The VPN icon in your status bar tells you a tunnel is up. It doesn't tell you the tunnel is doing its job. Misconfigured DNS, a leaky browser API, or an IPv6 path your VPN ignores can all quietly undo the privacy you think you have.
Here are the five checks we'd run on any VPN — ours included. All five take about two minutes total.
Test 1: The IP check
The basic one. Turn the VPN off, note your IP, turn it on, check again.
Open our IP lookup tool — it shows the IP address and network operator the internet currently sees. With the VPN connected you should see the VPN server's address and a hosting company as the operator, not your home ISP.
If your IP didn't change: the tunnel isn't actually routing your traffic. Reconnect, switch servers, or check that another VPN profile isn't fighting for the connection in Settings → General → VPN & Device Management.
Test 2: The DNS check
Your traffic can be tunneled while your DNS queries — the record of every site you look up — go straight to your ISP. That's a DNS leak, and it's the most common real-world VPN failure.
Run our DNS leak test. The network operator answering your DNS should be consistent with your VPN exit, not a consumer ISP in your home country.
If it leaks: in most VPN apps this is a settings issue — look for "use VPN DNS" or similar. On corporate or school profiles, a managed DNS setting can override the tunnel.
Test 3: The WebRTC check
WebRTC is a browser API for calls and video chat. To set up connections it collects your addresses — including, in some browsers, your real IP, which any script on a page can then read. The VPN never sees it happen because it happens inside the browser.
Run the WebRTC leak test. The exposed addresses should match your VPN IP, not your real one.
If it leaks: Safari and Brave block WebRTC enumeration by default. On Chrome or Firefox, install an extension that disables non-proxied UDP, or switch browsers when privacy matters.
Test 4: The IPv6 check
Many networks now hand your device both an IPv4 and an IPv6 address. If your VPN only handles IPv4, sites reachable over IPv6 may bypass the tunnel entirely — while everything looks fine.
Check with our IPv6 test. Ideal results with a VPN on: either "no IPv6 detected" (the VPN blocks it) or an IPv6 address that belongs to the VPN, not your ISP.
Test 5: The kill-switch drill
A kill switch should cut your internet the moment the tunnel drops, so nothing leaks in the gap before reconnection. Test it the blunt way:
- Connect the VPN and start loading a page.
- Toggle Airplane Mode on for five seconds, then off.
- Watch what happens in the seconds after the network returns.
With a kill switch active, nothing should load until the VPN is re-established. If pages load instantly while the VPN icon is still off, your traffic used the gap — enable the kill switch in the app (FREE VPN FAST Premium includes one).
Make it a habit
Run these once when you set up a new VPN, and again whenever iOS has a major update or you join a network you don't trust. Two minutes, five checks, and "the icon is on" becomes "the tunnel is verified."
All five tools are free, run in your browser, and don't require the app: freevpnfast.com/tools.