Fix Windows 11 VPN Drops Repeatedly After Idle Time

Quick fix: Open Settings → Network & internet → VPN → [your VPN] → Advanced options. Toggle off Connect automatically. Then in the VPN client, configure keep-alive to a short interval (30 seconds) and auto-reconnect on disconnect. For Windows’s built-in VPN client, increase the idle timeout via registry value HKLM\SOFTWARE\Microsoft\RasMan\Parameters\MaxConfigure.

Your VPN connects fine and stays up while you actively use it. Walk away for 10 minutes, come back, and the VPN is disconnected. The cause is usually one of three: the VPN gateway timing out your idle session, Windows’s connection-aware features killing the VPN to save battery, or the VPN client’s own idle-handling misbehaving.

What causes this

VPN sessions are kept alive by traffic flowing through them. Most VPN servers have an idle timeout (default 300 to 1800 seconds) — if no traffic flows during that window, the server disconnects the client to free resources. Windows adds its own complications: USB selective suspend can hibernate the Wi-Fi adapter, power management can sleep the network stack on battery, and Windows 11’s connected standby can pause background TCP connections.

The fix combines client-side keep-alive packets (so traffic always flows) with disabling power-saving features that interfere with the VPN.

Method 1: Enable keep-alive in the VPN client

For commercial VPN clients (NordVPN, ExpressVPN, ProtonVPN) and corporate clients (Cisco AnyConnect, GlobalProtect, OpenVPN).

1. Open your VPN client’s settings.
2. Find Keep-alive, Heartbeat, or Idle timeout options:
   • NordVPN: Settings → Auto-connect → tick. Settings → Connection → Connect on app launch.
   • ExpressVPN: Preferences → General → Reconnect when connection drops.
   • OpenVPN: in the .ovpn config file, add ping 15 and ping-restart 60. The first sends a ping every 15 seconds; the second restarts connection if no response in 60.
   • WireGuard: in the .conf file, add PersistentKeepalive = 25 in the [Peer] section.
3. For corporate VPNs: ask IT for keep-alive settings or look in the deployed config for keep-alive parameters.
4. Save settings. Reconnect VPN. Idle timeouts should no longer drop the connection because keep-alive packets count as traffic.
5. For commercial VPNs without explicit keep-alive setting: open a continuous-ping command in Terminal: ping -t 1.1.1.1. While ping runs, traffic flows through VPN; idle timeout never triggers. (Stop when you don’t need VPN active.)

This is the most reliable approach — address the root cause.

Method 2: Disable Windows power-saving features that affect VPN

For when keep-alive is on but VPN still drops.

1. Disable USB selective suspend (affects USB Wi-Fi adapters): Control Panel → Power Options → Change plan settings → Change advanced power settings. Expand USB settings → USB selective suspend setting. Set to Disabled for both On battery and Plugged in.
2. Disable wireless adapter power management: Device Manager → Network adapters → [Wi-Fi adapter] → Properties → Power Management tab. Untick Allow the computer to turn off this device to save power.
3. For laptops on battery: VPN often drops because battery saver throttles background traffic. Settings → System → Power & battery → Battery saver → ensure Turn battery saver on automatically is set to Never or a low percentage (e.g., 5%).
4. For TCP connections via WAN: disable Modern Standby if your laptop has it. Modern Standby pauses TCP connections during sleep. powercfg /availablesleepstates shows current sleep states. To force traditional S3 sleep instead of S0 Modern Standby, BIOS may need a setting change (varies by manufacturer).
5. For Bluetooth-tethered connections: Bluetooth has aggressive power management. Use Wi-Fi or Ethernet for stable VPN.

This handles Windows-level interference with the VPN.

Method 3: Increase VPN reconnect aggressiveness

For when drops are inevitable and you want fast auto-reconnect.

1. In the VPN client: enable Auto-reconnect on disconnect if available.
2. For Windows’s built-in VPN client: Settings → Network & internet → VPN → [your VPN] → Advanced options → Edit. Toggle Connect automatically. (Note: this restarts the VPN when Windows reconnects to a network, not for every disconnect.)
3. For OpenVPN: command-line option --auth-retry interact; or use the OpenVPN GUI’s Auto Connect setting.
4. For Cisco AnyConnect: client preferences — AutoReconnect enabled, AutoReconnectBehavior = ReconnectAfterResume.
5. For OpenVPN with watchdog script: write a PowerShell script that pings a known IP through VPN, and if ping fails, runs rasdial "VPN Name". Schedule via Task Scheduler to run every minute.
6. For commercial VPN client with kill switch: enable kill switch. When VPN drops, internet stops — you notice immediately and can reconnect. Better than VPN silently dropping and traffic going unprotected.

This minimizes the disruption when drops occur.

How to verify the fix worked

• Connect VPN. Walk away for 30 minutes. Return — VPN is still connected.
• In Wireshark or VPN client logs: keep-alive packets every 15–30 seconds during idle.
• VPN client’s “Up for” timer shows long sessions without resets.

If none of these work

If VPN persistently drops despite all client-side fixes, the cause is server-side or network-path. Try a different VPN server: commercial VPN clients let you pick servers; some are more stable than others. Pick a geographically close one (lower latency = fewer packet losses = fewer disconnects). Switch VPN protocol: OpenVPN, IKEv2, WireGuard, L2TP behave differently under network strain. Try each. WireGuard tends to handle idle and roaming best. Network ISP issues: some ISPs throttle or disconnect long-running encrypted connections. Test from a different network (mobile hotspot) to confirm. If VPN is stable on hotspot but not home ISP, contact ISP. For corporate VPN drops: contact IT. Corporate VPNs often have admin-side idle timeout policies you can’t change client-side. Ask for the timeout to be extended or for keep-alive to be enabled at the gateway. For 2-in-1 laptops with Connected Standby: this is a common cause — disable in BIOS to fall back to traditional sleep.

Bottom line: Enable keep-alive in VPN client config (ping 15 / PersistentKeepalive 25). Disable USB selective suspend and Wi-Fi power management. Enable auto-reconnect for fast recovery from any drops that still occur.