Start with the underlying network
Confirm ordinary connectivity on the new network and complete a legitimate captive portal if one is required. The tunnel cannot fix a network that does not provide usable transport.
Look for a new handshake
Check that the gateway is still reachable at the configured endpoint and port. Router rules, UDP restrictions, sleeping hosts and mismatched keys can all prevent the next handshake.
Verify routing after recovery
After the tunnel re-establishes, check the expected external address, DNS and intended IPv6 behavior. Do not infer a leak-prevention guarantee from the interface remaining visible.