How to Check If Your VPN Is Working (IP, DNS and WebRTC Leaks)

A VPN icon in the corner does not prove that your traffic is protected. Leaks through WebRTC, DNS or IPv6 can reveal your real address while the VPN says "connected". The check below takes about five minutes, needs nothing but a browser, and tells you exactly which part leaks and how to fix it.

By Ali Ahmad Updated 5 min read

The short answer

  • Compare your IP with the VPN off and on using what is my IP. With it on, the address, network owner and location should all be the VPN's.
  • Run the WebRTC leak test with the VPN on. A different public IP through WebRTC is a leak, usually your real one.
  • Check IPv6: if the page shows your provider's IPv6 address with the VPN on, IPv6 bypasses the tunnel.
  • Fix leaks with the VPN's kill switch and leak protection, no split tunnelling for the browser, and IPv6 blocked or tunnelled. Test again after each change.

Try it in your browser

What Is My IPYour public IPv4 and IPv6 address, network owner, rough location and a VPN check.

What a VPN should hide, and how it leaks

A VPN sends your traffic through an encrypted tunnel to the VPN company's server, so websites see that server's IP address instead of yours, and your internet provider sees only encrypted data going to the VPN. Three things commonly slip past the tunnel:

  • WebRTC leaks: the browser's video-call technology asks a STUN server which address it sees, sometimes outside the tunnel, and any web page can read the answer.
  • DNS leaks: your device keeps asking your provider's DNS server for website addresses, so the provider still sees every site name you visit.
  • IPv6 leaks: the VPN tunnels only IPv4, while your connection also has IPv6, so IPv6 traffic goes out directly with your real address.

There is also the simplest failure: the VPN is connected but the browser is excluded by split tunnelling, or the tunnel dropped and there is no kill switch to stop traffic.

Step 1: Note your real IP with the VPN off

Turn the VPN off and open what is my IP. Write down (or screenshot with Hide off, for yourself only) four things: the IPv4 address, the IPv6 address if there is one, the network owner (your provider), and the location. This is your baseline: none of it should appear once the VPN is on.

Step 2: Turn the VPN on and compare

Connect the VPN, preferably to a server in another country so the difference is obvious, and reload the page. What you should see:

  • A different IPv4 address.
  • A network owner that is the VPN company or a hosting provider it rents servers from (names such as M247, Datacamp, Leaseweb or the VPN brand itself). The page's VPN check box will usually say "Looks like a VPN, proxy or data centre".
  • A location matching the VPN server.
  • Either no IPv6, or an IPv6 address that also belongs to the VPN.

If your provider's name or your real IPv4 still shows, the browser is not going through the VPN at all. Reconnect, try another server, and check split tunnelling (step 5). If only the IPv6 line still shows your provider's address, you have an IPv6 leak.

Step 3: Test for a WebRTC leak

With the VPN still on, open the WebRTC leak test. It compares the public IP that STUN servers see through WebRTC with the IP your normal browsing uses.

  • No leak: WebRTC shows only the VPN's address, or none.
  • Leak found: WebRTC shows a different public IP. Compare it with your baseline: if it is your real IP, any website can read it without asking.
  • A local address such as 192.168.1.23, or a random name ending in .local, is not a leak of your public IP. Current browsers hide local IPs by default.

WebRTC leaks are most common with browser-only VPN extensions, which proxy web pages but not the UDP traffic WebRTC uses. The standard for how browsers should handle this is RFC 8828; Chrome, Edge, Firefox and Safari now follow its safer modes by default, but a VPN setup can still bypass them.

Step 4: Check for a DNS leak

A DNS leak means that the VPN hides your traffic, but the questions "where is example.com?" still go to your internet provider. The surest check is in the VPN app itself: most have a "DNS leak protection" switch and show which DNS server they use. You can also check from the browser:

  • Open 1.1.1.1/help (Cloudflare's diagnostic page). It shows whether you are using Cloudflare's DNS and which data centre answers. If you set Cloudflare DNS but the VPN is supposed to use its own, it should say No.
  • On a Windows PC, run nslookup example.com in Command Prompt. The "Server" line shows the resolver your system is using. With the VPN on, it should be the VPN's address, not your router (192.168.x.x) or your provider.

The DNS lookup tool itself talks to Cloudflare or Google over HTTPS and does not use your system's DNS, so it is the right tool for checking records but not for spotting a DNS leak.

Step 5: Fix what leaks

  • Turn on the kill switch (sometimes called Network Lock). It blocks all internet traffic if the tunnel drops, so nothing goes out unprotected.
  • Turn on DNS leak protection and, if offered, the VPN's own DNS servers. On Android, set Private DNS to Automatic or Off while using a VPN that provides its own DNS.
  • Check split tunnelling. Make sure your browser is not on the list of apps that bypass the VPN.
  • Handle IPv6. Turn on the VPN's IPv6 leak protection, or choose a VPN that tunnels IPv6. As a last resort, turn off IPv6 in the network adapter settings.
  • Block WebRTC leaks. Use the desktop app rather than only a browser extension, turn on the extension's WebRTC protection, or in Firefox set media.peerconnection.enabled to false in about:config (this turns off browser video calls). The WebRTC leak test page lists the setting for each browser.
  • Update the VPN app and switch protocol (WireGuard or OpenVPN) if a leak keeps returning.

After every change, repeat steps 2 to 4. A VPN that still leaks with all protections on is not doing its job.

What a VPN does not hide

Even a leak-free VPN hides only your IP address and your traffic from the local network and provider. Websites still recognise you when you log in, cookies and browser fingerprints still work, and your browser and device details are visible to every site. A VPN also slows your connection a little: run the internet speed test with it on and off to see the cost.

Frequently asked questions

How do I know if my VPN is on?
Open what is my IP with the VPN connected. If the address and location are the VPN server's and the network owner is not your provider, it is working for your browser.
What is a VPN leak?
Any traffic that reveals your real IP address or the sites you visit despite the VPN: most often through WebRTC, DNS requests or IPv6.
Can websites see my real IP with a VPN?
Not if the VPN works and nothing leaks. With a WebRTC or IPv6 leak, a website can read your real address without asking.
Do free VPNs leak more?
Leak tests often find more problems with free VPNs and browser extensions, which may skip WebRTC, DNS or IPv6 protection. Test any VPN yourself rather than relying on claims.
Is a WebRTC leak dangerous?
It reveals your real IP to any site that checks, which defeats the purpose of the VPN for privacy. It does not give access to your device.
Should I check every time I connect?
Check after installing a VPN, after updates, and when you change networks or settings. A quick look at what is my IP each time you connect takes seconds.

Sources

  1. RFC 8828: WebRTC IP Address Handling Requirements