How to Check a VPN Connection: IP, DNS, IPv6, and WebRTC
Use separate checks for routing and browser behavior, and understand why one changed IP address is not a complete privacy test.
An IP-address website can tell you something about that browser request. It cannot establish that every app, protocol, and network transition uses the intended route.
Record the starting point
With ordinary non-sensitive browsing, note the network, device, app version, and protocol. Record the normal public connection address where appropriate, then connect the VPN and compare. Do not post your real address or an unredacted diagnostic screenshot publicly.
Check more than IPv4
A network may use IPv4, IPv6, or both. Providers can route IPv6, block it, or support it only in particular apps. An IPv4 result alone does not show how IPv6 behaves.
DNS determines how names are resolved. A resolver result needs context: a provider’s resolver address can differ from the exit address, and browser secure-DNS settings can change the route. Do not label every unfamiliar resolver a leak without checking the setup.
Treat browser checks separately
WebRTC-related results concern browser behavior and exposed connection information. Private local addresses or anonymized candidates do not automatically establish a public-IP leak. Compare the result with the provider’s current guidance and the actual network configuration.
Repeat after a change
Try a network transition, sleep and wake, and reconnection while using ordinary test traffic. Check any app or website deliberately excluded through split tunneling separately.
If something looks wrong, save the conditions and ask the provider to interpret a redacted result. We have not published our own leak-test findings; these steps explain what a meaningful check needs to distinguish.