Is Your VPN Actually Working? Here's How You Can Tell by Testing It

A virtual private network, or VPN, is a privacy tool that makes apps, websites or other internet-connected services think you’re connecting from a different location. VPNs mask your physical IP address, making it look like you’re in another city, state or even country. But if a VPN isn’t working, your IP address could be exposed.

Testing is a crucial component of our hands-on VPN reviews. We run more than 250 individual internet speed tests per VPN provider, check major features like kill switches and check for DNS leaks. During our review process, we’ve even uncovered IP leaks, which were thankfully quickly patched. But you don’t have to wait for us: Whether you’re already experiencing issues or just want to see if everything’s working properly under the hood, here’s how to test and ensure your VPN works correctly.

How to tell if a VPN is working

The easiest way to tell if a VPN is working is to fire up your VPN software, hop on a server in a different location -- another city, state or country -- then look up your IP address using a website such as the aptly named WhatIsMyIPAddress. Usually, your IP address is that of your internet service provider, or ISP -- like Google Fiber or Spectrum. However, with a VPN enabled, your IP address will show different information for the ISP, city, region, and maybe even country.

If you’ve got a VPN running but still see your ISP’s info and your current geographical location, there’s a chance your VPN isn’t working correctly.

Why isn’t my VPN working?

If your VPN isn’t working correctly, there are several possible reasons why your IP address isn’t masked. There could be an issue with your kill switch, you may have split tunneling toggled on or there could be an IP leak -- either a DNS or WebRTC leak. Here’s how to diagnose and fix your VPN problems.

What kinds of IP leaks can occur while using a VPN?

You can experience two main types of IP leaks with a VPN: DNS or WebRTC leaks. The Domain Name System, or DNS, is like an address book -- it keeps a record of website domains (like CNET.com) and translates those into their Internet Protocol addresses. When you use a website or app, your device pings your internet service provider’s DNS server requesting that app or site’s IP address. But when using a VPN, your machine usually contacts a VPN server rather than your ISP’s DNS. A DNS leak while using a VPN means internet-connected services like apps and websites will view your actual IP address rather than your VPN provider’s IP address.

On the other hand, a WebRTC, or Web Real-Time Communication, IP leak can show your IP address through a security flaw in programs like web browsers. WebRTC is used in various programs -- notably messaging apps like Google Meet and Facebook Messenger. So turning WebRTC off in your browser means those apps may not work properly when running in your browser of choice. While DNS leaks with a VPN enabled are usually the fault of your virtual private network provider, WebRTC leaks are typically related to other software, like your web browser. WebRTC lets web browsers communicate with one another, but they’ll have to share their IP addresses in the process.

How to Check if your DNS has leaked

You can easily discover DNS leaks with websites like BrowserLeaks and IPLeak.net -- I use both sites when performing hands-on VPN review testing. Look up your IP address and make a note of it. Enable your VPN and head to IPLeak.net or BrowserLeaks. You should see the IP address of your VPN provider rather than your own.

For instance, I’m physically located in North Carolina in the United States and connected to a London, UK, server with a virtual private network. So when I check my IP, I should see a UK IP address rather than my NC one.

How to test for WebRTC leaks

To check for WebRTC leaks, I recommend using the BrowserLeaks WebRTC leak test. Alternatively, some VPNs, including ExpressVPN, include built-in WebRTC checkers. With your VPN toggled off, head to the WebRTC leak test in your browser and note any public IP addresses. Now, connect to your VPN and recheck the WebRTC leak test page. If you don’t see your actual IP address, there are no WebRTC leaks, but if you do see your IP, then you may have a leak.

Because WebRTC relies on your browser, you’ll need to check each one -- like Chrome, Brave, Opera or Safari -- separately if you use multiple browsers.

How to fix DNS leaks

If you discover a DNS leak while using a VPN, you could try toggling your VPN connection off and back on if you find a DNS leak, or clearing your DNS cache:

• On Windows: Click Start > Select Command Prompt > Enteripconfig /flushdns
• On MacOS:Open Finder > Tap Applications > Select the Utilities folder > Open Terminal > Entersudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

If restarting your VPN connection and flushing your DNS settings doesn’t fix the problem chances are you can’t fix that on your own. When we discovered a now-fixed DNS exposure with split tunneling on Windows using ExpressVPN, we contacted the company immediately and were impressed with its swift response. It removed split tunneling from its Windows app until the issue was fixed.

How to fix WebRTC leaks

Most VPNs protect you from WebRTC leaks, but you can disable WebRTC altogether. Note that turning off WebRTC might cause websites that rely on it to function incorrectly -- think Discord’s browser app not making calls. The ExpressVPN browser plugin -- available for Chrome, Edge and Firefox -- lets you shut off WebRTC directly from the settings menu. Alternatively, you can restrict WebRTC on a per-browser basis:

• In Google Chrome:I recommend using Google’s own WebRTC Network Limiter extension.
• In Firefox:In the address bar, type about:config. You may see a Proceed with Caution warning, so click the Accept the Risk and Continue button. Then, in the search bar, enter media.peerconnection.enabled. Double-click it and change the value to False.
• In Microsoft Edge:Type about:flags into the address bar. Find Anonymize local IPs exposed by WebRTC and enable it.
• In Opera:Navigate to Settings, search in the magnifying glass for WebRTC and toggle Disable non-proxied UDP on.
• In Brave:Visit Settings and click the magnifying glass icon, then type WebRTC. In the WebRTC IP Handling Policy section, choose Disable Non-proxied UDP.

How to test your VPN’s kill switch

A kill switch shuts off your internet connection when your VPN gets unexpectedly disconnected -- for instance, when there’s a power outage or your internet goes out for a moment. With a kill switch, your actual IP address remains masked even if your VPN connection is interrupted. Here’s how to test your VPN’s kill switch:

1. Open a DNS leak checker like IPLeak.net or BrowserLeaks to monitor your publicly available IP address.

2. Look up your IP address without a VPN connected using a website such as WhatsMyIPAddress.

3. Enable the kill switch in your VPN’s settings and toggle on your VPN connection.

4. Switch to a different VPN server in another location.

5. Cause an unexpected internet interruption by disconnecting your Wi-Fi on your computer, unplugging an ethernet cable hooked up to your PC or enabling airplane mode on a mobile device.

6.Reconnect to the internet.

If your VPN’s kill switch is working correctly, your IP log shouldn’t show your actual IP address even when switching servers or during an unexpected internet disconnection.

How to tell if your VPN’s split tunneling feature is working properly

Split tunneling is a neat option that lets you select which apps use a VPN connection and which don’t, so you can leave your VPN running without tunneling all of your traffic through it at once. For instance, I’ll often use split tunneling on my Windows desktop to stream Star Trek: The Next Generation from the Netflix UK library (normally it’s on Paramount Plus in the US) using a VPN while downloading games on Steam outside of an encrypted connection to get the fastest possible internet speeds.

Let’s look at how to test whether your VPN’s split tunneling is functioning correctly.

1. Enable split tunneling in your VPN app.

2. Choose the app or apps you’d like to use your VPN.

3. Open a web browser.

4. Check your IP address.

If your browser is set to tunnel through your VPN, you should see your VPN provider’s IP address instead of your own. But if you’ve got a VPN running with split tunneling enabled and your browser set to bypass your VPN, you should see your own IP address. In either situation, split tunneling isn’t working properly if you notice the opposite.

Best VPNs for masking your IP address

ExpressVPN is the best overall VPN. It features split tunneling, and its WebRTC blocking from within the browser apps makes it a great choice for preventing DNS leaks.

NordVPN is the fastest VPN we tested, so it’s excellent for streaming geo-protected content, like foreign Netflix libraries. Its advanced privacy features, including Tor Over VPN and Double VPN servers, alongside split tunneling, mean Nord can hide your IP address well.

Surfshark is a solid wallet-friendly VPN that’s fast, great for streaming and packs privacy options for keeping your IP address hidden, such as Multihop (double VPN servers) and split tunneling.

Proton VPN is the best -- and only -- free VPN we recommend. You’ll get privacy options like split tunneling, Tor Over VPN servers and Secure Core (Double VPN) servers. While Proton’s free tier doesn’t sell your data, plaster your screen with ads or impose usage restrictions, its paid plan provides a much larger server network.