Is my VPN working? How to run a VPN leak test

What “working” means for a VPN

A VPN creates an encrypted tunnel from your device to a server run by the VPN provider. Websites then see that server’s public address — the exit — instead of the one your internet provider assigned to you. If any part of your traffic takes another path, the site on the other end can still see your real address or your provider. That is a leak.

Most leaks are not dramatic failures. They usually come from traffic the VPN app was never set up to carry, such as IPv6, or from browser features that open their own connections. A complete check looks at four separate paths:

• Your public IP over IPv4 — the address most websites see.
• Your public IP over IPv6 — a second address many connections also have.
• WebRTC — the browser feature behind video calls, which can discover addresses on its own.
• DNS — the lookups that turn names like example.com into addresses.

Run the test in under two minutes

You only need IPNIXA in your browser and your VPN app. Do the checks in this order so the before-and-after comparison is meaningful.

1. With the VPN off, open IPNIXA. Note your IPv4 address and your internet provider. The page keeps this check in your browser tab for 30 minutes so it can compare later; nothing is sent to our server.
2. Connect your VPN and wait until the app says it is connected.
3. Press Refresh on IPNIXA. When the connection looks like a VPN, the NIXA Privacy Check opens below your result.
4. Scroll through the check. Each line runs as it comes into view: public IP, network, location, WebRTC, IPv6, time zone and DNS. The gauge finishes with Looks good or Review.
5. For a saved before-and-after table, open the VPN check, select Save current connection with the VPN off, then Check again & compare with it on.
6. Finish with a DNS leak test from your VPN provider or a dedicated DNS test service.

How to read each result

Use this table to decide whether a line is fine, needs a second look, or needs a fix.

Why IPv6 is the most common leak

Many home and mobile connections are dual-stack: they have both an IPv4 and an IPv6 address. Some VPN apps only route IPv4 through the tunnel. Your browser still reaches dual-stack websites over IPv6, often first, and those websites see your provider’s IPv6 address — which reveals your provider and an approximate location.

Because IPNIXA tests IPv4 and IPv6 separately, this shows up clearly: the IPv4 line belongs to the VPN, while IPv6 exits in your real country. The fix is in the VPN app, usually an option called IPv6 leak protection or Block IPv6. If your app has neither, choose a provider that tunnels IPv6.

WebRTC leaks in your browser

WebRTC lets browsers make calls and share video directly between people. To find a direct path, the browser asks a STUN server which public address it appears to have. If that request travels outside the VPN, it can reveal an address the website never saw over normal web traffic.

Modern browsers hide local network addresses by default, so the real question is whether a public address other than the VPN’s appears. The IPNIXA check gathers WebRTC candidates through Cloudflare’s public STUN server and compares them with the addresses confirmed over the web. If another public address shows up, enable your VPN’s WebRTC protection or use a browser setting or extension that limits WebRTC to the VPN.

DNS leaks and why a web page cannot test them

Before your browser can load a site, a DNS resolver translates its name into an address. If those lookups go to your internet provider’s resolver instead of the VPN’s, your provider can still see which sites you visit, even though the pages themselves travel through the tunnel.

A web page cannot see which resolver answered your lookups. A real DNS leak test works by making your device look up unique, random names and watching which resolvers ask for them at an authoritative DNS server. That needs dedicated DNS infrastructure, so this check marks DNS as not tested instead of guessing. Use your VPN provider’s leak test page or a dedicated DNS leak service, and turn on the app’s DNS leak protection.

When “VPN detected” is wrong

IPNIXA recognizes VPNs, proxies and relays from the network name and number (ASN) that your address belongs to, plus Cloudflare’s WARP flag. That is an estimate. A company network, a cloud desktop or a hosting provider can look like a VPN, and a small VPN that uses a regular internet provider’s addresses may not be recognized.

iCloud Private Relay and Cloudflare WARP are reported by name when they can be identified. They protect browser traffic differently from a full VPN, so read their results as a privacy relay, not a traditional VPN tunnel.