How do I know if my VPN's kill switch is working?

Disconnect your VPN while a VPN leak test is running. If a kill switch is active and working, your internet connection should drop entirely — the test page should stop loading rather than showing your real IP. If you can still browse with the VPN disconnected, the kill switch is either disabled or not functioning.

How to Fix a VPN Leak — Step-by-Step Guide

Q: Why does my VPN still show my real IP?

The most common causes are: VPN reconnect in progress (IP briefly exposed), split-tunnel mode routing some traffic outside the VPN, or the VPN client crashing without a kill switch active. Reconnect the VPN, ensure kill switch is on, and run the test again.

Q: Does a VPN leak mean my VPN provider can see my traffic?

A VPN leak means a third party (typically your ISP) can see specific information — usually your DNS queries or real IP. The VPN provider's visibility depends on their logging policy, which is separate from the leak issue. A DNS leak exposes DNS queries to your ISP, not to a new eavesdropper.

Before you start: Connect your VPN, then open the VPN Leak Test in a new tab. Keep it open — you'll run it multiple times during this guide.

Step 1 — Run a VPN Leak Test

With your VPN connected, open the MyIPScan VPN Leak Test. The tool checks four things simultaneously:

IP address — the public IP your connection is exiting from
DNS resolvers — the DNS servers handling your name lookups
WebRTC candidates — IP addresses exposed by your browser's WebRTC API
IPv6 address — whether your IPv6 connection bypasses the VPN

Note which results show your real ISP information rather than your VPN's network.

Step 2 — Identify the leak type

Each leak type has a different cause and fix:

IP leak: Your real IP appears in the main IP result instead of the VPN's exit IP
DNS leak: Your ISP's DNS server appears in DNS results, meaning DNS queries bypass the VPN
WebRTC leak: Your real IP appears in the WebRTC candidates list despite the VPN being active
IPv6 leak: Your real IPv6 address is visible because the VPN only tunnels IPv4 traffic

Step 3 — Fix an IP leak

An IP leak means your real public IP is visible instead of the VPN's exit IP. This usually happens during reconnection, after a VPN crash, or when the VPN fails to establish a tunnel.

Disconnect and reconnect your VPN. Run the test again.
If the leak persists: check that your VPN client's kill switch is enabled. A kill switch blocks all internet traffic when the VPN drops, preventing IP exposure.
Try a different VPN server — the specific server may have a routing problem.
If the issue continues across multiple servers, contact your VPN provider's support — it may be a client-side bug or misconfiguration.

Step 4 — Fix a DNS leak

A DNS leak means your DNS queries are going to your ISP's resolver instead of the VPN's. Sites you visit are not exposed (your IP is still the VPN's), but your ISP can see which domains you look up.

In your VPN client settings, look for "DNS leak protection" or "prevent DNS leaks" and enable it.
Switch from split-tunnel to full-tunnel mode if your client offers both — split-tunnel routes only some traffic through the VPN, which can leave DNS exposed.
On Windows: Smart Multi-Homed Name Resolution (SMHNR) is a common cause. See the full guide: How to Fix a DNS Leak.
Re-run the DNS Leak Test to confirm the fix worked.

Step 5 — Fix a WebRTC leak

A WebRTC leak exposes your real IP through the browser's peer-to-peer networking API. This is a browser-level issue — VPNs cannot block it unless they proxy all UDP traffic at the system level.

Follow the browser-specific steps in: How to Disable WebRTC.
In summary: Firefox users can disable WebRTC in about:config; Chrome users need an extension (uBlock Origin blocks WebRTC exposure); Brave has a built-in policy setting.
After disabling WebRTC, run the WebRTC Leak Test — the candidates list should be empty or show only the VPN's IP.

Step 6 — Fix an IPv6 leak

An IPv6 leak means your VPN tunnels only IPv4 while your IPv6 connection routes natively, revealing your real ISP-assigned IPv6 address to every site you visit.

In your VPN client settings, check for "IPv6 leak protection" or "block IPv6" and enable it.
If your VPN has no such setting, disable IPv6 on your system. See: How to Fix an IPv6 Leak.
Re-run the IPv6 Leak Test to confirm no IPv6 address is visible.

Confirm all leaks are fixed

After applying each fix, return to the VPN Leak Test and run a full test. A clean result looks like this:

IP address: shows your VPN server's IP and your VPN provider's ASN
DNS: shows your VPN provider's DNS servers, not your ISP's
WebRTC: empty, or shows only the VPN's IP
IPv6: no result, or shows an IPv6 address within your VPN provider's range

Related guides and tools

VPN Leak TestFull combined IP + DNS + WebRTC + IPv6 check. How to Fix a DNS LeakStep-by-step DNS leak fix including Windows SMHNR. How to Disable WebRTCPer-browser instructions for Chrome, Firefox, Brave, Edge. How to Fix an IPv6 LeakDisable IPv6 on Windows, macOS, and Linux. What Is a VPN Leak?In-depth explanation of all four VPN leak types. Public Exposure ReportFull privacy audit combining all tests.

Frequently asked questions

Why does my VPN still show my real IP?

The most common causes: the VPN is reconnecting (IP briefly exposed without a kill switch), split-tunnel mode is routing some traffic outside the VPN, or the client crashed. Reconnect the VPN, enable the kill switch, and run the test again. If the IP leak persists across multiple sessions, try reinstalling the VPN client.

What is the difference between a VPN leak and a VPN not working?

A VPN leak means the VPN is active but a specific type of traffic (DNS queries, WebRTC UDP, IPv6 connections) bypasses the encrypted tunnel. A VPN not working at all means no traffic routes through the VPN. Leak tests can identify both conditions.

Can a VPN fix a WebRTC leak by itself?

Usually not. WebRTC's ICE candidate collection happens inside the browser sandbox, above the network layer. A VPN that doesn't proxy all UDP traffic at the OS level cannot prevent the browser from exposing IPs through WebRTC. Browser-level configuration is required.

How do I know if my VPN kill switch is working?

Disconnect the VPN while a page is loading. If the kill switch works, your internet connection drops entirely — the page stops loading. If you can still browse with the VPN disconnected, the kill switch is disabled or not functioning. Enable it in your VPN client settings.

Does a VPN leak mean my VPN provider can see my traffic?

No — a VPN leak means a third party (usually your ISP) can see specific information like DNS queries or your real IP. A DNS leak exposes DNS queries to your ISP's resolver, not to a new eavesdropper. Your VPN provider's visibility depends on their no-logs policy, which is a separate issue from the leak.