Multiple VPN Connections: Why the Second Tunnel Fails

When a second VPN tunnel from the same router or network fails to connect, the cause is almost always a conflict in network address translation (NAT) or routing. The first tunnel works because it established its mappings first; the second tunnel cannot because the router or the VPN client cannot distinguish the two sessions. This page explains the mechanism, what you can fix, and what you cannot.

Why Two VPNs Clash

A VPN tunnel encapsulates your traffic and sends it to a VPN server. For the tunnel to work, the router must keep track of the connection so that return traffic comes back to the right device. This is NAT’s job. NAT rewrites the source address of outgoing packets and remembers the mapping so replies are sent back to the original device.

When you start a second VPN connection, the router must create a second mapping. Problems arise when:

• The VPN protocol uses the same port numbers for both connections. For example, two IPsec tunnels both use UDP ports 500 and 4500. The router cannot tell which incoming packet belongs to which tunnel because the destination IP is the same (the VPN server) and the ports are the same.
• The VPN protocol does not play well with NAT. Protocols like PPTP (which uses GRE) and IPsec (in transport mode) were not designed to be NATed. They embed the original IP address in the packet, so NAT breaks the integrity check. The router may drop the second tunnel because it cannot validate it.
• The router’s NAT table has a limited size. Some consumer routers have small NAT tables. A second tunnel may simply exhaust the available entries.
• Routing conflicts. If both VPNs try to route the same subnets, the router may not know which tunnel to send traffic through, causing one to fail.

Which VPNs Can Share a NAT?

Key point: The failure is not about the number of VPNs, but about the router’s ability to differentiate them. If the router can assign different port numbers or IP addresses to each tunnel, they can coexist. If not, the second one fails.

What You Can Change

1. Use Different VPN Servers

The simplest fix is to connect to different VPN servers. If each tunnel goes to a different IP address, the router can distinguish them by destination IP, even if the ports are the same. This works for most protocols, including IPsec and OpenVPN.

2. Use Different Ports (If the VPN Allows)

Some VPN protocols let you configure the port. For OpenVPN, you can set a custom port on the client. For IPsec, you cannot change the port (it is fixed at 500/4500), but you can use different servers.

3. Enable NAT Traversal (NAT-T) on IPsec

IPsec has a feature called NAT-T that encapsulates the IPsec packets inside UDP, which helps it work through NAT. If your router or VPN client supports it, enable it. However, NAT-T does not solve the multiple-tunnel problem if both tunnels use the same server and ports.

4. Use a Router That Supports Multiple VPN Tunnels

Some routers, especially business-grade ones, can handle multiple VPN connections simultaneously. They do this by using different source ports or by tracking the connections more intelligently. If you need multiple tunnels, consider upgrading your router.

5. Change the VPN Protocol

If you are using PPTP or L2TP/IPsec, switch to OpenVPN or WireGuard. These protocols are more NAT-friendly and are more likely to work with multiple connections.

What You Cannot Fix

If the VPN server is the same for both connections and the protocol uses fixed ports, you cannot fix the problem from your end. The router cannot distinguish the two tunnels, and no client setting will change that. In that case, you must use a different server or a different protocol.

Similarly, if your ISP or carrier uses carrier-grade NAT (CGNAT), you may not be able to run any VPN that requires inbound connections. CGNAT is common on mobile networks and some home internet connections. You can check if you are behind CGNAT by looking at your router’s WAN IP address. If it is in the range 100.64.0.0/10, you are behind CGNAT. In that case, you cannot fix it; you would need to ask your ISP for a public IP address.

Common Misdiagnosis

A frequent mistake is to blame the VPN client software or the operating system. Users think that the second VPN fails because of a software bug or a configuration error. This is a natural mistake because the error messages often say “connection failed” or “timeout,” which sounds like a software issue.

In reality, the problem is almost always at the router level. The router is the one doing NAT, and it is the one that cannot handle the second tunnel. Software settings on your computer cannot change how the router handles NAT.

Another misdiagnosis is to think that the problem is with the VPN server. But if the first VPN works, the server is fine. The issue is that the router cannot create a second mapping.

Commands to Diagnose

On Windows, you can check the routing table to see if both VPN routes are present:

route print

Look for the routes for the VPN subnets. If only one is present, the second VPN did not add its route, which indicates a routing conflict.

You can also check the NAT table on your router (if you have access) to see if entries are being created. This is usually in the router’s web interface under “NAT” or “Port Forwarding.”

On Windows, you can check the active network connections:

netstat -an

Look for UDP or TCP connections to the VPN server’s IP. If you see only one connection, the second VPN is not establishing.

When to Contact Your ISP

If you are behind CGNAT, you cannot run multiple VPNs (or any VPN that requires inbound connections). Contact your ISP and ask for a public IP address. They may charge extra for this. If they cannot provide one, you cannot fix the problem.

Summary of Fixes

• Use different VPN servers.
• Use different ports (if the protocol allows).
• Enable NAT-T for IPsec.
• Upgrade to a router that supports multiple VPN tunnels.
• Switch to a NAT-friendly protocol like OpenVPN or WireGuard.
• If all else fails, contact your ISP about CGNAT.