KotoVPN

Guide · Updated August 13, 2026

How to check your VPN is actually working

How do I test whether my VPN is doing anything?

Short answer

Four checks, in this order: confirm the address changed, confirm DNS lookups go to the provider’s resolver rather than your ISP’s, confirm no IPv6 address is exposed, and confirm traffic stops when the tunnel is killed. The last one is the one almost nobody runs and the one that matters most, because it tests the failure mode rather than the working state.

Check the address changed

Load any address-reporting site with the VPN off and note what it says. Connect and reload. The address and the reported country should both change. If the address changed but the country did not, you may be on a virtual location where the hardware sits elsewhere.

This is the check everyone runs and it proves the least. An address change confirms traffic is being routed somewhere else. It says nothing about DNS, IPv6, or what happens when the tunnel drops.

Check DNS is not leaking

A DNS leak means your device asks your ISP’s resolver which address a domain lives at, then connects through the tunnel. Your ISP cannot read the encrypted traffic, but it has the full list of every site you asked about — which is usually enough.

Use a DNS leak test page while connected. Every resolver listed should belong to your VPN provider. If your ISP’s name appears, the tunnel is carrying traffic but not lookups. On Windows this is common enough to be worth checking after every major update, because the resolver behaviour can query multiple interfaces simultaneously.

Check IPv6 is handled

If your connection has IPv6 and the tunnel carries only IPv4, IPv6-capable sites see your real address directly. The tunnel is working and irrelevant for those sites.

A leak test that reports an IPv6 address while connected means the client is not handling it. Two fixes are acceptable: the provider carries IPv6 inside the tunnel, or the client blocks IPv6 at the interface. Check the client settings for an IPv6 option before assuming it is broken.

Kill the tunnel and watch what happens

This is the test that separates a working kill switch from an advertised one. Do not click disconnect — a graceful disconnect is not the failure you need covered.

Start a continuous download or a ping to a remote host. Then terminate the VPN process from the task manager or with kill. If traffic continues, the kill switch is application-level and depends on the app still running to notice a failure. If traffic stops immediately, the switch installs firewall rules that survive the process dying, which is what you want.

Avoid

  • Testing by clicking disconnect, which every implementation handles correctly
  • Assuming the switch is on by default — on several clients it is not
  • Testing once and never again; client updates have reintroduced leaks before

Questions

How often should I re-test?
After every VPN client update, after every major operating-system update, and whenever you change networks in a way that matters to you. Leaks have been reintroduced by client updates more than once across the industry.
My VPN says connected but sites still know my country. Why?
Address is only one signal. Services also use your account region, payment country, browser locale, timezone and language headers. A correct address is necessary but not sufficient, which is why no honest review promises a specific service will work.
Does a WebRTC leak mean my VPN is broken?
No. WebRTC leaks happen in the browser, above the tunnel, so they are not a VPN failure. They are fixed with a browser extension or by disabling the peer-connection API, not by changing provider.

Terms used here

DNS leak

When name lookups travel to your ISP’s resolver instead of through the tunnel, exposing every domain you visit.

IPv6 leak

When a tunnel carries only IPv4 while your connection also has IPv6, so IPv6-capable sites see your real address.

WebRTC leak

When a browser exposes your local or real address through the peer-connection API, independently of the VPN tunnel.

Kill switch

A control that blocks all internet traffic if the VPN tunnel drops, rather than letting it fall back to your normal connection.

Related