VPN IP leaks and the kill switch
IPv6, DNS, and WebRTC can still show your real IP. Test the tunnel, then block the fallback.
A VPN is supposed to hide your real public IP and encrypt the path to a server you chose. An IP leak is when some of your traffic still uses the ISP address. A kill switch is the setting that blocks the internet if the tunnel drops, instead of silently exposing you. If you care about hide my IP, public WiFi, or IP geolocation tests, these two features matter more than the marketing map of 90 countries.
Common leak types
IPv6 leak: the VPN covers IPv4, IPv6 goes native. WebRTC leak: the browser asks STUN servers and reveals a local or public address on a page. DNS leak: name lookups skip the tunnel and hit the ISP resolver. Split tunnel leak: you excluded an app and forgot it.
Any of those can make an IP lookup show your home ISP while you believe you are in another country.
How to test for leaks
Note IPv4, IPv6, city, and ISP with the VPN off. Connect. Reload. All of them should change. Visit a WebRTC check if you use the browser for sensitive work. Confirm DNS is the VPN’s resolver, not the café.
If IPv6 still shows the carrier, enable IPv6 leak protection or disable IPv6 on that network adapter. If WebRTC still shows the old IP, disable WebRTC or use the provider’s browser extension only as extra hardening. The system VPN should still be on.
What a kill switch does
When the VPN process crashes or the WiFi hops, traffic can fall back to the raw network for a few seconds. That is enough to publish your real IP to a swarm, a login, or an IP tracker. The kill switch firewalls everything except the tunnel.
Turn it on for travel WiFi and for anything you would not do on an open hotspot. Turn it off only if you understand that a dropped VPN means a dropped mask.
Setup that actually holds
- Official app, not a random “free IP changer.”
- Kill switch enabled. IPv6 handled. DNS inside the tunnel.
- Recheck your public IP after every OS update.
- Do not mix a work VPN and a personal VPN on the same interface unless IT said so.
A VPN without a leak test is a hope. Check the IP, check it again, and let the kill switch be boring.