Drıftstack docs
Docs

Session ended: VPN tunnel did not finish connecting / handshake failed

You might be here because: “tunnel did not finish connecting” · “proxy security handshake failed” · “my VPN session ends right away” · “session stopped, proxy hung up during setup” · “tunnel could not be started” · “VPN connects on my phone but not in Driftstack” · “vpn won’t connect” · “openvpn session ends immediately”

Short answer

The session ended because the VPN never came up. The end reason says what failed and whose side it is on — the provider’s, your config’s, or ours. Fix the named side, then run Check VPN before launching again.

Check first

  • Are you signed in to the desktop app, and is the app up to date?
  • Is the proxy saved and tested? Open Proxies, find the row, press Test (SOCKS5) or Check VPN (OpenVPN/WireGuard) and read the result.
  • If the app shows it is offline, reconnect and try again.
  • Is a proxy chosen for the profile you are launching? Open the profile’s Edit and look at the Proxy picker.

Likely causes and fixes

  1. “Proxy address not found” / “Proxy refused the connection” / “Proxy did not respond” / “Proxy hung up during setup”. The endpoint is offline, moved, or filtered — the provider’s side. Confirm the server address with the provider; if it changed, paste the new config (see To change a VPN password or server address).
  2. “Proxy security handshake failed”. The encrypted handshake did not complete — usually a certificate or tls-auth key in the config that no longer matches the server. Get a fresh config from the provider.
  3. “Tunnel did not finish connecting”. Either the endpoint never answered (the provider’s side), or the handshake never completed — “a key or protocol the server does not accept is dropped silently rather than refused. Open the proxy and check its config.”. For WireGuard, a wrong pre-shared key or private key looks exactly like this.
  4. “Proxy config was rejected”. Re-paste the config; the app offers to remove lines it will not accept.
  5. “Proxy rejected the credentials”. The stored username/password was refused.

If the explanation says “This one is ours, not yours”, nothing in your config is wrong — see ‘The part of this session’s connection that we run did not start / stopped’.

A full check that could not bring the tunnel up also reports a bad config, a handshake failure, or a timeout as check_unavailable and is worth a retry.

If it still fails

Press Talk to a person in this chat (or open Help) and include: the profile and proxy label, the outcome and explanation lines from the ended session, and the time. Anything marked “ours” is for a person to look at. Never send the config or keys.