Recently, some Websites won't load unless VPN is turned on

Certain websites (mostly support.app.com that I've noticed so far) won't load unless my Nord VPN connection is enabled. This is occurring on my home 1 GB Fiber connection. I've tested it on multiple Macs and iOS devices and they don't load on any of the devices. Same thing when I try Chrome or Firefox. I've only noticed this in the last couple weeks. I've tried deleting all the website data in Safari that has apple or support in the web address. Could it be something with my ISP? Thanks.

Posted on Sep 9, 2024 6:45 PM

Reply
Question marked as Top-ranking reply

Posted on Sep 10, 2024 11:04 AM

If it's multiple devices then it does point to something at the network level, not device level. The first culprit would be your router, then your ISP.


Your router may be misconfigured, handing invalid DNS, or blocking/mis-routing traffic to certain IP addresses.

Some 'smart' routers also do content filtering, and this may be getting triggered by something on the sites in question.

I know my ISP-provided router does this. Generally it works well, but the blacklisting system is opaque, at best.


If it's not your router then it could be your ISP. They can also have misconfigured configuration, router setup and content filtering, but it's even more opaque and harder to diagnose.


The problem could also be IPv6 vs. IPv4. Your Mac will try to use IPv6 where possible, but the router/ISP may not support that.


The reason the VPN circumvents it is that your request is encrypted and sent over the VPN, where the VPN server decrypts it and establishes the connection to the end server. To your router and ISP, it just looks like another connection to a semi-random server, so their misconfiguration/blocks don't kick in.


For troubleshooting, I'd start by going offsite - if the same device (sans VPN) can connect to those sites while on cell service or at the local coffee shop, then it's not the device.


Net turn off IPv6 (if it's on), and try again.


Next would be DNS - the ISP's DNS server may be blocking the connection, so change the DNS servers you use (via System preferences -> Network). Override whatever your router/ISP set and use Google DNS:


8.8.8.8

8.8.4.4


If it still doesn't work, open Terminal.app and try:


traceroute support.apple.com


You should see the path between your device and the server support.apple.com

While not definitive (some routers will not respond to traceroute), it might provide some insight.


(for grins, you can run the above while the VPN is on and off to compare the difference, and learn how much the overhead the VPN is adding).


Hopefully that will give some insight. You can also post back the actual message from Safari which can give hints as to the problem (e.g. can't find server, connection refused, SSL mismatch, etc.). These error messages aren't always easy to decode, but someone here might wean something from it.

Similar questions

15 replies
Question marked as Top-ranking reply

Sep 10, 2024 11:04 AM in response to djborden

If it's multiple devices then it does point to something at the network level, not device level. The first culprit would be your router, then your ISP.


Your router may be misconfigured, handing invalid DNS, or blocking/mis-routing traffic to certain IP addresses.

Some 'smart' routers also do content filtering, and this may be getting triggered by something on the sites in question.

I know my ISP-provided router does this. Generally it works well, but the blacklisting system is opaque, at best.


If it's not your router then it could be your ISP. They can also have misconfigured configuration, router setup and content filtering, but it's even more opaque and harder to diagnose.


The problem could also be IPv6 vs. IPv4. Your Mac will try to use IPv6 where possible, but the router/ISP may not support that.


The reason the VPN circumvents it is that your request is encrypted and sent over the VPN, where the VPN server decrypts it and establishes the connection to the end server. To your router and ISP, it just looks like another connection to a semi-random server, so their misconfiguration/blocks don't kick in.


For troubleshooting, I'd start by going offsite - if the same device (sans VPN) can connect to those sites while on cell service or at the local coffee shop, then it's not the device.


Net turn off IPv6 (if it's on), and try again.


Next would be DNS - the ISP's DNS server may be blocking the connection, so change the DNS servers you use (via System preferences -> Network). Override whatever your router/ISP set and use Google DNS:


8.8.8.8

8.8.4.4


If it still doesn't work, open Terminal.app and try:


traceroute support.apple.com


You should see the path between your device and the server support.apple.com

While not definitive (some routers will not respond to traceroute), it might provide some insight.


(for grins, you can run the above while the VPN is on and off to compare the difference, and learn how much the overhead the VPN is adding).


Hopefully that will give some insight. You can also post back the actual message from Safari which can give hints as to the problem (e.g. can't find server, connection refused, SSL mismatch, etc.). These error messages aren't always easy to decode, but someone here might wean something from it.

Sep 17, 2024 6:57 PM in response to Camelot

Here's an interesting discovery. If I turn on iCloud Private Relay, the problem is gone, at least for the support.apple.com pages. This, coupled with the fact that when the Nord VPN was enabled, those pages also loaded normally seem to suggest that my normal configuration (without NordVPN or Private Relay enabled) is sending bad DNS info, but why? I'm on he verge of doing a reset to factory defaults on my Orbi router.

Sep 17, 2024 2:19 PM in response to djborden

Well, that's interesting.


If I read that right, your request is being sent to Akamai in South America (assuming 'baires1.bai' points to Beunos Aires, Argentina, but that could be wrong). Assuming you're in the northeastern US, that seems like the wrong place to go.


It does look like a DNS issue, though. The DNS resolves the hostname to that 2.19.36.146 address, which is in Akamai's network, which is likely valid. But there's no reason for the DNS resolver to send you there.


What are your current DNS settings? Does the routing change if you change the DNS server as described in my earlier post?

Sep 10, 2024 6:23 AM in response to djborden

I have no idea, but VPNs are not necessary, convey zero benefits, generally cause problems, and are extremely popular for reasons that escape my understanding. Most connection problems are solved by removing them and all similarly categorized junk — broadly defined as things that prevent Macs from working the way Apple designed them to work.


Is an extension or something loaded during my computer startup that could cause the problem I'm having.


Quite possibly.


Also, I'm having this problem on at least 5 different devices - a mix of MacOS and iOS devices.


If they are not similarly affected then you may have effectively isolated the problem to beyond your Mac. Investigate your router, wireless access points, and if you have the opportunity to use a different wireless network or a different ISP, try that also. In the meantime please review If Safari doesn't open a page or work as expected on your Mac. There are many useful suggestions in that document, among some that are less than useful, but exhaust all of them. If you need more help by all means please write back.

Sep 16, 2024 9:42 AM in response to Camelot

Here's what traceroute support.apple.com returned in Terminal with the VPN offf..Last login: Sat Sep 14 18:07:37 on console


You have mail.




The default interactive shell is now zsh.


To update your account to use zsh, please run `chsh -s /bin/zsh`.


For more details, please visit https://support.apple.com/kb/HT208050.


Mac-mini:~ xxxxxxxxx$ 


Mac-mini:~ xxxxxxxxx$ traceroute support.apple.com


traceroute to e2063.e9.akamaiedge.net (2.19.36.146), 64 hops max, 52 byte packets


 1  192.168.1.1 (192.168.1.1)  1.106 ms  0.566 ms  0.366 ms


 2  rbpool8-interface.shoreham.net (208.65.166.1)  1.660 ms  1.919 ms  1.882 ms


 3  rbpool2.shoreham.net (208.65.161.1)  1.760 ms  0.981 ms  1.814 ms


 4  vtelinet-216-66-121-133.vermontel.net (216.66.121.133)  4.850 ms  4.836 ms  5.295 ms


 5  vtelinet-216-66-105-57.vermontel.net (216.66.105.57)  13.574 ms  13.265 ms  14.296 ms


 6  * * *


 7  be3362.ccr41.jfk02.atlas.cogentco.com (154.54.3.9)  14.811 ms


    be3363.ccr42.jfk02.atlas.cogentco.com (154.54.3.125)  14.905 ms


    be3362.ccr41.jfk02.atlas.cogentco.com (154.54.3.9)  13.797 ms


 8  be3495.ccr31.jfk10.atlas.cogentco.com (66.28.4.182)  14.584 ms


    be3496.ccr31.jfk10.atlas.cogentco.com (154.54.0.142)  13.989 ms


    be3495.ccr31.jfk10.atlas.cogentco.com (66.28.4.182)  14.503 ms


 9  telecomitalia.jfk10.atlas.cogentco.com (154.54.10.218)  14.442 ms  14.397 ms  14.884 ms


10  ae1.baires1.bai.seabone.net (185.70.203.89)  157.202 ms  157.393 ms


    ae0.baires1.bai.seabone.net (185.70.203.99)  156.358 ms


11  akamai-sa.baires1.bai.seabone.net (185.70.203.49)  242.957 ms  420.273 ms  214.721 ms


12  * * *


13  * * *


14  * * *




Sep 10, 2024 6:11 AM in response to John Galt

Thanks for your reply. Maybe my knowledge is too basic, but why would the problem only exist when the VPN is not activated, and in fact the Nord VPN app isn't even launched? Is an extension or something loaded during my computer startup that could cause the problem I'm having. Also, I'm having this problem on at least 5 different devices - a mix of MacOS and iOS devices.

Sep 11, 2024 10:34 AM in response to djborden

That helps.


It indicates DNS is returning an IP address (it could be the wrong address, but at least we have an address).

It also indicates that you can connect to the server (so not, necessarily, a routing issue).

You're not getting a reply back, though, which could be a routing issue, or filter.

Let's see what the rest of the testing comes back with.


Sep 17, 2024 4:03 PM in response to Camelot

Thanks for your reply. I changed the DNS servers to 8.8.8.8 and 8.8.4.4 as suggested, and the Traceroute data I posted is with those settings. I can't remember my original settings, but the problem existed with whatever those settings were. Do you have a suggestion other servers I should try and I can then try Traceroute again and post those results.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Recently, some Websites won't load unless VPN is turned on

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.