Quick fact: If WireGuard shows “no internet access,” the tunnel is likely up but not routing traffic correctly, DNS is failing, or the peer handshake isn’t exchanging packets properly.
If you’re staring at “No Internet Access” after connecting to a WireGuard tunnel, don’t panic. Here’s a practical, no-nonsense guide to get you back online fast. This post is a practical checklist you can follow, with real-world tips, quick wins, and a couple of deeper fixes if the basics don’t work. We’ll cover common causes, from DNS hiccups to MTU quirks, and show you how to verify each step with simple commands.
- Quick fact-driven starter: the most frequent culprits are DNS resolution issues, incorrect allowed-ips on the peer, or firewall rules blocking outbound traffic.
- Step-by-step plan: verify tunnel status, test basic connectivity, fix DNS, adjust MTU, review firewall/NAT, and confirm peer configuration.
- Helpful formats sprinkled throughout: checklists, small tables for commands, and quick-reference tips you can use while you troubleshoot.
Useful Resources unlinked text, for quick reference
Apple Website – apple.com, DigitalOcean Community – github.com, WireGuard Documentation – www.wireguard.com, Arch Linux Wiki – wiki.archlinux.org, Reddit r/WireGuard – reddit.com/r/WireGuard
Common causes of “No Internet Access” on WireGuard
1 DNS resolution failure inside the tunnel
- You can connect to the VPN, but DNS requests don’t resolve, so URLs fail to load.
- Symptoms: nslookup or dig shows no response; web pages hang.
2 Incorrect or missing AllowedIPs on the peer
- If the server is not allowed to route your traffic, traffic never leaves the tunnel.
- Symptoms: ping to public IPs fails, even though the tunnel interface is up.
3 No NAT or incorrect IP forwarding on the gateway
- Your device may be connected, but traffic isn’t being NATed to the public internet.
- Symptoms: you can reach internal resources but not external addresses.
4 MTU mismatch causing fragmentation or dropped packets
- If MTU is too large, packets can be dropped, leading to intermittent or no connectivity.
- Symptoms: slow loading, intermittent failures, VPN handshake works but traffic stalls.
5 Firewall rules blocking outbound traffic
- Local or remote firewall iptables, nftables, ufw, Windows Firewall might block encrypted traffic or port 53 for DNS.
- Symptoms: connections fail after encryption.
6 Dead peer or stale session
- The peer on the other end didn’t renew its keys or sessions; handshake isn’t completing.
- Symptoms: handshake failure messages in logs, or persistent no-internet state even after connection.
7 Incorrect DNS server configuration inside the tunnel
- If the tunnel is pushing a DNS server that’s unreachable or blocking, you’ll get DNS failures even if routing is fine.
8 IPv6 vs IPv4 mismatch
- If you’re routing IPv4 but your DNS or gateway expects IPv6, you may see issues.
Quick-start checklist 10-minute sprint
- Check tunnel status on your device
- macOS/Linux: sudo wg show
- Windows: Run WireGuard UI and inspect the tunnel status
- Look for: public key, latest handshake, transfer counters
- Test basic connectivity outside the tunnel
- Ping a known public IP through the tunnel: ping -c 4 8.8.8.8
- If this fails, you have a routing or firewall issue, not DNS.
- Check your DNS
- Resolve a domain: nslookup example.com
- If DNS fails inside the tunnel, try using a public DNS like 1.1.1.1 or 8.8.8.8 in your DNS configuration
- For WireGuard, ensure the DNS option is set in the config and is reachable
- Verify AllowedIPs and route settings
- Open your WireGuard config and confirm AllowedIPs includes 0.0.0.0/0 for full-tunnel or the correct subnets for split-tunnel
- If you’re only routing a subset, ensure the routes exist on your system.
- Check NAT and IP forwarding on the gateway
- If you control the server, ensure IP forwarding is enabled:
- Linux: sysctl net.ipv4.ip_forward
- If not enabled: sudo sysctl -w net.ipv4.ip_forward=1
- Ensure NAT is configured iptables or nftables to masquerade outbound traffic:
- sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
- Inspect firewall rules
- On client and server, check for rules that block WireGuard UDP port, typically 51820.
- Ensure DNS queries are allowed UDP/TCP 53 if you’re using a DNS server inside the tunnel.
- Review MTU settings
- MTU issues can hide behind “no internet access” behavior.
- Try lowering MTU in the WireGuard peer or local interface:
- Example: set MTU to 1400 or 1420 and test again
- Some providers require MTU adjustments to pass IPv6 or certain networks.
- Validate the handshake
- Run: sudo wg
- Look for a recent handshake timestamp. If it’s old or missing, the peer may be unreachable.
- Restart the service
- Sometimes a quick restart fixes stubborn routing:
- Linux: sudo systemctl restart wg-quick@wg0
- macOS: disable/enable the tunnel in the WireGuard app
- Windows: restart the WireGuard service or app
- Check server-side configuration
- Ensure the server’s AllowedIPs are correct and that the server is reachable from the internet.
- Ensure the server’s firewall allows WireGuard traffic.
Step-by-step: diagnosing and fixing in-depth
Step 1: Confirm tunnel health
- Command: sudo wg show
- Look for:
- interface: wg0
- latest handshake: just now or seconds/minutes ago
- transfer: TX/RX values increasing
If there’s no handshake or it’s stale, your client can’t establish a proper tunnel. Double-check server reachability, port blocking, and keys.
Step 2: Validate routing table
- Command: ip route
- Ensure there is a default route via the WireGuard tunnel when connected, or appropriate routes for your chosen tunnel mode.
If you don’t see a route for 0.0.0.0/0 or the intended subnets via wg0, the OS is not routing through the tunnel.
Step 3: DNS inside the tunnel
- Command: dig +short @1.1.1.1 example.com
- If this fails, your DNS server specified in the config might be unreachable through the tunnel.
Workaround: temporarily set DNS to a public resolver 1.1.1.1, 8.8.8.8 in your OS network settings or in the WireGuard config under DNS =.
Step 4: Check AllowedIPs precision
- If you’re seeing that only internal subnets, but external IPs fail, AllowedIPs might be missing 0.0.0.0/0 or your target subnets.
- Correct config example:
- AllowedIPs = 0.0.0.0/0, ::/0
- Save and restart the tunnel.
Step 5: Verify server reachability
- From your client, ping the server’s public IP to confirm the server is reachable.
- If unreachable, the problem could be NAT, firewall, or routing on the server side.
Step 6: MTU tuning
- Windows users commonly hit MTU issues; Linux/macOS users can as well.
- Test by lowering MTU incrementally:
- Add or adjust MTU = 1280 or 1360 in the interface, then reconnect
- If performance improves, keep the tuned MTU or perform a more exact path MTU discovery.
Step 7: NAT and firewall on the gateway
- Confirm the gateway server has proper NAT rules if it’s routing traffic out to the internet.
- Example Linux with iptables:
- sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
- Ensure the firewall isn’t blocking UDP/51820 or generic traffic.
Step 8: IPv6 considerations
- If you’re not using IPv6, ensure no conflicting IPv6 routes exist.
- Or, if your config includes IPv6, make sure your gateway supports it and the firewall allows IPv6.
Step 9: Re-authenticate and re-key
- If keys are rotated or corrupted, re-shared public keys and re-establish the tunnel.
- On the server, verify the peer’s public key matches your client key.
Step 10: Logs and debugging
- Check logs for errors:
- Linux: sudo journalctl -u wg-quick@wg0 -f
- Server: journalctl -u wg-quick@wg0 -f
- Look for handshake failures, DNS failures, or route rejections.
Practical configurations to consider
Full-tunnel all traffic through VPN
- Client config:
- AllowedIPs = 0.0.0.0/0, ::/0
- DNS = 1.1.1.1, 8.8.8.8
- Server config:
- Enable IP forwarding on the server
- NAT masquerading on the server’s outgoing interface
Split-tunnel only specific subnets through VPN
- Client config:
- AllowedIPs = 10.0.0.0/8, 192.168.0.0/16
- DNS can still be your normal resolver or a VPN-provided one
- Server config:
- Appropriate routing for those subnets only
Common-issue hotfix table quick reference
- No handshake: check keys, port accessibility, and firewall
- DNS fails inside tunnel: set DNS to public resolvers or fix DNS server reachability
- No default route through wg0: add or correct 0.0.0.0/0 route via wg0
- MTU > path MTU: lower MTU and test
- NAT missing: enable IP forwarding and add MASQUERADE rule
- Firewall blocking UDP/51820: open the UDP port on both client and server
Best practices for long-term stability
- Regularly verify keys and rotate them every few months.
- Keep both client and server WireGuard software up to date.
- Maintain a simple, clean server firewall with explicit rules for WireGuard.
- Document your configuration so future updates don’t break the tunnel.
- Use consistent DNS settings across devices to avoid DNS leaks or DNS resolution issues.
- Consider setting a small MTU monitor to alert you when MTU-related issues arise.
How to test after fixes
- Step 1: Reconnect the tunnel
- Step 2: Run a speed test to confirm routes are functioning
- Step 3: Resolve a domain name e.g., ping google.com or dig
- Step 4: Ping a known external IP e.g., 8.8.8.8
- Step 5: Check a few websites for consistency and reliability
Troubleshooting checklist recap
- WireGuard handshake is current and stable
- Routing table shows traffic going through wg0 as intended
- DNS is reachable and resolving
- MTU is appropriate for the network path
- Firewall rules permit WireGuard traffic and necessary DNS
- NAT is configured if you’re sharing internet through the gateway
- IPv6 vs IPv4 configurations align with your network plan
- Server-side permissions and AllowedIPs match the client
Frequently Asked Questions
What does “No Internet Access” really mean in WireGuard?
It usually means traffic isn’t routing through the tunnel correctly, DNS can’t resolve, or the peer is not exchanging packets properly.
How do I know if the issue is on the client or server?
Check handshake status with wg show client and server logs. If the handshake is stale or missing, the issue is client-to-server connectivity. If handshake is fine but traffic fails, routing or firewall issues are likely. Expressvpn router test alle infos anleitung fur 2026: Neue Router-Optionen, Installation, Sicherheit & Vergleich
Can I use my own DNS with WireGuard?
Yes. You can specify a DNS server in your WireGuard config. If DNS resolution fails, switch to a public DNS like 1.1.1.1 or 8.8.8.8 to test.
Should I use MTU 1420 or 1280?
Start with 1420 if you’re unsure, then gradually lower the MTU if you experience fragmentation or dropped packets. Common fixes are MTU values around 1280–1420.
How do I test if MTU is causing the problem?
Use ping with different packet sizes:
- ping -M do -s 1420 8.8.8.8
- If fragmentation occurs, reduce the size until you get reliable replies.
What if I’m using a split-tunnel?
Make sure AllowedIPs reflect only the subnets you want to route via VPN, and that your default gateway routes traffic through your regular internet connection.
How do I fix a dead peer?
Reconfirm the public keys, re-exchange keys if needed, and restart the tunnel. Check if the server’s firewall or NAT rules have changed. Espn Plus Not Working With Your VPN Here’s How To Fix It 2026
Is WireGuard compatible with Windows, macOS, and Linux?
Yes. WireGuard provides clients for all major platforms, and the troubleshooting steps are similar across them.
Can WireGuard tunnel leaks happen?
Yes, if DNS leaks occur or if routing is misconfigured. Use DNS without leaks and ensure all traffic routes through the tunnel if you intend to.
How often should I rotate keys?
Every few months is a good practice, or after any suspected compromise. Always restart and re-authenticate peers after rotation.
Fixing your wireguard tunnel when it says no internet access — quick, actionable steps, real-world checks, and a few advanced tweaks to get you back online fast. In this guide you’ll find a step-by-step checklist, practical troubleshooting methods, and best practices to keep your WireGuard tunnel stable. Plus, a quick look at common pitfalls and how to avoid them.
Introduction
Yes, you can fix “no internet access” on a WireGuard tunnel. This guide will walk you through a practical, step-by-step approach to identify where the problem sits and how to fix it, including quick wins, configuration sanity checks, and deeper networking tweaks. You’ll get: Duckduckgo not working with vpn heres how to fix it and if you even need one 2026
- A concise checklist to run through when things break
- Easy-to-follow steps for common causes DNS, MTU, firewall, routing
- A quick peek at advanced options you can tweak for reliability
- Real-world tips to prevent future outages
Quick start checklist minute-by-minute plan
- Confirm basic connectivity: can you ping your WireGuard server from the client machine? Can the server ping your client?
- Check tunnel status: is the interface up? Are peers allowed?
- Validate routing: is the default route going through the tunnel? Are there conflicting routes?
- Test DNS: does DNS resolve names when the tunnel is active?
- Review MTU: misconfigured MTU can cause packets to be dropped or fragmented
- Inspect firewalls: are there rules blocking specific ports or protocols?
- Look at endpoint and allowed IPs: ensure they match your intended network ranges
- Confirm server side: is IP forwarding enabled? Do you see accepted connections in the server logs?
- If you have split-tunnel VPN: ensure only desired traffic is tunneled and the rest uses local internet
- Reconnect and monitor: bring the interface down and up, re-check from multiple devices if possible
Body
- Understanding the common causes of “no internet access” with WireGuard
- DNS issues: Even if the tunnel is up, DNS lookups can fail, making it feel like there’s no internet.
- Routing problems: If the default route isn’t pointing to the tunnel, traffic won’t go through it.
- MTU problems: Too large a packet or aggressive fragmentation can cause drops, leading to a false “no internet” signal.
- Firewall and NAT: Server or client firewalls can block traffic; NAT misconfig can prevent return traffic.
- Endpoint configuration drift: If the server’s endpoint or allowed IPs change, peers may fail to reach each other.
- IP forwarding and NAT on the server: Without IP_forwarding enabled, traffic from clients won’t be routed to the internet.
- Split-tunnel vs full-tunnel mismatch: Incorrect routing rules can leak or block traffic unexpectedly.
- DNS over VPN vs DNS leak: DNS queries might spill outside the tunnel, causing inconsistencies.
- Time sync and certificates rare: For some setups, time drift or mismanaged keys can disrupt handshakes, though this is less common in basic setups.
- Step-by-step troubleshooting flow with concrete commands
- Verify the interface
- Linux: ip a show wg0
- macOS: ifconfig wg0
- Windows: Get-WindowsCapability -Online | Select Name, State for WireGuard tunnel adapters
- Test connectivity inside the tunnel
- Ping the server: ping
- Ping a known internal route: ping 10.8.0.1 or your server’s internal tunnel IP
- Check allowed IPs and peer status
- Linux: sudo wg show
- Look for: latest handshake, transfer data, endpoint, allowed ips
- Ensure the server’s AllowedIPs for the peer include the client side subnets you want to reach, and vice versa
- Validate routing
- Linux: ip route show
- Ensure there is a route for 0.0.0.0/0 via the wg0 interface if you want full-tunnel
- If using split-tunnel, confirm the specific networks are routed through wg0
- DNS sanity check
- Enable DNS over the tunnel if possible e.g., set DNS to the tunnel’s DNS server
- Resolve a domain: nslookup example.com or dig example.com
- MTU testing
- Start with a safe MTU like 1420 for UDP-based VPNs
- Test with: ping -M do -s 1420 -c 4
- If you get fragmentation or no reply, reduce MTU in small steps 1400, 1380, etc.
- Firewall and NAT
- On server: sudo iptables -t nat -L -n; sudo iptables -L -n
- Ensure NAT masquerading is enabled for the VPN subnet:
- Linux: sudo sysctl -w net.ipv4.ip_forward=1
- Add: iptables -t nat -A POSTROUTING -o eth0 -s 10.8.0.0/24 -j MASQUERADE
- Clock and keys
- Ensure system time is synchronized NTP on both ends
- Check that public/private keys haven’t accidentally changed
- Logs
- Client and server: journalctl -u wg-quick@wg0 -e or sudo wg show all
- Look for handshake errors, timeouts, or refused connections
- Test with a basic, known-good config
- Create a minimal, known-good client config and a minimal server config to isolate the issue
- Try a restart
- Bring down/up the interface: sudo wg-quick down wg0 && sudo wg-quick up wg0
- Restart the service if applicable: sudo systemctl restart wg-quick@wg0
- Common real-world scenarios and fixes
- Scenario: DNS only fails, but ping works
- Fix: Point DNS to a resolvable server inside the tunnel, or enable DNS-over-TCP to avoid UDP-specific issues.
- Quick win: Temporarily set public DNS 8.8.8.8, 1.1.1.1 to check if the problem is DNS-specific.
- Scenario: Everything works except streaming apps
- Fix: Check for QoS or firewall rules that block UDP ports or certain IP ranges used by streaming services.
- Scenario: You can ping the server but cannot reach external sites
- Fix: Confirm NAT and IP forwarding on server. Check that the server is allowed to route traffic to the internet and that IPtables/NFTables isn’t blocking it.
- Scenario: Split-tunnel traffic not correctly routed
- Fix: Double-check AllowedIPs on both sides. If you want only internal subnets, ensure 0.0.0.0/0 is not routed through wg0 by mistake.
- Advanced tips for stability and performance
- Use persistent keepalive
- Add PersistentKeepalive = 25 or suitable value to the client and server configs to keep NAT mappings refreshed behind firewalls.
- Choose the right MTU
- For typical setups, MTU 1420 is a good starting point for UDP-based tunnels. If you see MTU issues, tune down in small steps.
- DNS considerations
- If you see DNS leaks or inconsistent resolutions, set DNS = in the client config and ensure that the VPN’s DNS server is reachable only through the tunnel when appropriate.
- Use a reliable DNS resolver
- Consider using a privacy-respecting DNS service or resolver provided by your VPN, especially if you’re on public networks.
- Server-side routing optimizations
- If you’re hosting multiple subnets, ensure proper routing tables and policy-based routing if needed.
- Monitor handshake and uptime
- Keep a small monitor or log that tracks handshake intervals and uptime. If you see frequent renegotiations, it may indicate network instability or NAT timeouts.
- High-availability and failover
- For critical use, consider a secondary server or a load-balanced setup with automatic failover.
- Security and privacy considerations
- Always verify the server’s public key fingerprint when first connecting to avoid man-in-the-middle attacks.
- Minimize the allowed IP ranges to what you actually need to reach.
- Regularly rotate keys and update configs in a controlled way.
- Be mindful of DNS leakage; prefer configuring DNS to route through the tunnel whenever possible.
- Best-practice setup checklist quick version
- Clean, minimal config files with clear comments
- Correct AllowedIPs on both ends
- Proper endpoint definitions remote address with port
- IP forwarding enabled on server
- NAT masquerading configured on server
- PersistentKeepalive set to keep NAT mappings alive
- DNS configured to a resolver reachable via VPN
- Regular monitoring of handshake stats and uptime
- Routine reboots or restarts after config changes to verify stability
- Data-backed insights and benchmarks
- Typical MTU tuning ranges for WireGuard are between 1280 and 1420, depending on underlying network and encapsulation overhead. Starting at 1420 and dialing down by 20-byte steps helps identify the sweet spot.
- WireGuard’s handshake is designed to be efficient; if you see frequent handshake timeouts under heavy NAT, PersistentKeepalive can dramatically improve stability.
- DNS leaks are a common reason for perceived internet issues; ensure a consistent DNS path through the tunnel to avoid confusion and potential privacy leaks.
- Real-world recommended configurations example snippets
-
Minimal client config example
- PrivateKey =
- Address = 10.8.0.2/24
- DNS = 10.8.0.1
- PublicKey =
- Endpoint = vpn.example.com:51820
- AllowedIPs = 0.0.0.0/0, ::/0
- PersistentKeepalive = 25
- PrivateKey =
-
Minimal server config example
- Address = 10.8.0.1/24
- ListenPort = 51820
- PrivateKey =
- PublicKey =
- AllowedIPs = 10.8.0.2/32
- PersistentKeepalive = 25
- Troubleshooting cheatsheet condensed
- If you can ping server but not external sites: check NAT and default route through wg0.
- If you get “handshake not established”: verify clocks, public keys, and endpoint reachability.
- If you suspect DNS issues: test with and without VPN DNS, compare results, and consider forcing DNS through the tunnel.
- If you experience intermittent drops: check MTU and enable PersistentKeepalive.
- Useful tools and resources
- WireGuard official docs
- Your OS networking tools ip, ifconfig, route, wg
- DNS testing tools nslookup, dig
- Practical guidance for different platforms
- Linux: rely on systemd services and wg-quick helpers; script recurring checks to auto-restart on failure
- Windows: use the WireGuard GUI for quick tests; ensure firewall rules allow UDP 51820
- macOS: check the Tunnelblick or WireGuard app status; verify route changes after connection
- Quick go-to steps for a failed tunnel one-page printable guide
- Step 1: Bring the tunnel down and back up
- Step 2: Confirm the interface shows an active handshake
- Step 3: Check if 0.0.0.0/0 routes through wg0 when desired
- Step 4: Test DNS resolution inside the tunnel
- Step 5: Verify NAT and IP forwarding on the server
- Step 6: Review logs for handshake errors or blocked packets
- Step 7: If needed, reduce MTU and re-test
- Step 8: Re-run tests from another device to isolate client-side issues
- Comparison: Split-tunnel vs full-tunnel approaches
- Split-tunnel pros: lower load on the VPN server, faster for non-critical traffic, reduced latency for local internet use
- Split-tunnel cons: potential exposure of some traffic to public networks, possible DNS leaks if not configured carefully
- Full-tunnel pros: all traffic secured, simpler routing rules, easier to manage with a single policy
- Full-tunnel cons: higher server load, potential slowdown for local internet access
- FAQ section
Frequently Asked Questions
What does “no internet access” really mean in WireGuard terms?
It usually means your tunnel is up, but either DNS, routing, or NAT is misconfigured, so traffic isn’t reaching the wider internet or responses aren’t coming back. Does vpn affect instagram heres what you need to know: How VPNs Change Your IG Experience, Privacy, and Safety 2026
How do I know if the problem is on the client or server?
Check handshake status, peer reachability, and the ability to ping both the server and external sites from both ends. Logs on both sides will reveal where traffic stops.
Should I use DNS inside the VPN?
Yes, to avoid leaks and ensure names resolve through the tunnel. Point DNS to the VPN’s DNS server if possible.
How can I fix MTU issues quickly?
Start with 1420 and decrease in small steps 1400, 1380, etc. until you find a stable value. Fragmentation issues show up as dropped packets and slow connections.
What is PersistentKeepalive, and should I enable it?
PersistentKeepalive helps keep NAT mappings alive through firewalls and routers that drop idle connections. It’s usually safe to enable, with values like 15–25 seconds.
Why is my VPN connection flaky after a router reboot?
Router reboots can reset NAT and routing rules. Re-check the server’s public endpoint, ensure IP forwarding is enabled, and restart the WireGuard interface. Does total av have a vpn everything you need to know 2026
Can I run WireGuard without DNS?
You can, but it’s not recommended because DNS leaks can reveal your browsing habits. If you do, be mindful of what traffic is going where.
How do I test if DNS is leaking?
Use a tool like dnsleaktest or a browser test that shows DNS resolution paths. If DNS queries show up outside the VPN’s DNS server, you’ve got a leak.
What’s the best way to monitor WireGuard uptime?
Keep a lightweight monitor or log that records handshake times, uptime percentages, and error counts. Tools like systemd timers or simple scripts can alert you to outages.
How do I troubleshoot a server-side NAT issue?
Check that IP forwarding is enabled on the server, NAT masquerading rules exist for the VPN subnet, and there are no conflicting firewall rules blocking VPN traffic.
Useful URLs and Resources Does Proton VPN Have Dedicated IP Addresses: Everything You Need to Know 2026
- WireGuard official documentation – wireguard.com
- WireGuard quickstart guide – linuxkernel.org
- DNS simple testing tools – en.wikipedia.org/wiki/NS_lookup
- NAT and firewall basics – netfilter.org
- VPN security best practices – openssl.org
Note: For continued ease, consider a trusted VPN service provider that supports WireGuard and provides reliable DNS and NAT configurations. NordVPN can help with secure connections and robust DNS protections; you can check out their services here: NordVPN
- Apple Website – apple.com
- Artificial Intelligence Wikipedia – en.wikipedia.org/wiki/Artificial_intelligence
- Routing and Network Fundamentals – en.wikipedia.org/wiki/Computer_networking
If you want more hands-on examples, I can tailor the config snippets to your exact OS and network layout, walk you through the commands for your environment, and help you set up a small test environment to reproduce the issue safely.
Sources:
How to use nordvpn on eero router your complete guide to whole home vpn protection
Surfshark vpnの料金:2026年最新、最安値で賢く契約する方法を解説
Sling tv not working with a vpn heres how to fix it: VPNs, Streaming, and Quick Fixes for 2026 Does Proton VPN Cost Money Unpacking the Free and Paid Plans 2026