Sign inMonitor a domain
VPN

Is my VPN working? A 60-second checklist

A VPN app saying “connected” proves the tunnel is up. These four checks prove your traffic actually uses it.

By peekip editorialLast checked 5 Oct 20262 min read4 sources
On this page
Short answer

With the VPN on, check four things: your public IPv4 address and country changed to the VPN’s; IPv6 either goes through the VPN or is absent; the browser’s WebRTC doesn’t reveal your home address; and your DNS lookups are answered by the VPN’s resolver, not your ISP’s. If all four pass, the tunnel is carrying your traffic. If one fails, the fix is usually one setting.

Before you start

Note your normal public address with the VPN off. You need it to recognise a leak. Then connect the VPN, wait a few seconds and run the checks below.

The four checks

1 · ExitIPv4 changedYour public address and its country now belong to the VPN provider.
2 · IPv6No home IPv6IPv6 is tunnelled too, or not available at all while connected.
3 · WebRTCNo home addressThe browser doesn’t hand your real public address to web pages.
4 · DNSVPN resolverLookups are answered by the VPN’s DNS, not your ISP’s.

1. Exit address

The address sites see should be the VPN’s, in the country you picked. If it is still your ISP’s address, the tunnel isn’t carrying web traffic: check split-tunnelling settings and whether the browser is excluded.

2. IPv6

If your ISP gives you IPv6 and the VPN only tunnels IPv4, IPv6 traffic can go around the tunnel. A good result is either a VPN-owned IPv6 address or none. Your ISP’s IPv6 prefix while connected is a leak.

3. WebRTC

Browsers use WebRTC for calls, and it can gather addresses from your network interfaces. The IETF’s requirements describe four handling modes, from “enumerate all addresses” to forcing traffic through a proxy, with a default that uses the normal route plus its local address.[1] The same document singles out VPN users, noting that “for some users, the purpose of using a VPN is for anonymity”. The leak to look for is your home public address appearing next to the VPN address; private addresses like 192.168.x.x reveal much less.

4. DNS

Every site visit starts with a DNS lookup. If those lookups still go to your ISP’s resolver, your ISP can see which sites you visit even though the traffic is tunnelled. The fix is usually one setting on the device or browser:

  • Windows: Microsoft documents setting DNS servers per network and choosing encrypted DNS (“Encrypted only” or “Encrypted preferred”) in the network’s DNS settings.[2]
  • Firefox has its own resolver setting; in “TRR first” mode it uses DNS over HTTPS and falls back to the system resolver if a lookup fails.[3]
  • Android has a Private DNS setting under Network & internet with Off, Automatic and a named provider.[4]

A browser’s own encrypted DNS can bypass the VPN’s resolver even when the VPN works. That isn’t a leak to your ISP, but it does mean a third resolver sees your lookups.

Run it on yours

Run the four checks

The VPN check runs these in your browser and says which pass. Nothing is stored unless you share it.

Run the VPN check

What a pass does not prove

Four passes mean your traffic goes through the VPN. They don’t say whether the VPN provider logs, whether a site will accept the VPN, or anything about trackers in your browser. That part is about who you trust, not about leaks.

Sources

  1. RFC 8828: WebRTC IP Address Handling Requirements (Jan 2021) · IETF / RFC EditorChecked 5 Oct 2026
  2. Secure DNS Client over HTTPS (DoH) · Microsoft LearnChecked 5 Oct 2026
  3. Trusted Recursive Resolver (network.trr.mode) · Mozilla WikiChecked 5 Oct 2026
  4. Manage advanced network settings on your Android phone (Private DNS) · Google Android HelpChecked 5 Oct 2026