Check your VPN for leaks
A VPN app can say “Connected” and still give your real address away, through a browser feature, through IPv6, through DNS, or in the seconds when the connection drops. In this lesson you’ll test each of those on your own VPN, one at a time, and fix any that leak.
In this lesson
- Test your VPN for IP, WebRTC and IPv6 leaks
- Check by hand whether your DNS lookups go around the VPN
- Test the kill switch, and fix whatever leaks
You’ll need: a VPN app, and the “before” notes from Lesson 5, especially your real provider’s name. Part 2 needs a computer.
The four ways a VPN leaks
- WebRTC. Browsers use WebRTC for video calls and file transfers, and to set them up quickly it can share your network addresses with a page directly, sometimes including your real one.
- IPv6. Some VPNs only tunnel the older IPv4 traffic. If your connection also has IPv6 and the VPN ignores it, IPv6 traffic goes out the normal way, with your real address.
- DNS. If your lookups keep going to your provider’s DNS server instead of through the tunnel, your provider still gets a list of every site, even though your traffic is hidden.
- Drops. When the VPN reconnects or changes server, there can be a few seconds when traffic goes out unprotected. A kill switch blocks the internet during that gap.
Try it yourself · part 1
Run the leak test
- Connect your VPN, then open our VPN leak test and click Run Leak Test. It takes about ten seconds.
- Check the three results:
- Your visible IP address should belong to the VPN, with the label VPN / datacentre. If it shows your own provider, the VPN isn’t carrying your traffic at all.
- WebRTC leak should say No leak. Exposed means a page can read an address the VPN is meant to hide.
- IPv6 exposure should show no address of yours. If your real IPv6 address appears while the VPN is on, it’s going around the tunnel.
- The summary at the top tells you the overall result: No leaks detected, Your VPN is leaking, or You don’t appear to be using a VPN.
- To double-check IPv6, open the IPv6 test with the VPN on. Your home connection’s IPv6 address shouldn’t be the one it finds.
Why the leak test doesn’t check DNS
You’ll notice the leak test marks DNS as not tested here. A real DNS leak test needs a DNS server of its own that records which resolvers ask for some made-up names, and a web page can’t do that from inside your browser. Any tool that gives a DNS verdict from the browser alone is guessing. So you’ll check it the way you learned in Lesson 2.
Try it yourself · part 2
Check your DNS by hand
- With the VPN on, run the lookup from Lesson 2 (
nslookup whoami.akamai.neton Windows,dig +short whoami.akamai.neton a Mac or Linux). - Paste the address at the bottom of the answer into the ASN lookup.
- Read whose network it is:
- The VPN company, or a public DNS service it uses: no leak. Your lookups are going through the tunnel.
- Your own internet provider, the name from your Lesson 5 notes: that’s a DNS leak. Your provider can still see every site name.
- This checks your system DNS. If you turned on secure DNS in your browser in Lesson 2, the browser’s own lookups go to the DNS service you chose instead, so they don’t reach your provider either way.
Try it yourself · part 3
Test the kill switch
- Open your VPN app’s settings and find the kill switch. Apps call it different things: Kill switch, Network lock, Always-on VPN or Block connections without VPN. Turn it on.
- On phones there’s a system version too. On Android, search Settings for VPN, tap the gear next to your VPN, and turn on Always-on VPN and Block connections without VPN.
- Open the IP checker. In the VPN app, switch to a different server, and while it reconnects, keep reloading the checker.
- With a working kill switch, the page fails to load until the new connection is up, then shows the new server. What you must never see is your own provider’s name, even for one reload.
Fixing a leak
| What leaked | What to do |
|---|---|
| Your IP: the checker shows your own provider | The VPN isn’t connected, or a split-tunnelling setting is leaving the browser out. Reconnect, and check which apps the VPN covers. |
| WebRTC | Turn on the VPN’s WebRTC protection if it has one. Firefox lets you switch WebRTC off entirely (media.peerconnection.enabled in about:config); in Chrome and Edge, an extension from your VPN provider usually handles it. |
| IPv6 | Turn on the VPN’s IPv6 leak protection, or choose a VPN that supports IPv6 properly. Switching IPv6 off on your device also works. |
| DNS | Turn on the VPN’s DNS leak protection, or “use VPN DNS”. If the app has no such option, that’s a reason to change VPN. |
| Kill switch | Turn it on, and use the system “Always-on” option on your phone. If you still see your provider during a reconnect, the app’s kill switch isn’t working. |
After any fix, run all three parts again. A VPN that fails one of them repeatedly, even with every setting on, isn’t doing its job.
Key takeaways
- “Connected” in the app doesn’t prove you’re protected; test it.
- WebRTC and IPv6 leaks show up in the VPN leak test in about ten seconds.
- DNS leaks need a test with its own DNS server, or the manual whoami.akamai.net check.
- A kill switch stops traffic leaking while the VPN reconnects; test it by switching servers.
- Most leaks are fixed by a setting in the VPN app. If it has none, consider another VPN.
Check yourself
Three questions. Pick one answer each and you’ll see why.
1. What is a WebRTC leak?
2. With your VPN on, whoami.akamai.net comes back with an address from your own internet provider. What does that mean?
3. What does a kill switch do?
Want each leak explained in depth? Read What Is a DNS Leak?, WebRTC Leaks: What They Are and How to Fix Them and What Is a VPN Kill Switch?
This lesson is part of the free course Privacy and VPNs, licensed under CC BY-NC-SA 4.0: you may share and adapt it for non-commercial use, with credit to ExamineIP and a link to the original.