Why does a VPN work for a few minutes, then just stop?

You set up a VPN or proxy on a restrictive network. It works. Then, ten minutes or two hours later, it just stops — no error, no warning, just dead. You try a different app, same thing happens eventually. This isn't a coincidence and it isn't your connection being flaky. It's usually active probing.

What active probing actually is

Most people assume a firewall blocks a VPN the moment it sees suspicious traffic. That's not how the more sophisticated censorship systems work. Instead, the firewall's deep packet inspection flags a connection as possibly a proxy based on traffic shape — packet timing, TLS handshake quirks, entropy that doesn't look like a normal website. It doesn't block on that suspicion alone, because false positives would break real traffic too.

Instead it logs the server's IP address, and later — sometimes minutes, sometimes hours — a separate system connects back to that IP and runs its own protocol tests against it: does it respond like a Shadowsocks server, an OpenVPN server, a proxy that speaks back in a way an ordinary web server never would? If it answers the probe the way a real proxy does, the IP gets blocked. If it responds like nothing's there, or like a normal website, it survives.

This is documented behavior, not speculation. Researchers reverse-engineered exactly this pipeline against the Great Firewall in the 2020 paper How China Detects and Blocks Shadowsocks, and GFW Report has published follow-up measurements on the probing system's targeting and timing at gfw.report. The pattern also shows up in OONI's network interference measurements, which log the same connect-then-verify signature against multiple circumvention tools.

Why this explains the "works, then dies" pattern

A full IP or protocol block happens immediately and consistently. Active probing has a delay baked into it, because the probe has to be scheduled and run separately from the traffic that triggered it. That's the tell: if a connection works right after you set it up and then goes dead later with no config change on your end, the timeline itself is evidence of probing rather than a blanket block. A dropped connection that comes back a few minutes later on its own, only to die again, often means the probing system re-checks IPs on a schedule rather than banning them permanently the first time.

What actually resists this, and what doesn't

A VPN protocol that looks like a VPN protocol — a distinctive handshake, predictable packet sizes, a TLS ClientHello that doesn't match any real browser — is exactly what a probe is built to fingerprint. Running the same protocol on a new IP just buys you time until that IP gets probed too.

What holds up is a transport where the probe itself can't tell the difference between your server and a real website. VLESS with the Reality protocol does this by borrowing the actual TLS certificate and handshake behavior of a genuine site, so a probe connecting to it sees a normal TLS response, not a proxy giving itself away. Pangea uses Reality as its first transport for exactly this reason, alongside four others — Cloak, Shadowsocks, Hysteria2, and NaiveProxy — tried in sequence, because different networks fingerprint different things and no single transport is immune to every detection method being developed against it. That's an honest description, not a guarantee: a network operator who explicitly blocks the hub's IP outright, or a full network shutdown, isn't something any transport gets around.

If you want to check whether this is what's happening to you, the free five-day trial doesn't need a card, so you can test a transport against your own network before deciding anything. If your priority is not handing over identity at all, Pangea also takes Monero with no email or card required — though that path skips the trial.

The practical takeaway

If your VPN reliably works for a while and then reliably dies, don't just restart the same protocol on a new server and expect a different outcome. Ask what the network is probing for, not just whether it's blocking. That's the difference between a connection that lasts a day and one that lasts a week.

Try Pangea or read how the transports work before you commit.