Provider-neutral self-test pilot
NordLayer is a business product, and that changes who decides what these checks will show: an administrator configures the gateway, the split-tunnelling rules and the filtering, and your client applies them. It also does not support IPv6, and publishes per-platform guides for switching it off. Read the IPv6 line and the address line against the policy in force, and treat the result as a description of this browser rather than of the network you belong to.
Live test
On NordLayer an administrator decides which traffic is tunnelled, so in Include mode a browser is normally outside it. IPv6 is not supported at all.
Current-session checks
Take a reading before connecting and one after, and find out which split-tunnelling mode your organisation uses first, because Include and Exclude produce opposite expectations.
Before you read the result
The points below come from NordLayer's own help centre, which documents these settings as administrator-controlled rather than per-user.
NordLayer publishes guides for disabling IPv6 on Windows, macOS, Linux and Android, and notes that on iOS it cannot be disabled on the device and has to be handled at the router instead. Its stated reason is that having IPv6 enabled can slow the connection considerably, make it unstable, or make connecting to a server impossible. An IPv6 address still tied to your own connection is the case those guides exist for.
NordLayer documents two split-tunnelling modes. Include mode encrypts and routes only the IP addresses or subnets an administrator chose. Exclude mode routes everything through the tunnel except the addresses listed, and NordLayer documents excluded traffic as having direct internet access without encryption. In Include mode a browser is normally outside the tunnel, so this page showing your own address is the configuration working.
Exclude mode is documented on the gateway, where it accepts IP addresses, subnets and domains, and on the browser extension, where it accepts domains, subdomains and wildcards. Which of the two you are running decides whether a reading here describes the whole machine or only this browser, and that is the first thing to establish before comparing two devices.
NordLayer documents a server with a dedicated IP as useful when team members need a fixed address that only they can use, and as the basis for allowlisting access to remote resources and for setting up a site-to-site connection. If your organisation has one, the exit address is expected to be the same on every run, which makes a changed address the thing worth asking about.
NordLayer documents a kill switch across Windows, macOS, Android, iOS and Linux that blocks internet traffic immediately when the connection fails, and notes that it may limit local network services such as AirDrop, CarPlay and other device-to-device connections. That side effect is a useful confirmation it actually engaged when a check comes back with nothing at all.
Between the readings
NordLayer's kill switch is documented as possibly limiting local network services such as AirDrop and CarPlay, which makes it unusually easy to tell when it engaged. A recorded drop turns that into a timestamp.
Safe Copy exports use safe summary categories and remove raw IP, exact city, full user-agent, raw fingerprint data, raw resolver IPs and WebRTC candidates. It is not a certificate, provider audit, or proof of anonymity.
FAQ
No. NordLayer publishes per-platform guides for disabling IPv6 and states that having it enabled can slow the connection, make it unstable, or make connecting to a server impossible. On iOS it has to be handled at the router.
Check which split-tunnelling mode is in force. In Include mode only the addresses and subnets an administrator chose are routed through NordLayer, so an ordinary browser stays outside the tunnel by design.
Include mode routes only the addresses an administrator selected. Exclude mode routes everything except the listed addresses, and NordLayer documents that excluded traffic reaches the internet directly and without encryption.
No. NordLayer documents the extension as covering domains, subdomains and wildcards in the browser, while the gateway client handles IP addresses and subnets for the machine. Which one you run changes what these checks describe.
If your organisation uses a server with a dedicated IP, yes. NordLayer documents that as a fixed address only your team can use, and as the basis for allowlisting, so a changed address is worth asking your administrator about.
It can be. NordLayer notes that its kill switch may limit local network services such as AirDrop, CarPlay and other device-to-device connections while it is blocking traffic.