Kaspersky VPN Secure Connection error 628: tunnel drops after the daily limit

Fix it now

628 is a Windows connection error, not a Kaspersky one: Microsoft publishes it as ERROR_DISCONNECTION, the specified port was disconnected. It says nothing about the traffic allowance, so read the counter yourself – the free version gives 200 MB a day, or 300 MB with the device connected to My Kaspersky.

ipconfig /flushdns
netsh winsock reset
netsh int ip reset

1. Read the traffic counter in the VPN application first. Kaspersky’s figure can differ from the actual amount by up to 15 per cent, so treat a counter close to the limit as spent.
2. Connect the device to My Kaspersky if you have not. Kaspersky documents an extra 100 MB a day for that, and 300 MB more with an active Kaspersky Plus subscription.
3. Choose a different server location and connect again. One busy or blocked endpoint accounts for a lot of these.
4. Test on a phone hotspot. If the tunnel builds there, the fault is the network you were on rather than the client.
5. On a captive network, complete the portal sign-in in a browser before starting the VPN.
6. Run the reset commands above, restart, and try once more before reinstalling anything.

The allowance is per device. A licence covering several machines does not give them a shared pool, so the fifth device in the house has its own daily figure rather than a share of one.

If the tunnel comes up and stays up, you are done. If not, the next section explains what each of these codes is actually reporting.

Why it happens

A tunnel comes up in stages: resolve the endpoint, open a session, authenticate, negotiate the data channel. 628 lands at the point where the far end hangs up. Microsoft’s published text is short and worth taking literally – the specified port was disconnected – because it means the code carries no information about why. A server declining you and a network device killing the session look identical from the client.

That is why the traffic allowance is worth checking first even though the code does not mention it: it takes ten seconds and it is the most common single answer. Kaspersky publishes the free version as 200 MB of secure traffic per day when the device is not connected to My Kaspersky, an extra 100 MB a day once it is connected, and 300 MB more where there is an active Kaspersky Plus subscription. It also publishes a warning most people have not read: the traffic figure shown in the application can differ from the actual amount by up to 15 per cent.

If traffic is not it, the companion codes tell you which layer objected, and each has a published meaning. 651 is your modem or other connection device reporting an error, which points at the local adapter. 735 is the requested address being rejected by the server, which points at the far end. 807 is the connection between your computer and the VPN server being interrupted, and Microsoft attributes it to VPN transmission problems, internet latency or the VPN server having reached capacity – with reconnecting as the documented first action.

Full reference

The four numbers, and what Windows says about each

None of these is a Kaspersky code. They belong to Windows’ remote access layer and any VPN client on the machine can raise them, which is a useful test in itself: if a second VPN fails the same way on the same network, reinstalling Kaspersky will not help.

The traffic figures Kaspersky publishes

Kaspersky states that the used-traffic figure shown in the main window may differ from the actual amount by up to 15 per cent. Do not treat a counter reading 180 MB as proof you have 20 MB left.

Working the network layer without guessing

1. Test on a phone hotspot. This single test separates a client problem from a network one and takes a minute.
2. If the hotspot works, the machine is fine. Take the question to whoever runs the network you were on.
3. If the hotspot fails too, run the reset commands, restart, and test again.
4. If it still fails, check Device Manager for a VPN adapter or WAN Miniport entry with a warning icon.
5. Only then reinstall the application.

What the reset commands actually change

All three need a restart before they take full effect, and netsh winsock reset will remove third-party network components that some applications depend on. Do them together, restart once, and expect to re-check any other networking software afterwards.

Deciding whether the cap is your actual problem

• Note how long the tunnel stays up. Minutes rather than seconds, with normal traffic, points at the allowance.
• Note whether it fails at the same time each day. An allowance that resets daily produces exactly that pattern.
• Note whether it fails on every network including a hotspot. That points away from the network and towards the account or the client.
• Note whether other devices on the same subscription fail at the same moment. They should not, because the allowance is per device.
• Note what else is running. A cloud backup client will spend a day’s allowance in minutes without you touching anything.

If you decide to keep using the free allowance

It is a perfectly reasonable position for occasional use, and there are two things worth doing. Connect the device to My Kaspersky, because that is documented as increasing the daily figure and costs nothing. And turn the tunnel on for the things that need it rather than leaving it up, since everything the machine sends while it is connected counts, including updates and sync you did not initiate.

Every code this article covers

Confirm the fix worked

1. The application reports the tunnel as established with the location you chose.
2. Your visible IP address in a browser reflects the VPN location rather than your own.
3. The traffic counter moves normally during a few minutes of use.
4. Disconnect and reconnect once, and confirm the tunnel comes up first time without a network reset.
5. Leave it connected for longer than the previous failures lasted, so you know the drop has actually stopped.

Questions people ask about this