How to Fix Common Windows VPN Errors (809, 789, 691)

When a Windows VPN connection fails, the system often shows only a number, such as 809, 789 or 691. These codes look cryptic, but each one points to a small group of causes. This guide explains what they mean, shows the safest fix to try first and helps you tell a login problem from a network problem.

Windows shows these codes when you use its built-in VPN connection. If you connect with the app listed on your My Pass page, you will see the app's own messages instead. The network, login and clock checks below still apply. If you have not set up your connection yet, start with the guide on setting up a VPN on Windows.

What the common codes mean

Code	Message in plain words	Usual cause	First thing to try
691	Access denied, username or password not accepted	Typo in login details, wrong sign-in type or an expired pass	Re-copy details from My Pass
809	The server did not respond	A firewall, router or network blocks the VPN traffic	Try another network
789	Security layer failed during negotiation	Wrong connection type or shared key, or a wrong clock	Check the type and the time
800	Unable to establish the VPN connection	Wrong server address, or no route to the server	Re-check the server address
806	Connection blocked partway	Traffic needed by older connection types is blocked	Try another network

Treat the table as a map, not a diagnosis. The same code can have more than one cause, so work through the checks in order.

Five-minute checks before you change anything

These solve a surprising share of problems, and they never hurt.

1. Check your pass. Open My Pass and confirm the pass is delivered and has not expired. Expiry is shown in UTC.
2. Check your internet. With the VPN off, open a website. If normal browsing fails, fix that first.
3. Check the date and time. Go to Settings > Time & language > Date & time, make sure time and time zone are set automatically, and choose Sync now.
4. Restart Windows. Updates, network drivers and stuck connections clear up after a restart.
5. Use the general checklist. The guide in VPN not connecting walks through the same order of checks for any device.

Fix error 691: access denied

Error 691 is the clearest of the three. The server was reached, but it did not accept your sign-in.

1. Open My Pass and show the login details. Details appear only inside My Pass after you sign in; they are never sent by email. If you cannot find them, read where are my login details.
2. Use the copy buttons to copy the username, and paste it into the Windows VPN entry. Do the same for the password. Do not retype them.
3. Check for a space at the start or end of either field.
4. Open Settings > Network & internet > VPN, select your connection and choose Advanced options > Edit. Make sure Type of sign-in info is set to User name and password.
5. Check that the pass has not ended. If it has, renew it from My Pass and use the same details again.

If you reused an old Windows credential, remove the saved one first. Delete the VPN entry, add it again and enter the details from My Pass.

Fix error 809: the server did not respond

Error 809 means Windows sent its request and got nothing back. The most common reason is that something on the path blocks the traffic.

1. Test another network. Connect your PC to a phone hotspot and try again. If it works there, the first network, such as a hotel, office or school network, or your router, is blocking VPN traffic.
2. Restart the router. Turn it off for thirty seconds. Home routers sometimes keep stale connection records.
3. Check the server address. Compare the address in the Windows entry with My Pass, character by character.
4. Check your firewall and security software. See the section below.
5. Try another connection type if My Pass lists more than one.

A note about ports. Different connection types use different network traffic, for example UDP ports 500 and 4500 for IKE-based types such as those described in RFC 7296, TCP 1723 and GRE for older PPTP, or TCP 443 for SSTP. Some networks only allow ordinary web traffic. You cannot change a public network, so another network is the practical fix.

Some online guides tell you to edit a registry value for 809. That setting concerns servers behind NAT and can change how Windows handles all VPN connections. Do not edit the registry for this unless an official guide for your specific case asks you to, and then create a restore point first.

Fix error 789: security layer failed

Error 789 appears while the two sides are agreeing on their security settings. It is mostly seen with L2TP connections.

1. Check the VPN type. In Settings > Network & internet > VPN > Advanced options > Edit, compare the VPN type with what My Pass lists. If My Pass does not name one, leave it on Automatic.
2. Check any shared key. If My Pass gives a pre-shared key, make sure it is entered exactly, including capital letters.
3. Check the clock. A wrong date or time breaks certificate and key checks. Sync it as described above.
4. Try another network. Some networks that sit behind address translation interfere with this negotiation.
5. Recreate the connection. Delete the entry and add it again with the details from My Pass. This removes any hidden typo.

Check the Windows firewall and security software

Firewalls and antivirus programs protect you, so change them carefully.

1. Temporarily turn off any third-party firewall or antivirus web shield and test the connection once.
2. If the VPN works now, turn the protection back on right away. Do not leave it off.
3. Add an allow rule for the VPN app or connection in that software's settings, then test again.
4. For the Windows firewall, open Windows Security > Firewall & network protection > Allow an app through firewall, and make sure the VPN app is allowed on the network type you use.
5. If the computer is managed by an employer or school, do not change these settings. Ask the administrator.

Also check that no other VPN or proxy tool is running, since two tunnels can conflict.

Reset the network adapter and network stack

If the checks above did not help, the cause may be a stuck network component on your PC.

1. Disable and re-enable the adapter. In Settings > Network & internet > Advanced network settings, find your Wi-Fi or Ethernet adapter and use disable, then enable. The virtual WAN Miniport adapters for VPN are managed by Windows, so you do not normally need to change them.
2. Flush DNS and reset the stack. Open Command Prompt as administrator and run ipconfig /flushdns, then netsh winsock reset. Restart the PC.
3. Last resort: network reset. In Windows 11 go to Settings > Network & internet > Advanced network settings > Network reset. This removes saved Wi-Fi networks and VPN connections and reinstalls network adapters, so be ready to enter Wi-Fi passwords and add the VPN again.

Limits and when to contact support

A VPN depends on your device, the network and the server. Some networks block VPN traffic altogether, and no guide can promise a connection on every network. After you connect, check that the VPN is really working, and if the connection keeps dropping, see how to improve connection stability.

If your pass is active, your details are correct, and a different network and a restart did not help, write to xpassvpn@gmail.com. Include the error code, your Windows version, the connection type you used and the email from checkout. Never send your password.

Summary

Error 691 is about login details, 809 is usually a blocked or unreachable network and 789 is a security negotiation problem, often a wrong type, key or clock. Check your pass and sign-in first, then test another network, then look at the firewall, and only then reset the adapter. Browse the help center for guides on other devices.