Fix: FortiClient VPN Drops Internet Connection

A remote worker contacted us because their internet kept dropping out every time they connected to their company’s FortiClient VPN. Applications would freeze, file transfers would fail, and the home internet would go completely offline for around 30 seconds before recovering. The problem had been ongoing for weeks and was preventing them from accessing critical business applications. After ruling out endpoint security software and testing on both WiFi and Ethernet, we found the VPN’s default transport mode was overloading their home router. A single settings change fixed the issue immediately.

Symptoms

When connected to FortiClient VPN, the user’s internet connection repeatedly drops out. The home router (such as an Optus Ultra WiFi Modem Gen 2 or similar consumer-grade device) shows the connection resetting, with indicator lights cycling from solid green to flashing blue. This affects all devices on the network, not just the VPN-connected computer. The issue occurs on both WiFi and Ethernet connections.

Internet connection drops out repeatedly while connected to FortiClient VPN. Home router resets every few minutes. All devices on the network lose connectivity.

Affected Software

• FortiClient VPN (all recent versions)
• Consumer-grade home routers and modems (Optus, Telstra, TP-Link, Netgear, etc.)

Cause

By default, FortiClient VPN uses TCP as its transport protocol. When a VPN tunnel runs over TCP, every dropped packet triggers a retransmission. On a busy connection, this creates a cascade effect where lost packets generate even more traffic as TCP aggressively tries to recover them. Consumer-grade home routers do not have the processing power or memory to handle this volume of traffic, causing them to crash and reset the internet connection entirely.

This is sometimes called the “TCP meltdown” problem. It is especially common on home internet connections where the router is already handling multiple devices and has limited resources.

Resolution

Enable UDP (DTLS) in FortiClient

1. Open FortiClient VPN on the affected workstation
2. Click the settings/gear icon next to your VPN connection
3. Go to the Advanced settings
4. Under SSL Options, tick “Preferred DTLS Tunnel”
5. Save the settings and reconnect the VPN
6. Test that the internet stays stable during file transfers and normal use

UDP (DTLS) handles dropped packets more gracefully. Instead of TCP’s complex acknowledgment and retransmission mechanism, UDP simply re-sends the data without the overhead. This dramatically reduces the traffic load on the home router and prevents the cascade effect that causes the crash.

For IT Administrators: Enable DTLS on the FortiGate

1. Log in to the FortiGate management console
2. Navigate to VPN > SSL-VPN Settings
3. Ensure DTLS is enabled on the SSL-VPN portal settings
4. This is required for the client-side DTLS option to work. If DTLS is not enabled on the FortiGate, the client will fall back to TCP regardless of the client setting.

Important Notes

• This issue is most common on consumer-grade home routers and modems. Business-grade firewalls and routers typically handle TCP VPN traffic without issue.
• If the DTLS option is greyed out in FortiClient, the FortiGate administrator needs to enable it on the server side first.
• If switching to DTLS is not possible, reducing the MTU size in FortiClient can also help reduce the load on the router.
• The problem can appear suddenly if the user starts transferring larger files or using more bandwidth-intensive applications over the VPN.
• Always test on both WiFi and Ethernet before assuming the issue is VPN-related, as this helps rule out wireless interference.

Related Resources

• Fortinet Community: Lost Internet Connection When Using FortiClient
• Fortinet: Technical Tip - Internet Drops During Dial-up IPsec VPN
• ForestVPN: When I Connect to FortiClient VPN I Lose Internet
• Fix: FortiClient VPN Stuck at 98% When Connecting
• Fix: FortiClient “The VPN Server May Be Unreachable” (-14)
• Fix: FortiClient “Permission Denied (-455)” and -7200 Errors
• Fix: SonicWall GVC “Peer Is Not Responding to Phase 1 ISAKMP”

If you need help with VPN connection issues, get in touch with our team.