No internet after uninstalling a VPN: inventory before reset

Removing a VPN client should restore the machine you had before it, and occasionally it restores a machine where nothing resolves and the browser still wants a proxy. The leftovers come from a short list of owners: routes, Winsock providers, a proxy setting, DNS, and filter drivers. Two repair strategies exist, and they differ mostly in what they destroy.

Two repairs with very different costs

The broad reset is not wrong; it is expensive. It also removes the evidence that would have told you which layer failed, so the next machine with the same symptom starts from zero again. Inventory first costs four commands, and three of them are read-only.

Choose by the clock, not by preference. On a machine that must be working in ten minutes, a full reset may be the right call, and the note you leave afterwards is the only thing that keeps the knowledge. On a fleet with a repeating symptom, the inventory is the cheaper path because it produces a cause instead of an outage that ended.

Read four things before touching anything

ipconfig /all
route print -4
netsh winsock show catalog
netsh winhttp show proxy

Each output maps to a different failure. A default route pointing at an adapter that no longer exists explains a dead internet with a working local network. An adapter DNS server that used to belong to the tunnel explains names that fail while addresses work. A Winsock provider installed by the client explains browser failures that survive every route change. A proxy entry explains a browser that cannot reach anything while curl can.

Check the browser's own proxy separately. It lives in the Internet Options dialog under Connections and LAN settings, and it is a different setting from the WinHTTP proxy the command reports. Fixing one does not fix the other, and a machine can carry both. Look for a proxy address that resolves to nothing, because that is the shape a removed client leaves behind.

Climb the ladder instead of jumping

ipconfig /release
ipconfig /renew
ipconfig /flushdns
route -f
netsh int ip reset reset.log
netsh winsock reset catalog

route -f clears the routing table without touching adapters, which is the cheapest way to remove a tunnel's leftover default. netsh int ip reset rewrites TCP/IP stack settings and expects a reboot. netsh winsock reset restores the catalog a filter driver modified, and it is the step that fixes the browser-only failures. Run one, test, then run the next; a ladder you climbed is a ladder you can describe later.

netsh advfirewall reset is not part of this ladder. It deletes rules that someone created deliberately, and restoring them is a separate project. The Settings app's network reset removes and reinstalls every adapter and also clears saved Wi-Fi passwords, so it belongs after the narrow steps rather than before them.

Leftovers whose owner is another product

Dragging an application to the Trash does not uninstall it. A Mac that kept using a VPN it no longer displayed had a vendor helper still running; Activity Monitor's network tab identified it by traffic, and the vendor's uninstall procedure removed the daemon and its launch items. Check /Library/LaunchDaemons and /Library/LaunchAgents for entries whose program no longer exists.

Security software is the other place this pattern shows up. Antivirus tools install filter drivers of their own, and a removal that leaves one behind can break a VPN adapter in a way no VPN setting explains. The vendor's removal tool exists for that case; a generic uninstall usually does not reach it.

Installers can also refuse to start because an earlier instance is alive. The OpenVPN installer checks for a running openvpn.exe, including one your own script started hours ago.

The env_block failure is a leftover of yet another kind. PATH has lost C:\Windows\System32 and its neighbours, so the client cannot launch the utilities that build the adapter. Repair PATH rather than reinstalling, because a fresh copy will hit the same missing commands.

Linux interfaces and the router test

A tun interface can outlive the configuration that made it. One slow-download report ended with a leftover device holding the old pool's gateway address and pulling traffic toward a tunnel nobody intended. ip -brief link lists what exists; compare that against what the current service claims, then delete the orphan.

Leases that stop arriving after a VPN experiment are not automatically a stack problem. Test a laptop that never carried the client, and a different router, before running more resets. If the router stopped answering, no Windows command will change that, and a temporary static address, gateway, and resolver tell you which side is broken.

Record what you reset and in what order. The next person needs to know whether the Winsock catalog or the firewall was rebuilt, and that note is the one thing an uninstall cannot take with it.