How to Check if Your VPN is Working: IP, DNS, WebRTC, and Kill Switch

How to check your IP address and what should change

Your IP address is the number websites use to identify your connection. Without a VPN, it belongs to your ISP or mobile carrier; with a VPN, it's the server's address. Websites also use it to determine your country and city.

1. Turn off your VPN and open ipleak.net or browserleaks.com/ip. Note your IP, country, and ISP (look for the ISP or Organization line).
2. Turn on your VPN, wait a few seconds, and refresh the page.
3. Compare the results. Your IP should change, the country should match your VPN app, and your ISP should be replaced by the name of a hosting provider or data center.

The process is exactly the same on a phone using a mobile browser. If you want to test both your home Wi-Fi and mobile network, repeat the process on both—a VPN that works fine at home might behave differently on cellular data.

If the address changed, your browser traffic is going through the VPN. If it didn't, we cover the reasons below in the section on why a VPN might not change your IP. If the VPN won't connect at all, start with our troubleshooting guide.

Why local sites like 2ip.ru or Yandex show your real IP

In Russia, people often use 2ip.ru or Yandex Internetometer to check their IP. With a VPN on, they might still show your regular Russian address—this doesn't mean your VPN is broken. Many people set up split tunneling so banking apps and Gosuslugi (Russia's public services portal) bypass the VPN. 2ip.ru and yandex.ru are Russian websites, so their requests also skip the tunnel, allowing them to see your ISP's address.

This is why you should always use a foreign website for testing. You only need to worry if a local site shows your real IP when split tunneling is completely turned off.

DNS leaks: what they are and how to test for them

Before loading a website, your device asks a DNS server for its address: 'where is example.com?'. If your VPN is working correctly, these queries go through the tunnel. If not, they are sent to your ISP or the public Wi-Fi network's DNS server. This is a DNS leak. The ISP can't see the content of the pages you visit, but they can see the list of websites you open.

1. Turn on your VPN and open dnsleaktest.com.
2. Click Extended test and wait about 30 seconds. The site will send a series of queries and show which DNS servers responded.
3. Look at the ISP column. If you see your home ISP or mobile carrier, your queries are bypassing the tunnel.

You can run a similar test at browserleaks.com/dns. On ipleak.net, it runs automatically and shows results in the DNS section.

What is a normal result?

It's normal to see servers located in the VPN server's country, or large public DNS providers like Google and Cloudflare. If you see Cloudflare or Google even though you didn't configure them, your browser might be using Secure DNS (DNS over HTTPS). This isn't considered a leak: the queries are encrypted and routed to these servers through the same VPN tunnel.

What to do if your DNS is leaking

• Switch your client from proxy mode to VPN mode. In Hiddify, this is under 'Service Mode' → 'VPN'. In other clients, it might be called 'TUN'. In proxy mode, the system and some apps decide for themselves where to send DNS queries.
• If you changed DNS settings in the VPN app, revert them to default.
• Keep split tunneling in mind. Some clients route DNS queries for Russian domains outside the tunnel. This is expected, since the sites themselves open directly. Test sites are hosted abroad, so this won't affect your test results.
• On Windows using Hiddify, keep 'Strict Route' enabled in VPN mode. This closes a loophole that allows Windows to send DNS queries outside the tunnel.

A DNS leak doesn't reveal your IP to websites, but it tells the network owner which sites you visit. If you use a VPN mainly for public Wi-Fi in cafes or hotels, you definitely want to fix this.

WebRTC leaks: when your browser reveals your real IP

WebRTC is a technology for making video calls directly in your browser, no extra apps needed. To connect two people directly, the browser requests its external address from a special STUN server and can share it with the website. If this request bypasses the VPN, the website gets your real IP, even if everything else is routed through the tunnel.

1. Turn on your VPN and open browserleaks.com/webrtc or ipleak.net.
2. Find the WebRTC results section. On BrowserLeaks, it's called Your WebRTC IP.
3. If it shows your ISP's IP address, you have a leak. If you see the VPN server's address, a dash, or n/a, you are fine.

A local address like 192.168.0.5 isn't considered a leak. Millions of home networks use these addresses, and they reveal nothing about you. Modern browsers also usually hide this behind a random string ending in .local.

When does WebRTC leak?

If your client runs in VPN (TUN) mode and captures all device traffic, the browser's request to the STUN server goes through the tunnel, and the site sees the server's address. Leaks usually happen in two cases. First: the VPN is acting as a proxy (like a browser extension or a system proxy mode in your client). Proxies handle regular web requests, but browsers often send WebRTC traffic outside the proxy by default. Second: your browser is excluded from the tunnel via split tunneling.

How to limit WebRTC in your browser

• The easiest fix is to use VPN mode instead of proxy mode in your client. Then you don't need to tweak browser settings at all.
• Firefox: type about:config in the address bar, accept the warning, search for media.peerconnection.enabled, and set it to false. This completely disables WebRTC and browser-based video calls.
• Brave: search for 'WebRTC' in the settings and select the 'Disable non-proxied UDP' policy, which stops the browser from routing UDP traffic outside the proxy.
• Chrome and other Chromium browsers don't have a built-in toggle. BrowserLeaks recommends the WebRTC Network Limiter extension for Chrome. You can find similar extensions in the Chrome Web Store.

Always test the browser you actually use every day. Chrome, Firefox, and Brave handle WebRTC differently, so passing the test in one tells you nothing about the others.

Completely disabling WebRTC breaks browser video calls. If you use them, switching your client to VPN mode is much more convenient than turning it off in the browser.

Kill switch: how it works on Android, iPhone, and PC

A kill switch blocks your internet connection if the VPN drops. Without it, a dropped tunnel means your phone quietly switches back to your regular connection, and your apps keep running without a VPN. It's easy to miss: the icon disappears, but pages keep loading as if nothing happened.

Disconnects happen when you switch networks, get in an elevator, reboot your device, or update your VPN client. A kill switch is crucial if you absolutely cannot risk a single request leaking. For casual browsing, standard auto-connect is usually enough.

Android: 'Block connections without VPN'

On Android, the kill switch is built into the OS. 'Always-on VPN' was added in Android 7.0, and 'Block connections without VPN' arrived in Android 8.0. You enable it in Android's system settings.

1. Go to Settings → Network & internet → VPN. If you don't see it, search for VPN in your settings.
2. Tap the gear icon next to your VPN client.
3. Turn on 'Always-on VPN'. The system will now automatically reconnect your VPN after a reboot or connection drop.
4. Turn on 'Block connections without VPN'. As long as the tunnel is down, you will have no internet.

These names are from stock Android. On Samsung, Xiaomi, or other interfaces, they might differ slightly. If the toggle is greyed out or says 'Not supported by this app', your client doesn't support the feature. For more setup details, check our guide on VPNs for Android.

Testing this is easy: pause the VPN inside the app and try opening a website. If everything is configured correctly, the page won't load, and Android will show a notification that the VPN is disconnected. Some clients will immediately try to reconnect in this mode, which is also correct behavior.

iPhone and iPad: no system-wide toggle

iOS doesn't have a universal kill switch like Android. Apple offers developers a setting to force all traffic through the VPN, and some clients call this a kill switch. However, it comes with caveats. In 2023, IVPN removed this feature from their app for iOS 16 and newer because requests to Apple servers were still bypassing the tunnel. Mullvad also avoids this setting because it can leave your device without internet during app updates.

What you can do on an iPhone: enable auto-connect in your client if available, and don't keep multiple VPN apps installed that might steal the connection from each other. Read more in our guide on VPNs for iPhone.

Computers

On Windows and macOS, the kill switch (if available) is built right into the client. VLESS clients often lack a specific button with this name. Hiddify has a similar feature called 'Strict Route' which prevents some traffic from bypassing an active tunnel, but if the app is closed or the tunnel drops completely, traffic will still flow directly. This is why it's a good idea to repeat the tests in this article whenever you change your computer's settings.

Why your VPN isn't changing your IP or location

If a checking website shows your original address, run through these causes. They range from harmless to a bit more complex.

1. The site is bypassing the VPN. This is split tunneling: Yandex, 2ip.ru, and other local sites are routing outside the VPN. Test your IP on ipleak.net.
2. The VPN isn't actually connected, or the page is cached. The app icon might show a previous state, or the browser tab loaded before the VPN connected. Reconnect and refresh the page.
3. You have a proxy or VPN extension in your browser. These extensions intercept browser traffic and route it their own way. Turn off extensions and test again.
4. The client is running in proxy mode. Proxies only route apps that support them. Browsers usually do, but games and many other apps do not.
5. IPv6 is leaking. If your ISP gives you an IPv6 address but your VPN only handles IPv4, the website might see your IPv6. ipleak.net shows both. Enable IPv6 in your client settings if supported, or turn off IPv6 in your system network settings.

The IP changed, but the location didn't

Sometimes you get a new address, but a website or app still shows your real city. There are two reasons for this. First: geolocation databases. As mentioned earlier, the server's new address might still be registered to another country. Second: the app isn't using your IP to find you. Maps, taxis, and weather apps use GPS coordinates. App stores and streaming services look at your account region and SIM card. A VPN only changes your IP address—your GPS, account, and SIM stay exactly the same.

Which checks do you actually need and how often?

Not everyone needs to run all four tests. It depends heavily on your device and how your VPN client is configured.

• On iPhones, VLESS apps connect via a system VPN profile and capture all device traffic. By default, Android clients usually do the same. For phones, just checking your IP on a foreign website after setup or switching apps is enough.
• On computers, clients often run as system proxies. Hiddify for Windows and macOS starts in this mode by default. Until you switch it to 'VPN' mode, you should run all three tests: IP, DNS, and WebRTC.
• If you connect to public Wi-Fi in cafes, hotels, or airports, check your DNS. You don't want the network owner seeing your browsing history. On Android, it's also smart to enable 'Block connections without VPN' so your phone doesn't silently fall back to an open network if the tunnel drops.
• If you use split tunneling, check your IP on two different websites every time you update your routing rules. A foreign site should show your VPN server's address, and a local site should show your real address.

You should repeat these checks after updating your client, changing modes or routing rules, and on every new device. If you haven't changed anything, running a quick check every few months is plenty.