Guide
How to check your VPN is working
Six checks that tell you whether the tunnel is carrying your traffic, in the order that finds the common failures first. None of them needs software beyond a browser, and each one proves one thing and nothing else. Written against the clients of late 2026.
What this settles
A client that says connected is reporting its own state, not where your traffic is going. The six checks below answer the second question. Run them once after installing, once after every client or system update, and once on any network you have not used before. Together they take a few minutes; the first three take one.
Connect first, to the exit you normally use. Then work down the list in order: each check assumes the one before it passed, and the common failures are at the top.
1. Your address changed
- Open any “what is my IP” page and read the address and the country it reports. The country has to match the exit you chose; the address has to be one you do not recognise as your own.
- Disconnect and reload the same page. The address should change back to your own. If it does not, the page is cached or a second tunnel is in the way, and the first result proved nothing.
- Reconnect and reload once more. Three readings, two of them different from the middle one, is the whole test. A single reading taken while connected is not.
This proves the exit is in front of your browser. It says nothing about name lookups, other applications, or what happens when the tunnel drops, which is what the rest of the page is for.
2. Lookups are inside the tunnel
- Run a DNS leak test — any page that offers an extended test, which sends many lookups rather than one — and read the list of resolvers it reports, with their owners.
- Every resolver has to belong to the VPN provider or sit in the exit's country. One entry belonging to your internet provider, or located in your own country, is a failed test regardless of what the others say.
- If it fails, set the client's DNS to the provider's own resolver, or turn on its leak protection, reconnect and repeat. The setting is described on every platform guide; what the leak means is on the DNS leaks page.
3. The browser is not announcing your address
Browsers carry a protocol for calls and video that can disclose your local and public addresses to a page directly, around the tunnel. It is a browser setting rather than a client one, so a perfectly configured client passes every other test and fails this one.
- Run a WebRTC leak test in each browser you use, while connected. Private windows and profiles have their own settings, so test the one you actually browse in.
- The public address it reports has to be the exit's, or none at all. A local address of the form the router hands out is normal and harmless; your own public address is the failure.
- If it fails, look for the WebRTC setting in the browser itself or in the provider's browser extension, where most clients put it, and repeat the test after changing it.
4. IPv6 is not going around it
Most networks now hand out two kinds of address, and a client that tunnels the older kind and ignores the newer one leaks to every site that answers over both — which is most large ones. The address check above often misses it, because the page you used reports whichever address it was reached on.
- Open an IPv6 test page while connected. The correct results are “no IPv6 connectivity” or an IPv6 address that belongs to the exit. An IPv6 address located in your own country is a leak.
- If it fails, look in the client for an IPv6 setting: block is the safe choice, route is the better one where offered. A client with neither needs IPv6 disabled on the adapter at the operating-system level.
- Repeat the first check afterwards: disabling IPv6 changes which address the test page reaches you on, and the earlier pass needs confirming under the new conditions.
5. A dropped tunnel fails closed
Everything above describes the tunnel while it is up. The check that matters on a bad network is what happens when it is not, and it is a procedure of its own: how to test a VPN kill switch. Do it once on any device that leaves the house; the short version is that a running download has to stop dead when the tunnel is killed without the client being asked. Why it matters is on the kill switch page.
6. Something other than the browser
Every check so far ran in a browser, and a browser can be routed differently from the rest of the machine: a proxy extension, a browser-only VPN or a split-tunnelling rule all make the browser pass while another application leaks, or the reverse.
- Pick one application that shows its own connection address — a torrent client's own address check, a mail client's connection log, a game's network panel — or run the address check from a second browser you did not configure.
- Its address has to be the exit's, the same as the first check reported. A different one means the tunnel is not system-wide, and the setting responsible is either the browser extension or a split-tunnelling rule.
What a pass means
What those checks prove
+Your traffic leaves through the exit server, in the country you selected, from every application and not just one
+The network you are sitting on sees neither the sites you reach nor the lookups that find them
+Neither the browser nor the newer address family is carrying your address around the tunnel
What they do not
−They say nothing about what the provider keeps — that is a documents question, answered on the retention pages
−They do not make you anonymous: your browser, your logins and your habits are unchanged, see what a VPN does not protect
−A pass today is a statement about today's client; the next update can reset any setting on this page
When a test fails
The address page shows my own country while the client says connected
The client is running and the traffic is not going through it. Disconnect, quit the client fully rather than closing its window, start it again and reconnect before anything else. If the result repeats, a second VPN, a proxy setting in the browser or a security product with its own network filter is usually taking the traffic first.
Check the browser's own proxy and extension settings last: an extension that routes the browser through its own proxy wins over the system tunnel, and the address page sees the extension's exit, not yours.
The DNS test lists my internet provider's resolvers
Lookups are leaving outside the tunnel. In the client, turn on DNS leak protection or set the DNS to the provider's own resolver, reconnect and run the test again. If the resolvers still belong to your internet provider, the operating system is keeping a resolver of its own on another interface, which the platform guides cover for each system.
One resolver in the list is enough to fail: a single leaked lookup names the site you visited.
The IPv6 test shows an address when the client is connected
The client tunnels IPv4 and lets IPv6 past it, and every site that answers over both sees your real address. Look for an IPv6 setting in the client and set it to block or to route; if the client has neither, disable IPv6 on the network adapter the operating system uses. Then run the test again and expect no IPv6 address at all, or one that belongs to the exit.
Every test passes on my home network and one fails on another
The second network is doing something to the traffic. A hotel or office network that intercepts DNS, strips IPv6 or breaks long-lived connections produces exactly one failing test, and it is the network rather than the client. The result is a fact about that network to carry with you, and the kill switch is what keeps a failing tunnel there from becoming an open one.
Everything passed yesterday and the DNS test fails today
Something changed, and the two usual candidates are a client update that reset a setting and a system update that added a resolver. Open the client's settings and read them rather than trusting what they were; the DNS and kill switch entries are the two most often reset. A check is a statement about the moment it ran, which is why this page is worth a repeat after every update.
Same steps, other machines
The rest of the platforms
Every platform has a guide of its own rather than a tab on this one. The steps diverge as soon as the installer opens, and a page that answers three platforms at once answers none of them properly.