MyIPScan

Provider-neutral self-test pilot

PrivateVPN Leak Test

By: · Updated August 2026

PrivateVPN publishes two kinds of protection, and which one applies depends on the platform. In its apps the kill switch automatically blocks internet access if the VPN connection drops for any reason, and DNS leak protection routes all DNS requests through the VPN connection. On GNU/Linux its help centre instead walks you through building a kill switch yourself with iptables or ufw around an OpenVPN connection, and those rules are written for IPv4 only. It also offers Stealth VPN, which changes how the tunnel looks on a network that blocks VPNs. Everything below reads your own session rather than PrivateVPN's servers.

Read methodology

Live test

Run the test on PrivateVPN now

PrivateVPN routes DNS requests through the VPN connection, so the resolver line below should change when you connect. On Linux, read the IPv6 line too: the manual kill switch PrivateVPN publishes for that platform is written for IPv4 only.

Open the full VPN Leak Test

This browser session

Leak report

Not tested
Verdict
Visible IP
Not tested
DNS
Not tested
WebRTC
Not tested
IPv6
Not tested
Browser
Not tested
Next step

This reports what your browser shows in this session. It does not certify PrivateVPN, does not test every server, app or device, and does not prove anonymity.

Current-session checks

What this PrivateVPN self-test checks

Take each reading twice, before connecting and after. On PrivateVPN the resolver and, on Linux, the IPv6 line carry the most information, because both follow from what PrivateVPN has documented for each platform.

Run the VPN Leak Test Review IP, DNS, WebRTC, IPv6 and browser/session signals together. Check DNS signals Review limited resolver-signal behavior for this browser session. Review WebRTC exposure Check browser WebRTC candidate behavior. Check IPv6 visibility Review whether IPv6 appears in visible signals. Review browser fingerprint Check browser characteristics a VPN usually does not change. Read the methodology Review the limits before interpreting results.

Before you read the result

What PrivateVPN documents about these signals

The points below are drawn from PrivateVPN's feature page and its help centre. Knowing what each platform is meant to do is what separates an ordinary reading from one worth chasing.

On Linux the kill switch is a firewall you write

PrivateVPN's help centre article for GNU/Linux sets out a manual kill switch, or VPN firewall, built with iptables or with ufw around an OpenVPN connection. It assumes a client file whose remote line uses the server's IP address rather than a hostname, and it notes that iptables rules are wiped on reboot unless you keep them with iptables-persistent or a reboot entry in crontab. If a reading surprises you after a restart, check that the rules are still loaded before anything else.

Those rules cover IPv4 only

Both versions of that Linux guide, the iptables one and the ufw one, are written with IPv4 addresses and commands, and the article does not mention IPv6 at all. On a machine with IPv6 connectivity that leaves IPv6 outside what the rules describe. The IPv6 check on this page is the direct way to see whether your own address is reachable that way while the tunnel is up.

DNS goes through the tunnel

PrivateVPN describes DNS leak protection as ensuring that all DNS requests are routed through the secure VPN connection. Its Linux guide is stricter than many: it declines to allow DNS queries through your default gateway, a shortcut other guides suggest, and leaves that choice to you. A DNS check taken while connected should name a resolver reached through the tunnel, and your ISP's resolver appearing there is the reading to look at twice.

Stealth VPN changes the wrapper, not the result

PrivateVPN describes Stealth VPN as technology designed to make VPN traffic appear like regular internet traffic, for networks that block VPNs. That changes how the connection looks to the network you are on. It does not change what this page reads, which is the address, the resolver and the browser signals your session exposes once the tunnel is up.

Port forwarding opens a door inward

PrivateVPN offers port forwarding for specific services or applications. A forwarded port concerns connections arriving at the VPN address from outside, which none of the checks on this page make. If you enabled it, the address shown here is still the one websites see, and the forwarded port is a separate question for the service you opened it for.

Between the readings

Record a kill-switch drop on PrivateVPN

PrivateVPN describes its kill switch as automatically blocking internet access if the VPN connection drops for any reason. On Linux the equivalent is a set of firewall rules you add yourself, and they are gone after a reboot unless you make them persistent. A single reading cannot show which of those was guarding the gap.

Open the drop recorder

What this cannot prove

  • This checks visible browser/session signals only.
  • This does not certify the provider.
  • This does not test every server, app, device, or connection.
  • This does not prove anonymity.
  • This does not prove every security condition.
  • A clean result does not prove every leak is absent.

How to compare before and after on PrivateVPN

  1. On your normal connection, note the visible address, which resolver answered, and whether the IPv6 check returned anything.
  2. Connect with the PrivateVPN app with the kill switch on, or on Linux bring up OpenVPN with your firewall rules loaded.
  3. Rerun the same checks in the same browser, so the readings compare like for like.
  4. Expect the address and resolver to change. On Linux, if IPv6 still returns your own address, the IPv4-only rules are the first thing to look at.
Safe Copy limits

Safe Copy exports use safe summary categories and remove raw IP, exact city, full user-agent, raw fingerprint data, raw resolver IPs and WebRTC candidates. It is not a certificate, provider audit, or proof of anonymity.

FAQ

PrivateVPN leak test FAQ

Does PrivateVPN have a kill switch on Linux?

PrivateVPN's help centre publishes a manual kill switch for GNU/Linux, built with iptables or ufw around an OpenVPN connection. It is a set of firewall rules you add yourself, and the article notes they are wiped on reboot unless made persistent.

Does that Linux kill switch block IPv6?

The guide's rules are written for IPv4, and the article does not mention IPv6. If your machine has IPv6, run the IPv6 check on this page while connected to see whether your own address is visible that way.

Which DNS servers should answer while PrivateVPN is connected?

PrivateVPN says DNS leak protection routes all DNS requests through the secure VPN connection. The DNS check here reports which resolver actually answered for your session, so your ISP's resolver appearing there is worth investigating.

Should I allow DNS through my default gateway in the Linux firewall?

PrivateVPN's Linux guide notes that other guides suggest it and says it does not recommend it, leaving the choice to you. Allowing it would let DNS queries leave outside the tunnel, which is what the DNS check on this page would then show.

Does Stealth VPN change these results?

PrivateVPN describes Stealth VPN as making VPN traffic appear like regular internet traffic on networks that block VPNs. It changes how the tunnel looks to the network, not the address and resolver this page reads once you are connected.

Can this page confirm PrivateVPN's no-logs policy?

No. PrivateVPN states that it follows a strict no-logs policy and does not monitor or store records of your browsing activity. These checks read only what your own browser exposes during one session.

Other provider self-tests

The same current-session checks, walked through for another provider. Listed alphabetically; this is not a ranking or a comparison.

All provider self-testsIndex of every provider walkthrough on MyIPScan.PrivadoVPN leak testThe same IP, DNS, WebRTC and IPv6 checks, walked through here.Private Internet Access leak testThe same IP, DNS, WebRTC and IPv6 checks, walked through here.Proton VPN leak testThe same IP, DNS, WebRTC and IPv6 checks, walked through here.Psiphon leak testThe same IP, DNS, WebRTC and IPv6 checks, walked through here.