VPN After an ISP Change: Same House, New Carrier, Forget the Old Modem SSID

A router you bought is a new radio on the same last mile. A move is cardboard and two buildings. CGNAT is how a lot of ISPs stretch IPv4. Home Wi-Fi is whether you wanted a hop on a LAN you already live on. Switching carriers at the same address is none of those. The street did not change. The account number on the bill did. The modem, the ONT, or both did. New default name. New password on a sticker the technician left on the fridge. New DHCP pool. Sometimes a v6 prefix the old cable brick never offered. Sometimes a shared public IPv4 the old DSL line never used. Your Klox install is still the same binary. The observer under it is a different company.

People treat a new ISP as the same house with a faster download number. Same kitchen, same year, not really a network. The phones disagree. They still list the old modem SSID as saved. They still try it first. They still skip the tunnel because last month that name was trusted. Farms skip that sentence because the keyword is home. Home after a carrier change is a new last mile, then a habit you already had, then a test.

Fiber overlay is the messy cousin. The truck hangs an ONT. Copper or coax may still sit in the wall for a week. Two radios can live in one hallway if you leave the old gateway powered. That is not a mesh you designed. That is two last miles arguing. Unplug the retired box once the new one actually routes, or you will spend an evening debugging a tunnel that is fine while the laptop is still on the dead carrier.

I will not walk packet sniffing. The public Wi-Fi how-to already did. I will not pack your chargers. You did not move. I will not sell you a preconfigured closet box. I will not name a consumer firmware SKU we do not ship. Cloudflare's IPv6 explainer is what a lot of overlays turn on by default. It is not a VPN. It is not Klox.

Klox is a consumer tunnel to an exit you picked. It is not the new ISP's activation disc. It is not the ONT on the wall. It will not inherit a trusted-network flag from the old modem SSID unless you told the app the new name is also yours. Treat the first handshake on the new last mile as a first handshake, not as a continuation of last year's cable bill.

The old modem name is still in every device that ever joined it. Phones offer it first. Laptops auto-join a neighbor if the password was a vendor default you never changed. Tablets sit in a saved-network list until you prune them. Forget it on purpose. Windows, macOS, iOS, Android: open the known-networks list and delete the dead string. Then join the new one from the sticker, or from the new ISP app, or from the sheet the technician left.

If you leave the old name saved, two ugly things happen. The device hunts a radio that is off, fails, and looks like the internet is dead. Or a neighbor still uses a similar default name and you join their LAN because the password was the vendor string printed on a million boxes. Finish whatever splash they have. Then leave. Do not treat the first Wi-Fi name that sorts to the top as the house.

Return-the-modem day makes this worse. The old box still broadcasts until you unplug it. If you forget the SSID after you drop the hardware at the store, a neighbor with the same vendor default can look like home. Forget the name while the retired box is still in your hallway, then unplug it, then join the new sticker. Order matters.

I will not paste OS click-paths that rot next autumn. Search the settings app for known networks, saved networks, or Wi-Fi. Delete the old ISP gear SSIDs. Confirm the new one. Then open Klox. Then Connect. WireGuard first.

A VPN does not forget networks for you. Smart Connect does not delete a saved SSID. The OS list is furniture. You own the broom. Do this on all five seats, not only on the laptop you used to email the new carrier. The phone in a kid's bag still has the old name. That is how people invent a curse about the new ISP blocking VPNs. The phone never joined it.

A new fiber shop often puts you behind carrier-grade NAT. Your laptop thinks it has a private number. The internet sees a shared door. Inbound ports fail because that door is not yours to open. A VPN does not undo that. It changes the hop you leave through. Sites see a VPN exit instead of the ISP door. Consumer exits are shared too. You still are not hosting inbound. The Cgnat: Not a VPN Setting owns that physics. This page exists so you do not declare WireGuard dead because a game server could not punch a hole the afternoon the overlay went live.

IPv6 is the other leftover. Dual-stack shows up because the new wizard left it on. A v4-only tunnel without a block can leave the v6 path on the NIC. Features lists IPv6 leak protection as a block. Test it. Do not file a ticket that the new ISP broke VPN because a test page showed a prefix you did not have on copper. The IPv6 Leak in Plain English: Two Addresses, One Laptop article owns the clicks. This page exists so you do not skip the test after a cutover.

They are siblings, not clones. Crowded v4 is a sharing story. Missed v6 is a leftover-path story. DNS is a third chore. Farms mash all three into one screenshot of Fastest server. Do not. If inbound failed off-tunnel, that is CGNAT. If a test page still shows a v6 after Connect, that is a leak test. If names still resolve at the ISP resolver after Connect, that is tunnel DNS. Three desks. Three URLs. One afternoon, then stop.

Baseline with the VPN off so you know what this carrier looks like in the clear. Write down the v4. Note whether v6 exists. Then Connect. Then the same tools. A pass is this browser, this network, this moment. It is not a character reference for the old cable plant.

I will not invent a dedicated-IP SKU so this article can pretend you got a public door back. I will not invent a city count as a reason CGNAT is special. I will not paste adapter checkboxes so this URL competes with the leak how-to. Point. Test. Move on.

Join the new SSID first. Finish the new ISP's welcome garden if the browser hangs on their activation page. Then open Klox. Then Connect. WireGuard first. OpenVPN when that welcome page hates UDP. Switching protocols while the splash is unfinished wastes twenty minutes and invents a story that the new carrier blocks VPNs.

Default DNS on a new gateway is the ISP's resolver until you change it, and a consumer VPN that actually connected still wants DNS inside the tunnel. Features lists DNS through the VPN tunnel. I will not invent a custom DNS picker in the Klox app so this article matches a competitor screenshot. Trust that sentence after Connect is up. Do not spend cutover day hunting a lab row.

If names still resolve at the new ISP's resolver after Connect, you are not testing leaks. You are testing a client that did not take the route. Reconnect. Confirm the app says connected. Load a plain site. Then run the Leak Test After You Connect a VPN: IP, DNS, WebRTC, IPv6. Do the check on the laptop and on a phone. Cutover week is when people only test Chrome on the machine they used to read the ISP email. The tablet on the counter is a different stack.

The sticker on the modem is not tunnel DNS. The ISP app's recommended resolver is not tunnel DNS. Private DNS on Android is a different argument the Android Private DNS vs a VPN: DoT Hostname Versus Tunnel DNS page already owns. Here the job is smaller. After Connect, names should follow the tunnel. If they do not, stop. Fix the client. Then continue.

Cellular on a phone is a valid afternoon skip while the technician is still in the hallway and the copper is dead. That is not a leak. That is a radio. When the new Wi-Fi actually routes, rejoin, then confirm tunnel DNS on purpose. Do not treat LTE as proof the house is done.

Fiber overlay week often leaves the old gateway powered because nobody wanted to kill the old SSID until the new one proved itself. That is reasonable for an hour. It is not a plan. Two DHCP servers, two default names, two paths to the internet, and a laptop that still prefers last year's string. Unplug the retired box once the new last mile actually works. Do not run both as two homes.

If you kept your own router behind the new ONT, that is a different sentence. Bridge the ISP modem if they allow it. If they do not allow it, you have double NAT. Outbound still works. Inbound was already a CGNAT problem on a lot of fiber. A VPN still wraps the hop from the device. Putting Klox on the closet box is a lifestyle choice the Router VPN vs Per-Device Apps article already owns. This page will not clone it. Cutover week only adds: the new box is often an ISP-rented gateway. If the lease says you may not alter the firmware, you may not alter the firmware. Put the apps on the devices you carry.

Smart Connect, if the app shows the row, means connect on untrusted Wi-Fi. The old home SSID was probably marked trusted, or excluded, because you lived on it. The new SSID is a new name. If you wanted the tunnel on house Wi-Fi, confirm the new name is in the habit you meant. If you wanted the tunnel only on cafes, confirm the new name is not treated like a shop just because it still says the vendor on the sticker.

Always-on on a phone does not know you changed carriers. It will try to hold a peer on the new radio the same way it did on the old one, once the phone actually joins. That is usually what you wanted. It is also how a tablet that never joined the new name still looks idle while you think the house is covered.

Windows and macOS trusted-network lists are OS furniture, not Klox SKUs. If the laptop auto-joins a leftover mesh node you unplugged, you joined a radio that is gone. If it auto-joins a neighbor, you joined a LAN you do not run. Finish whatever splash they have. Then tunnel, or leave.

If the Smart Connect row is missing in the app, you have a Connect button. Use the button after you have a real route. Do not perform a portal ritual that is not there. Load a plain site. If it hangs on the new ISP welcome page, you are still in their garden. Complete it. Then Connect. WireGuard first. OpenVPN when that welcome page hates UDP.

Klox is five simultaneous connections. Install can be more. Connect cannot. A carrier change does not grow the plan. It also does not shrink it. What it does is leave three phones on the old modem name and two on the new one, so you think the house is half-tunneled when half the house is still hunting a ghost.

Walk the list. Laptop. Phone. Partner phone. Tablet. The desktop that never sleeps. Forget old ISP gear SSIDs. Join new SSID. Open the app. Connect if that is the habit you wanted at home. Sleep is not disconnect. A lid on the desk can keep a peer. Open the app and look. Remove retired devices in the account UI when the old phone is actually in a drawer. I will not invent a portal URL. Use the account page you already use.

A router you left holding a tunnel, if you ever ran one, still counts as one seat until it loses power or you disconnect it. The new ONT is not automatically that seat. Do not assume a mesh node inherited the old handshake. It did not. The old ISP gateway you stuffed in a bag still might, if you never powered it down with the peer up. Unplug it. Then look at the account.

Phone plus laptop at the kitchen table is two. That is the usual first night after a cutover. Do not tunnel every gadget you have not named yet. Five is enough for a household that actually carries computers. It is not a seating chart for bulbs.

IoT you dumped on Guest because a blog said to still cannot run our app. The camera can wait, or it can sit on Guest without a consumer VPN, which is how most bulbs live anyway. Helpers assembling the ONT do not need your Klox login. Isolation first. Their app, their account, if they even needed a hop. Change the Wi-Fi password. Change the admin password. Turn on WPA2 or WPA3 as the box offers it. Those are owner jobs when the lease lets you into the admin page. They are not a VPN. A VPN is not a firmware update.

Connected is a UI state. The new carrier has not agreed until you check. After the first handshake on the new SSID, run the after-connect checklist: IP, DNS, WebRTC, IPv6. Baseline with the VPN off so you know what this house looks like in the clear on this ISP. Then connect. Then the same tools.

If the address did not change after Connect, stop. You are not testing leaks. You are testing a client that did not take the route. Reconnect. Try OpenVPN if WireGuard is stuck on an ISP welcome page. Complete the garden first. Then continue.

IPv6 is louder on a lot of fiber overlays than on the cable brick you stuffed in a bag. Dual-stack shows up because the wizard left it on. A v4-only path without a block can leave v6 on the NIC. Test it. Do not file a ticket that the new ISP broke VPN because a test page showed a prefix you did not have last month.

WebRTC can still offer a local candidate if a browser is rude. Features lists WebRTC leak blocking. Run the checklist on more than one browser if you can stand it. Do the check on the laptop and on a phone. Cutover week is when people only test the machine they used to chat with support. The tablet on the counter is a different stack.

If inbound still fails off-tunnel, that is not a leak. That is CGNAT, or double NAT, or both. Read the CGNAT essay. Do not keep reconnecting as a ritual. A leak site prints an IP. It does not print a NAT type. One afternoon, then stop. I will not paste adapter checkboxes so this URL competes with the test how-to. This page exists so you do not skip the test because the street did not change.

If you bought Klox only because a home-VPN farm said a new ISP requires a new brand, the consumer window is seven days on first purchase. Live page: /refund. Renewals are not that window. Store purchases follow the store. I would rather you keep the year if the habit already existed on the old last mile. Yearly from $2.83 a month is not a hardware tax. A new carrier is not a new SKU. The seven-day window is not a fiber promo and it is not an ISP coupon.

Cookies on this site live at /cookie. The new modem's portal cookies are the ISP's. Do not mix those desks when you are hunting a privacy page at midnight. Our cookie URL is /cookie. It is not a policy about the ONT sticker.

WireGuard first on the new radio. OpenVPN when the ISP's welcome page or a rude AP hates UDP. One change, test a site, stop. If both fail, it is the garden, the kill switch, or a client that is still aimed at a network that does not exist. Cellular on a phone is a valid first-night skip while the technician is still in the hallway.

Do not buy a month of a farm brand because a best VPN for home list told you a carrier change requires a reset, then also keep Klox, then refund neither. Pick one tunnel. Five devices is enough. You do not need a city count to sit in a kitchen that still has the old modem in a bag.

Change the Wi-Fi password on a gateway you are allowed to administer. Change the admin password. That is hygiene. It does not replace a tunnel. It also does not require a custom firmware image we do not sell. Sticker passwords are not a personality. The new ISP's default name is not yours until you rename it, and renaming it does not hide the graph from the new last mile. HTTPS already locked the page. The carrier still sees the hop unless that hop is a VPN.