@WMIK3:~$ netsh int ip reset
netsh: command not found
tropic@WMIK3:~$ resolvectl status
Failed to get global data: Connection timed out
tropic@WMIK3:~$ resolvectl status
Failed to get global data: Failed to activate service 'org.freedesktop.resolve1': timed out (service_start_timeout=25000ms)
tropic@WMIK3:~$ sudo iptables -L
[sudo] password for tropic:
Chain INPUT (policy ACCEPT)
target prot opt source destination
piavpn.INPUT all -- anywhere anywhere
ufw-before-logging-input all -- anywhere anywhere
ufw-before-input all -- anywhere anywhere
ufw-after-input all -- anywhere anywhere
ufw-after-logging-input all -- anywhere anywhere
ufw-reject-input all -- anywhere anywhere
ufw-track-input all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ufw-before-logging-forward all -- anywhere anywhere
ufw-before-forward all -- anywhere anywhere
ufw-after-forward all -- anywhere anywhere
ufw-after-logging-forward all -- anywhere anywhere
ufw-reject-forward all -- anywhere anywhere
ufw-track-forward all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
piavpn.OUTPUT all -- anywhere anywhere
ufw-before-logging-output all -- anywhere anywhere
ufw-before-output all -- anywhere anywhere
ufw-after-output all -- anywhere anywhere
ufw-after-logging-output all -- anywhere anywhere
ufw-reject-output all -- anywhere anywhere
ufw-track-output all -- anywhere anywhere

Chain piavpn.100.blockAll (0 references)
target prot opt source destination
piavpn.r.100.blockAll all -- anywhere anywhere

Chain piavpn.100.protectLoopback (1 references)
target prot opt source destination
piavpn.r.100.protectLoopback all -- anywhere anywhere

Chain piavpn.110.blockVpnIP (0 references)
target prot opt source destination
piavpn.r.110.blockVpnIP all -- anywhere anywhere

Chain piavpn.200.allowVPN (0 references)
target prot opt source destination
piavpn.r.200.allowVPN all -- anywhere anywhere

Chain piavpn.230.allowBypassApps (0 references)
target prot opt source destination
piavpn.r.230.allowBypassApps all -- anywhere anywhere

Chain piavpn.290.allowDHCP (0 references)
target prot opt source destination
piavpn.r.290.allowDHCP all -- anywhere anywhere

Chain piavpn.300.allowLAN (0 references)
target prot opt source destination
piavpn.r.300.allowLAN all -- anywhere anywhere

Chain piavpn.305.allowSubnets (0 references)
target prot opt source destination
piavpn.r.305.allowSubnets all -- anywhere anywhere

Chain piavpn.310.blockDNS (0 references)
target prot opt source destination
piavpn.r.310.blockDNS all -- anywhere anywhere

Chain piavpn.320.allowDNS (0 references)
target prot opt source destination
piavpn.r.320.allowDNS all -- anywhere anywhere

Chain piavpn.340.blockVpnOnly (1 references)
target prot opt source destination
piavpn.r.340.blockVpnOnly all -- anywhere anywhere

Chain piavpn.350.allowHnsd (0 references)
target prot opt source destination
piavpn.r.350.allowHnsd all -- anywhere anywhere

Chain piavpn.350.cgAllowHnsd (0 references)
target prot opt source destination
piavpn.r.350.cgAllowHnsd all -- anywhere anywhere

Chain piavpn.390.allowWg (0 references)
target prot opt source destination
piavpn.r.390.allowWg all -- anywhere anywhere

Chain piavpn.400.allowPIA (0 references)
target prot opt source destination
piavpn.r.400.allowPIA all -- anywhere anywhere

Chain piavpn.999.allowLoopback (0 references)
target prot opt source destination
piavpn.r.999.allowLoopback all -- anywhere anywhere

Chain piavpn.INPUT (1 references)
target prot opt source destination
piavpn.a.100.protectLoopback all -- anywhere anywhere

Chain piavpn.OUTPUT (1 references)
target prot opt source destination
piavpn.a.999.allowLoopback all -- anywhere anywhere
piavpn.a.400.allowPIA all -- anywhere anywhere
piavpn.a.390.allowWg all -- anywhere anywhere
piavpn.a.350.cgAllowHnsd all -- anywhere anywhere
piavpn.a.350.allowHnsd all -- anywhere anywhere
piavpn.a.340.blockVpnOnly all -- anywhere anywhere
piavpn.a.320.allowDNS all -- anywhere anywhere
piavpn.a.310.blockDNS all -- anywhere anywhere
piavpn.a.305.allowSubnets all -- anywhere anywhere
piavpn.a.300.allowLAN all -- anywhere anywhere
piavpn.a.290.allowDHCP all -- anywhere anywhere
piavpn.a.230.allowBypassApps all -- anywhere anywhere
piavpn.a.200.allowVPN all -- anywhere anywhere
piavpn.a.110.blockVpnIP all -- anywhere anywhere
piavpn.a.100.blockAll all -- anywhere anywhere

Chain piavpn.a.100.blockAll (1 references)
target prot opt source destination

Chain piavpn.a.100.protectLoopback (1 references)
target prot opt source destination
piavpn.100.protectLoopback all -- anywhere anywhere

Chain piavpn.a.110.blockVpnIP (1 references)
target prot opt source destination

Chain piavpn.a.200.allowVPN (1 references)
target prot opt source destination

Chain piavpn.a.230.allowBypassApps (1 references)
target prot opt source destination

Chain piavpn.a.290.allowDHCP (1 references)
target prot opt source destination

Chain piavpn.a.300.allowLAN (1 references)
target prot opt source destination

Chain piavpn.a.305.allowSubnets (1 references)
target prot opt source destination

Chain piavpn.a.310.blockDNS (1 references)
target prot opt source destination

Chain piavpn.a.320.allowDNS (1 references)
target prot opt source destination

Chain piavpn.a.340.blockVpnOnly (1 references)
target prot opt source destination
piavpn.340.blockVpnOnly all -- anywhere anywhere

Chain piavpn.a.350.allowHnsd (1 references)
target prot opt source destination

Chain piavpn.a.350.cgAllowHnsd (1 references)
target prot opt source destination

Chain piavpn.a.390.allowWg (1 references)
target prot opt source destination

Chain piavpn.a.400.allowPIA (1 references)
target prot opt source destination

Chain piavpn.a.999.allowLoopback (1 references)
target prot opt source destination

Chain piavpn.r.100.blockAll (1 references)
target prot opt source destination
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable

Chain piavpn.r.100.protectLoopback (1 references)
target prot opt source destination
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable

Chain piavpn.r.110.blockVpnIP (1 references)
target prot opt source destination

Chain piavpn.r.200.allowVPN (1 references)
target prot opt source destination

Chain piavpn.r.230.allowBypassApps (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere cgroup 1383

Chain piavpn.r.290.allowDHCP (1 references)
target prot opt source destination
ACCEPT udp -- anywhere 255.255.255.255 udp spt:bootpc dpt:bootps

Chain piavpn.r.300.allowLAN (1 references)
target prot opt source destination
ACCEPT all -- anywhere 10.0.0.0/8
ACCEPT all -- anywhere 169.254.0.0/16
ACCEPT all -- anywhere 172.16.0.0/12
ACCEPT all -- anywhere 192.168.0.0/16
ACCEPT all -- anywhere base-address.mcast.net/4
ACCEPT all -- anywhere 255.255.255.255

Chain piavpn.r.305.allowSubnets (1 references)
target prot opt source destination

Chain piavpn.r.310.blockDNS (1 references)
target prot opt source destination
REJECT udp -- anywhere anywhere udp dpt:domain reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp dpt:domain reject-with icmp-port-unreachable

Chain piavpn.r.320.allowDNS (1 references)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT tcp -- anywhere anywhere tcp dpt:domain

Chain piavpn.r.340.blockVpnOnly (1 references)
target prot opt source destination
REJECT all -- anywhere anywhere cgroup 1384 reject-with icmp-port-unreachable

Chain piavpn.r.350.allowHnsd (1 references)
target prot opt source destination

Chain piavpn.r.350.cgAllowHnsd (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere owner GID match piahnsd cgroup 1384 multiport dports domain,13038
ACCEPT udp -- anywhere anywhere owner GID match piahnsd cgroup 1384 multiport dports domain,13038
REJECT all -- anywhere anywhere owner GID match piahnsd reject-with icmp-port-unreachable

Chain piavpn.r.390.allowWg (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere mark match 0x3213

Chain piavpn.r.400.allowPIA (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere owner GID match piavpn

Chain piavpn.r.999.allowLoopback (1 references)
target prot opt source destination
RETURN udp -- anywhere anywhere udp dpt:domain
RETURN tcp -- anywhere anywhere tcp dpt:domain
ACCEPT all -- anywhere anywhere

Chain ufw-after-forward (1 references)
target prot opt source destination

Chain ufw-after-input (1 references)
target prot opt source destination

Chain ufw-after-logging-forward (1 references)
target prot opt source destination

Chain ufw-after-logging-input (1 references)
target prot opt source destination

Chain ufw-after-logging-output (1 references)
target prot opt source destination

Chain ufw-after-output (1 references)
target prot opt source destination

Chain ufw-before-forward (1 references)
target prot opt source destination

Chain ufw-before-input (1 references)
target prot opt source destination

Chain ufw-before-logging-forward (1 references)
target prot opt source destination

Chain ufw-before-logging-input (1 references)
target prot opt source destination

Chain ufw-before-logging-output (1 references)
target prot opt source destination

Chain ufw-before-output (1 references)
target prot opt source destination

Chain ufw-reject-forward (1 references)
target prot opt source destination

Chain ufw-reject-input (1 references)
target prot opt source destination

Chain ufw-reject-output (1 references)
target prot opt source destination

Chain ufw-track-forward (1 references)
target prot opt source destination

Chain ufw-track-input (1 references)
target prot opt source destination

Chain ufw-track-output (1 references)
target prot opt source destination

12

PIA depends on resolvd, whereas Nord does not.

Ensure it is started and running:

sudo systemctl enable --now systemd-resolved

resolvectl status

The rest of your post shows that PIA added firewall rules that are left behind blocking things.
Try

sudo iptables -F

1 Like
13

I need to understand how the same exact apps and Linux OS could be installed only to be met with this wall of nonsense. It doesn't make any sense how I could have installed zorin a month ago with the same vpn that hasn't been updated and I did not have this problem. I reinstalled mint after the zorin on screen keyboard kept driving me crazy. How does this kind of problem happen? The only variables are that this is a different computer but only because it got killed when I tried to upgrade the cpu. Lucky for me I had an extra i7 that ive had laying around since 2020 (free out of a garbage computer thrown away by a data center). supposedly this computer can't be killed by nuking your bios if you have the cd (which I do , but did not need). I doubled the ram and it had a hell of a time upgrading it. I played ram stick switcharoo for a long long time to get it to finally work. Can it be a hardware issue? This computer was thought to be dead after installing a cpu that I bought off amazon and returned when it did not work and did not work again when i put in the previous cpu . I thought it was dead. I forgot that I had this other cpu and when I saw it I thought that I had mistakenly sent back the wrong cpu to amazon. This computer works great. Loads zorin fast and I can make it faster. But I can't use it without a vpn.

14

Your output above shows:

This easily covers the question you asked as to how - so, that is our best starting point.

1 Like
15

I read this and even though I don't a damn thing about what or how this really works I could see what looked to be a fire wall. I didn't recognize anything that I had put in . You are a genius. i'll have to give this a try tomorrow since i can barely see straight right now. but Thankyou..

16

I had to change the dns in the settings to built in resolver which did not work at first. I also turned off the kills switch, which I may try turning back on later. I tried several dns settings that did not work. I also sent pia a lengthy email about what Aravision said. I am probably not the first person this has happened to but I do have a natural skill for finding a way to make things not work when they are supposed to.
Thanks for your help

17

Both may be valid, heh heh;I share the sentiment for having a knack for things not working right.
But, I think it is allowable to consider Common Patterns. If you are not the first person, nor the second or third... It is reasnably a common issue.
And the company itself has a strong motive to shirk that, as it places the ball firmly in their court. They won't hit that target without exhausting all external possibilities, first.

VPN's, in general, are very controlling and very complex.
When you layer both together - Yes, such issues are common.

The best route is to not trust these actions to a VPN based on the assumption that they are fully on the level. Instead, a person can setup their own proxies for use of privacy protection, without bloated software injecting modified iptables.
That is an opinion of mine and I realize, many users would rather install something and hope it works rather than learn the steps to do it themselves; not out of malice but simply limited time and resources to devote to yet another learning curve.
But you may consider it as a resort of some placement.

18

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.