5 min read
A green icon in the app tells you one thing only: the tunnel came up. It says nothing about whether your DNS queries go through it, whether your browser is leaking your real address over WebRTC, or what happens to your traffic if the connection drops mid-session. Below are five checks in sequence, each with a clear pass or fail. Order matters — each test only makes sense if the previous one passed.
What you're checking: websites see the VPN server's address, not yours.
With the VPN off, open any IP-checking service and note what it shows: address, city, ISP name. Turn the VPN on and reload.
Pass: the address changed, the country matches the location you picked, and the listed provider is a hosting company rather than your home ISP. Fail: same address or same city — the tunnel didn't come up, or your browser traffic is bypassing it. Check whether you're relying on a browser extension instead of an app: browser VPN extension or app.
What you're checking: turning site names into addresses happens inside the tunnel.
This is the most common leak by a wide margin. Your traffic can run through the VPN while the question "what's the address for example.com" goes to your ISP's resolver. Your provider then has a list of every site you opened, even though the content itself was encrypted.
Pass: the results show resolvers belonging to the VPN's country or the service itself, with your ISP nowhere in the list. Fail: your home provider appears among the DNS servers. Causes and fixes: DNS leaks and how to test your VPN.
What you're checking: the browser's real-time communication feature isn't exposing your real IP.
WebRTC contacts helper servers directly over UDP and can bypass proxy settings entirely. A system-level tunnel captures every socket on the device and covers this; a browser extension usually does not.
Pass: the public address field shows the VPN server's address. Fail: your real address is visible. Fix: move from an extension to a system client, or disable WebRTC in your browser if you don't need it.
What you're checking: your device doesn't have a second path out.
Many ISPs hand out IPv6 addresses, and some VPN clients only tunnel IPv4. The result: sites with IPv6 support see your real address, even though the IPv4 check showed another country.
Pass: the test reports no IPv6 detected, or shows the server's address. Fail: your own IPv6 address is visible. Fix: enable IPv6 tunnelling in the client, or disable IPv6 in your adapter or router if the option doesn't exist.
What you're checking: traffic stops on a disconnect instead of continuing in the clear.
Almost everyone skips this one, and it's the only test that examines behaviour during a failure — the exact moment a VPN is supposed to matter.
How to do it manually:
Pass: the page doesn't load at all — traffic is blocked until the tunnel returns. Fail: the page loads and shows your real address. Everything in that window went out unprotected.
More detail on the feature and how to enable it: VPN kill switch.
| Test | What it catches | Pass criteria | |---|---|---| | Address | tunnel never came up | address and country changed | | DNS | ISP can see your site list | your provider absent from resolvers | | WebRTC | browser exposing real IP | address fields show the VPN server | | IPv6 | second route around the tunnel | no IPv6 detected, or server's address | | Kill switch | leak at the moment of a drop | no traffic passes during the drop |
A VPN doesn't make you invisible, and it's better to know the limits up front:
What the VPN service itself records is a question of trust rather than technology: does a VPN keep logs.
The client works at the system level rather than inside a browser, so WebRTC and third-party app traffic stay inside the tunnel. DNS queries are routed through it. On Apple devices there's a kill switch: when the connection breaks, internet access stops until protection returns. The protocol is VLESS with Reality masking — from the outside it's an encrypted session to an ordinary web address, with no distinctive VPN signature.
What's the quickest way to check a VPN works? Open an IP-checking service before and after connecting. If the address and country changed, the tunnel is up. That's the minimum — DNS and WebRTC tests come next.
Why does a site still show my country with the VPN on? Three usual causes: a DNS leak, detection by your system language and time zone, or cookies from an earlier session. Start by clearing site data.
How do I test a VPN on a phone? The same way, in the phone's browser. The kill switch test is actually easier on mobile: just switch from Wi-Fi to mobile data.
How often should I re-test? After changing clients, updating the OS, or changing network settings. OS updates sometimes reset IPv6 behaviour.
What if the DNS leak test fails? Enable DNS routing through the tunnel in your client and remove manual DNS servers from your system settings.
Best video calling messengers instead of WhatsApp & Telegram. Review of Zoom, Teams, Signal, FaceTime. Bypass blocks with BessyVPN - bessy.my More
Does a VPN keep logs and what can your ISP see? An honest look at VPN privacy and anonymity. BessyConnect on VLESS+Reality keeps no browsing logs. More
What a DNS leak is and how to run a dns leak test with your VPN on. Learn to check your VPN for leaks and fix them. BessyConnect — a private, leak-free VPN. More
