How to Test Your VPN for IP, DNS & WebRTC Leaks

A VPN that's connected but leaking your real IP address is worse than no VPN at all — it creates a false sense of security. Three types of leaks can undercut a VPN connection without you ever knowing: IP leaks, DNS leaks, and WebRTC leaks. Each requires a different test and a different fix. This guide walks through all three.

What Is a VPN Leak?

A VPN leak occurs when your real network information is exposed to external servers or services even though a VPN is active. This can happen in several ways: the VPN client fails to route all traffic through the tunnel, your device makes DNS requests outside the tunnel, or your browser exposes your local network IP through a protocol called WebRTC.

Leaks are particularly dangerous because they're silent — the VPN appears to be connected normally, all your apps continue to work, but some of your real identity information is bypassing the tunnel and reaching servers you thought couldn't see it.

IP Address Leaks

An IP leak happens when your real IP address is visible to external services even while a VPN is connected. This can occur when:

• The VPN client fails to establish the tunnel properly but still shows "connected"
• The tunnel drops momentarily and traffic briefly reverts to the real IP (if no kill switch is active)
• IPv6 traffic bypasses an IPv4-only VPN tunnel (this is an IPv6 leak — a specific subtype; see our IPv6 Leak Protection guide for detail)
• Certain app-level requests bypass the VPN tunnel entirely due to routing misconfigurations

An IP leak is the most obvious failure mode: the VPN is supposed to replace your IP with the server's IP, and if it hasn't done that, the primary purpose of the VPN is unmet.

DNS Leaks

DNS (Domain Name System) translates domain names like carrotvpn.com into IP addresses. When you visit a website, your device makes a DNS request. If that request goes to your ISP's DNS servers instead of through the VPN tunnel, your ISP can see a complete log of every domain you visit — even if the actual page content is encrypted by HTTPS.

DNS leaks are surprisingly common because operating systems and VPN clients have multiple DNS resolution pathways. Even a well-configured VPN can fail to redirect DNS if the system DNS is set to a specific server that bypasses the tunnel, or if split tunneling is misconfigured.

The result: your ISP gets a browsing history even though your VPN is "on." All the sites you visit, at what times, are visible to them through DNS queries even if the content of those visits is encrypted.

WebRTC Leaks

WebRTC is a browser API used for peer-to-peer communication — video calls, voice chat, file sharing between browsers. To establish direct connections, WebRTC exchanges IP addresses between peers using a protocol called ICE (Interactive Connectivity Establishment). This process can reveal your local network IP and, in some implementations, your real public IP even when a VPN is active.

WebRTC leaks are browser-specific and are most commonly an issue in desktop browsers (Chrome, Firefox, Edge) rather than Android apps. However, if you use a browser on Android (including Chrome for Android), WebRTC may still be a factor depending on which sites you visit and whether they initiate WebRTC connections.

How to Run a Leak Test: Step by Step

1. Disconnect your VPN and note your real IP address by visiting any "what is my IP" site in your browser
2. Reconnect your VPN and wait for it to confirm a stable connection
3. Visit a VPN leak testing site — search for "VPN leak test" and use a reputable result that shows IP, DNS, and WebRTC results simultaneously
4. Check all three sections: the displayed IP address, the DNS server list, and the WebRTC IP (if shown)
5. Compare against your real IP from step 1 — none of the results should match
6. Repeat on different networks if you use the VPN across multiple connection types (home WiFi, mobile data, public WiFi)

Interpreting Your Results

Good result: no leaks

Bad result: leak detected

How to Fix Each Leak Type

Fixing IP Leaks

• Ensure your VPN app is up to date; reconnect and retest
• Enable the kill switch in your VPN settings to prevent traffic from flowing outside the tunnel if the VPN drops
• Check for IPv6 leaks specifically and ensure your VPN handles IPv6 (blocks or tunnels it) — see our IPv6 leak guide

Fixing DNS Leaks

• In your VPN app settings, look for "DNS leak protection" or "custom DNS" options and enable them
• Avoid manually setting a specific DNS server in Android network settings that might override the VPN's DNS routing
• On Android, set the VPN's "Always-on VPN" option in system settings to prevent network access without the VPN

Fixing WebRTC Leaks

• In Chrome for Android: go to chrome://flags and search for WebRTC — disable "WebRTC IP handling policy" non-proxied UDP
• In Firefox for Android: navigate to about:config and set media.peerconnection.enabled to false
• Alternatively, install a browser extension that blocks WebRTC if using a desktop browser

CarrotVPN's Leak Protection

After enabling CarrotVPN and running a leak test, you should see only our server's IP in the IP section, CarrotVPN's DNS resolvers in the DNS section, and no real IP in any WebRTC field. If you see anything unexpected, disconnect and reconnect, then retest.