Culvert VPNHow to check your VPN is working
Compare the IP address a website sees before and after you connect; if it changes to the server's address and DNS follows, the VPN is working.
A VPN is working when the public IP address that websites see is the VPN server's address instead of your own, and when that change is observed through the tunnel rather than assumed. The test takes a minute: note the address a site sees with the VPN off, connect, and check again. If the address has changed to the server's, your traffic is going through it. If it has not, the VPN is not working, whatever its status icon says.
The one test that matters
Everything a VPN does follows from one fact: your connections leave from the server's address instead of yours. So the check is to look at that address from the outside.
- With the VPN off, open a page that reports the IP address it sees, and note the address and the network name next to it. The network name will be your mobile carrier or the ISP behind the Wi-Fi.
- Connect the VPN and wait until the app reports a connection, not just "connecting".
- Reload the page. The address should be different, and the network name should now be a hosting provider rather than your carrier.
- Open one more site, any site, to confirm ordinary browsing works through the tunnel.
If step 3 shows the same address as step 1, stop there. The tunnel is not carrying your traffic, and nothing else on this list will change that.
The location shown next to the address is a guess made from a database, and those databases lag. A server in Roubaix can be listed under the wrong city for weeks after its address is assigned. Treat the change in address as the evidence, not the city name under it.
Why the status icon is not enough
Android shows the key icon in the status bar as soon as a VPN app has been given the tunnel interface. That happens before the app has finished its handshake with the server, and it stays on even if that handshake never completes. A tunnel that was set up and then blocked by the network looks identical in the status bar to one that is working.
This is the situation behind most "connected but no internet" reports: the interface exists, so the phone routes everything into it, but nothing comes back out the far end. The post on VPN connected but no internet goes through why that happens and what fixes it.
A good app checks this for you. After the tunnel is up it should ask a server, through the tunnel, what address the request arrived from, and only report a connection once it gets an answer. An app that prints the address it intended to use is showing you a label, not a measurement.
Check DNS as well
Your IP address can change while your DNS lookups still go to your carrier's resolver. That is a DNS leak, and it lets the carrier see every site name you look up even though the page contents are inside the tunnel. A DNS leak test page works differently from an IP page: it makes your browser look up unique hostnames and reports which resolver asked for them. If the resolver belongs to your carrier or ISP rather than the VPN, DNS is leaking. The steps are in how to run a DNS leak test on Android.
Check IPv6 as well
Many mobile networks give phones an IPv6 address alongside the IPv4 one. If the VPN only routes IPv4, a site reachable over IPv6 sees your real address while everything else goes through the tunnel. The IP page you used in the first test may only show one of the two, so use one that reports both, or check specifically for IPv6. A VPN that handles this either carries IPv6 inside the tunnel or blocks it while connected; both are fine. Showing your carrier's IPv6 address while connected is not.
The check itself has a cost
Every time you load a third-party "what is my IP" page while connected, that page learns that a user behind this particular VPN address just checked it, and it usually sets a cookie and loads a few trackers while it is at it. That is a small leak, but it is a leak inside a test that is meant to find leaks.
The better design is for the VPN app to ask its own server what address it saw, through the tunnel, and show that on the connect screen. The address the server saw and the address it was expected to see come from two different places, so the comparison means something, and no third party is told anything. The reasoning is laid out in why a VPN should verify its own exit IP.
When the check fails
| What you see | What it means | What to do |
|---|---|---|
| Same address with the VPN on | The tunnel is not carrying traffic | Disconnect, switch between Wi-Fi and mobile data, reconnect |
| Address changed, pages will not load | Traffic goes in, nothing comes back; often DNS | See the connected-but-no-internet post |
| Address changed, DNS test shows your carrier | DNS leak | Check Private DNS settings and the app's DNS handling |
| IPv4 changed, IPv6 is your carrier's | IPv6 leak | Use an app that routes or blocks IPv6 |
| Address changed but the city looks wrong | Location database lag | Nothing; the address is what matters |
Repeat it when the network changes
A tunnel that worked on your home Wi-Fi can come back up on the office network without actually carrying anything, because the office filters the port the app used the first time. The moments to re-check are a new Wi-Fi network, a switch from Wi-Fi to mobile data, and the first minute after the phone wakes from a long sleep. If you want the phone to refuse to send anything outside the tunnel during those moments, Android's own Block connections without VPN setting does that at the system level.
Culvert VPN runs this check on every connect and shows the result on the connect screen as your IP address, verified through the tunnel by asking its own server rather than a third-party page, and it is on Google Play.
Questions people also ask
The key icon is showing. Does that mean the VPN is working?
It means Android has handed the app the tunnel interface, not that traffic is flowing through it. A tunnel whose handshake never finished shows the same icon, so check the exit IP rather than the icon.
How often should I check?
Whenever the network changes, so a new Wi-Fi, a switch to mobile data, or a reconnect after the phone slept. Those are the moments a tunnel can come back without carrying anything.
My IP changed but the location is wrong. Is it working?
Probably yes. IP-to-location databases lag behind address reassignments, so a server in Amsterdam can be listed as somewhere else for weeks. The address changing is the evidence; the city name under it is a guess.