How to tell if your VPN is working: 5 tests in 5 minutes

Your VPN is working if four things are true while it is connected: sites see the VPN server's IP address instead of yours, your DNS lookups go to the VPN's servers and not your internet provider's, no IPv6 or WebRTC request shows your real address, and traffic stops when the tunnel drops. The "Connected" label proves none of that.

Here are five tests that do. They take about five minutes and cost nothing.

First, is the VPN on at all?

Each system has its own indicator, separate from the VPN app:

iPhone and iPad. A VPN icon appears in the status bar or in Control Center. Apple lists it among the status icons: "iPhone is connected to a network using VPN."
Android. A key icon sits in the status bar while a VPN is active. Under Settings, Network and internet, VPN, you can also turn on always-on VPN for the app.
Mac. System Settings, VPN shows the connection, and you can add a VPN status item to the menu bar.
Windows. Settings, Network and internet, VPN shows "Connected" under the profile.

An icon tells you a tunnel exists. It does not tell you that everything is going through it. That is what the tests are for.

Before you test: write down your real details

Turn the VPN off. Open https://www.cloudflare.com/cdn-cgi/trace in your browser. It prints a few lines of text. Note two:

ip= is your real public IP address.
loc= is your country.

Also note the name of your internet provider. You will need to recognize it in test 2.

Now turn the VPN on and go through the tests in order.

Test 1: has your IP address changed?

Reload the same page.

Pass: ip= shows a different address and loc= matches the server location you picked.
Fail: the address is the one you wrote down. The VPN is not carrying your traffic.

If this fails, nothing else matters yet. Disconnect, reconnect, and try a different server. If the address still does not change, check that the app is not set to exclude your browser through split tunneling.

Test 2: are your DNS lookups leaking?

Every site visit starts with a DNS lookup that turns a name into an address. If those lookups go to your internet provider while everything else goes through the VPN, your provider still gets the list of sites you visit. That is a DNS leak, and pages load normally while it happens.

Open dnsleaktest.com and run the extended test.
Read the list of servers it found, and the provider name beside each.

Pass: every server listed belongs to your VPN provider, or to a DNS service the VPN is known to use. Your internet provider's name is nowhere on the list.
Fail: your internet provider's name appears, even once.

Test 3: is IPv6 going around the tunnel?

Many home and mobile connections have two addresses: an older IPv4 one and a newer IPv6 one. A VPN that only handles IPv4 leaves the IPv6 path open, and sites that support IPv6 will see your real IPv6 address.

Open test-ipv6.com with the VPN on.

Pass: it reports no IPv6 address, or an IPv6 address that belongs to the VPN.
Fail: it shows an IPv6 address belonging to your internet provider.

Test 4: is your browser giving you away through WebRTC?

WebRTC is the browser technology behind video calls in a tab. To set up a call it collects the addresses your device can be reached on, and a web page can ask for them. The IETF's RFC 8828 describes the result: with some VPN setups, "WebRTC can discover not only the public address for the VPN, but also the ISP public address over which the VPN is running."

Open browserleaks.com/webrtc with the VPN on.

Pass: the public IP address shown is the VPN's, the same one as in test 1.
Fail: the address you wrote down at the start appears anywhere on the page.

This one is a browser test. Run it in each browser you use.

Test 5: does the kill switch hold when the VPN drops?

VPN connections drop when you change networks, when a laptop wakes, when Wi-Fi hiccups. A kill switch blocks all traffic until the tunnel is back. Without one, your device quietly falls back to the normal connection for a few seconds, which is long enough for apps to reconnect in the open.

Make sure the kill switch is turned on in the VPN app.
With the VPN connected, open the Cloudflare trace page from test 1 and confirm it shows the VPN's address.
Force a drop: turn Wi-Fi off and on, or switch from Wi-Fi to mobile data.
Reload the page immediately, several times, while the VPN is reconnecting.

Pass: the page fails to load until the VPN is back, then shows the VPN's address.
Fail: at any point the page loads and shows your real address.

The same tests from a terminal

If you would rather not rely on test websites, three commands cover tests 1 to 3. Run them with the VPN off, then on, and compare.

curl https://www.cloudflare.com/cdn-cgi/trace

Prints the ip= and loc= a server sees for this device. This checks the whole device, not only the browser.

dig +short whoami.akamai.net

Prints the address of the DNS server that actually made the lookup on your behalf. With the VPN on, it should not be an address belonging to your internet provider. On Windows, use nslookup whoami.akamai.net.

curl -6 https://icanhazip.com

Forces the request over IPv6 and prints the address used. With the VPN on, it should either fail or print an address that is not your provider's.

What each failure means and how to fix it

Test that failed	What is happening	What to do
1. IP address unchanged	Traffic is not entering the tunnel	Reconnect, change server, check split tunneling exclusions, restart the app
2. Provider's DNS servers listed	Lookups are going outside the tunnel	Turn on DNS leak protection in the app. Remove any custom DNS set on the device or browser, including "secure DNS" in browser settings, then retest
3. Provider's IPv6 address shown	The VPN is not carrying IPv6	Turn on IPv6 leak protection in the app if it has it. Otherwise disable IPv6 on the network adapter
4. Real address on the WebRTC page	The browser is exposing it	Fix test 3 first, since the two often go together. Then limit WebRTC in the browser's settings or with the VPN's browser setting
5. Real address during reconnect	No working kill switch	Turn the kill switch on. If it is on and still fails, the app's kill switch is not doing its job on that system

If a test still fails after the fix, the conclusion is that the VPN does not protect that path on your device, and that is a reason to change VPN.

When the app says connected and it still is not true

Passing these tests on your home network is a good sign. One class of problem depends on the network you join. In May 2024, Leviathan Security Group published TunnelVision, tracked as CVE-2024-3661. A hostile network can use an ordinary network setup feature, DHCP option 121, to tell your device to send traffic around the VPN's tunnel. The VPN app keeps showing "connected." The researchers found Windows, Linux, iOS and macOS affected, and Android not affected, because Android does not support that option.

The lesson for testing: run the five tests again the first time you use a network you do not trust, such as a hotel or conference Wi-Fi. It takes the same five minutes. We go through that setting in is hotel Wi-Fi safe.

What these tests cannot tell you

They show where your traffic goes. They cannot show what the VPN company does with it once it arrives. No leak test can see a provider's logs. For that you have to read what the provider says it records, in specifics.

For Secria VPN, the leak side is handled by design: DNS runs on our own resolver inside the tunnel, and an OS-level kill switch on iOS, Android, Windows, macOS and Linux blocks all traffic the moment the tunnel drops. On the other side, Secria VPN keeps no activity logs: we do not record browsing, DNS queries or traffic contents. Run the five tests on it. That is what they are for.

FAQ

How do I know if my VPN is working on my iPhone? Look for the VPN icon in the status bar or Control Center, then open the Cloudflare trace page in Safari and check that ip= is not your home address. Run the DNS test as well, since an icon alone does not rule out a leak.

How often should I test my VPN? After installing it, after any major app or system update, and the first time you use a new network you do not trust. The tests are quick enough to repeat.

Why does the IP test show a different city from the server I picked? IP location databases are approximate and sometimes out of date. What matters is that the address is not yours and the country is the one you chose.

Does passing a leak test mean my VPN is private? It means your traffic is going through the tunnel. Whether the provider keeps records of it is a separate question that no test can answer.

Can I test a VPN without using a website? Yes. The three terminal commands above ask a server directly what address and DNS resolver it sees, with no browser involved.

Five tests, five minutes, and you know instead of assuming. If yours fails and you want one built to pass, Secria VPN is $7.99 a month or included in Secria Pro.