How to Check If VPN Is Working: A Clear Test

Here is how to check if VPN is working: note the public IP address shown by Loqmi with the VPN off, connect, then reload the same page. A changed address and network provider mean this browser’s web request now leaves through another internet exit. DNS, IPv6, WebRTC, and connection-drop checks cover the paths that an IP check alone cannot see.

The common mistake is trusting a green “connected” badge to mean every route is protected. The badge only says the app connected. It is a starting signal, about as useful as a “locked” light on a door that is still propped open.

How to check if VPN is working

Start by deciding what the VPN is meant to cover. A personal full-tunnel VPN usually sends ordinary internet traffic through its exit server. A company VPN may route only work apps or internal sites and leave your public web traffic on the normal connection. That setup is called split tunneling, and it can be intentional, like a hallway with a staff-only door.

For a clean comparison, disconnect other VPNs, proxies, and Apple Private Relay (Apple’s Safari traffic relay) if they are active. Record the public IP and provider on Loqmi, connect the VPN, then reload the same page in the same browser. Compare the full address, not just the country. The country can stay the same, and geolocation databases sometimes put an exit in the wrong city. Then run Loqmi’s WebRTC leak test to see which IPs your browser exposes.

If the old address remains, check browser exclusions, the active profile, and whether general web traffic is meant to use the tunnel. For context, see why an IP location can be wrong.

Run a WebRTC test and check IPv6

Browsers use WebRTC (Web Real-Time Communication) for calls and other live connections. While they set up, they gather network addresses, so a WebRTC test can reveal more than an ordinary page request does. A device with several network paths may expose both its VPN exit and an address facing its internet service provider (ISP), depending on routing and browser behavior. See IETF RFC 8828.

With the VPN on, run a WebRTC test in each browser you use. Compare any public addresses with your VPN-off baseline and the VPN exit. If the baseline public address shows up, investigate. A private local address such as 192.168.x.x, one of the private IPv4 ranges documented in RFC 1918, is not the same as your public address leaking to a site. Your router’s NAT (network address translation) works like a receptionist who answers every call with one company number, so many devices can share a public connection. More on the difference: public vs. private IP addresses.

Check IPv6 separately. IPv4 and IPv6 are two formats for internet addresses, and an IPv4 result says nothing about the IPv6 route. A VPN should carry IPv6 through its tunnel, or block it while connected if it does not support it. If a test shows your normal ISP IPv6 address, check the VPN provider’s documented IPv6 setting or contact its support team. Do not disable IPv6 system-wide as a first fix. That can break other network services and still will not show that the VPN handles IPv6 correctly.

Check DNS with the VPN on

DNS (the Domain Name System) turns a site name into a network address. A DNS check reports which resolver answered your browser’s lookup. It does not report your public IP. Run a reputable DNS leak test once with the VPN off and once with it on, using the same browser and network. If the VPN promises to handle DNS, the connected result should match that design. It should not route lookups through your home router or ISP resolver without warning.

A third-party resolver may be intentional. Some browsers use DNS over HTTPS (DoH), which sends lookups inside HTTPS requests to a resolver you choose. That can differ from the operating-system setting. IETF RFC 8484 defines DoH, but the resolver still receives your queries. If results surprise you, check the browser’s secure-DNS settings and the VPN’s documented policy. Learn more about how DNS works.

Test the kill switch safely

A kill switch should block traffic if the tunnel drops unexpectedly. Turn on the VPN app’s documented option, save open work, and follow its test instructions. If none are provided, briefly turn Wi-Fi off while the app stays connected, turn it back on, and check whether traffic stays blocked until the tunnel returns. Avoid sensitive accounts during the check.

Pressing Disconnect may not test this feature, since some apps allow traffic after a user disconnects. AMTSO’s testing guidance also recommends checking server changes and Wi-Fi-to-mobile transitions. Your network can change underneath a tunnel, so treat this check as a small obstacle course for your connection.

Find the VPN controls on your device

Use the provider app for its connection, routing, exclusions, and kill-switch settings. Built-in profiles use the paths below. Device makers and managed devices may vary.

Windows 11

Open Start > Settings > Network & internet > VPN, select the profile, and choose Connect. The taskbar quick settings also has a VPN control. Microsoft says a recognized connection appears as Connected on the VPN page and may show a shield on the taskbar. See Microsoft’s Windows VPN instructions.

macOS

For a manual profile, open Apple menu > System Settings > Network, choose the Action menu, then Add VPN Configuration. Connect from the VPN menu or the provider app. Apple’s Mac setup guide covers manual configuration.

Linux

On Ubuntu with GNOME, open Activities, search for Network, open that panel, and choose the + beside VPN to add a profile. Connect from the top-bar system menu. Other distributions and desktop environments differ, and a provider’s Linux app may have its own controls. See Ubuntu’s VPN help.

Android

Open Settings > Network & internet > VPN, select a saved profile, and connect. If the menu is missing, search Settings for VPN. With an app-based VPN, Android may open the app instead. Google notes that manufacturers can change menus and that a work profile may route only work apps. See Android Help.

iPhone

Connect through the VPN provider’s app. To inspect installed profiles, open Settings > General > VPN & Device Management. A managed profile may be controlled by your employer or school, so do not remove it just to test. See Apple’s profile instructions. The iPhone menu can vary with iOS version and configuration, so search Settings for VPN if needed.

Troubleshoot what the results mean

Speed is not a security test. A VPN can raise latency or reduce throughput because of routing or server load. For performance, compare like with like on Loqmi’s speed test with the VPN on and off. Think of speed as a traffic report, not a bodyguard.

A good result means the tested browser request used the expected VPN exit, and the specific leak checks matched the VPN’s stated design. It does not make you anonymous, hide GPS or account logins, erase cookies, or prove that every app is covered. Think of it as checking the doors you actually use, not certifying the whole building.