Culvert VPNHow to test for an IP leak
An IP leak means a site sees your real address while the VPN is on. Compare IPv4 and IPv6 with the VPN off and on, then again after a reconnect.
An IP leak is when a website sees your real address even though the VPN says it is connected. To test for one, compare the address a site sees with the VPN off and with it on, for both IPv4 and IPv6, and then repeat the comparison after the tunnel has been through a reconnect. If your real address ever appears while the app reports a connection, the VPN is leaking.
Four ways an address leaks
"IP leak" covers several different failures, and the test has to cover each one because they show up differently.
- The tunnel is not carrying traffic. The app set up the interface, the handshake never finished, and the phone either routes traffic around the dead tunnel or the app quietly gave up. Everything goes out over your normal connection.
- IPv6 goes around the tunnel. The app routes IPv4 into the tunnel and does nothing about IPv6. Every site with an IPv6 address sees your carrier's IPv6 address. This is the most common leak on modern phones and the one most tests miss. The IPv6 and VPNs post explains why it happens.
- The gap on reconnect. The tunnel drops when you walk from Wi-Fi to mobile data, and for a second or two before it comes back the phone sends traffic directly. Any connection opened in that window carries your real address.
- A browser's WebRTC code. Browsers can discover their own public address by asking a STUN server, and a web page can read the answer. This is a browser behaviour, and on Android it only affects browsers and apps that embed one. The WebRTC post covers whether it applies to you.
Running the test
- With the VPN off, open a page that reports both the IPv4 and the IPv6 address it sees. Note both, and the network name shown beside them.
- Connect the VPN and wait for the app to report that it is connected, not merely connecting.
- Reload the page. Both addresses should have changed, or the IPv6 line should be empty because the VPN blocks it. If the IPv6 address is unchanged, that is your leak.
- Switch the phone from Wi-Fi to mobile data, or the other way, with the VPN still on. Wait for it to reconnect.
- Reload the page again and compare. This catches an app that reconnects but does not re-route properly on the new network.
- Lock the phone for ten minutes, unlock it, and reload once more. This catches an app that was stopped in the background and never came back.
Do the test on both Wi-Fi and mobile data at least once, because the two networks hand out different addresses and IPv6 is far more common on mobile.
Reading the result
| Result | Meaning |
|---|---|
| IPv4 and IPv6 both changed, network name is a hosting provider | No leak |
| IPv4 changed, IPv6 blank | No leak; the VPN blocks IPv6 while connected |
| IPv4 changed, IPv6 still your carrier's | IPv6 leak |
| Neither changed | The tunnel is not carrying traffic; see how to check your VPN is working |
| Fine at first, real address after the network switch | Reconnect leak |
| Fine at first, real address after the phone slept | The app was stopped in the background |
The location shown under the address is a database guess and lags behind address reassignments. An address that changed is a pass even if the city name looks wrong.
Closing the reconnect gap
The reconnect and sleep leaks are not something a test fixes; they need the phone to refuse to send traffic outside the tunnel. Android provides that itself: Always-on VPN with "Block connections without VPN" turned on drops every packet that is not inside the tunnel, including during the seconds it takes to come back. It is in Settings under Network, then VPN, then the gear next to the app. The kill switch post explains what it does and does not cover.
For the sleep case, also exempt the app from battery optimisation, so the system does not stop the service that holds the tunnel open. Without that, a VPN that passes every test at your desk can still leak overnight.
The test page is part of the test
Every third-party "what is my IP" page you load while connected learns that someone behind this VPN address is checking their setup, and most set cookies and load trackers as they do it. That is a small thing, but it is a leak of its own, inside a test that exists to find leaks. It is also why a VPN app should do this check itself, through the tunnel, against its own server: the result is measured rather than assumed, and nobody outside the conversation learns anything.
Culvert VPN verifies the exit address through the tunnel on every connect by asking its own server rather than a third-party page, and its Settings screen reports the real state of Android's block-without-VPN setting; it is on Google Play.
Questions people also ask
Is a DNS leak the same as an IP leak?
No. An IP leak shows a website your real address. A DNS leak shows your carrier or ISP the names of the sites you look up, while the sites themselves still see the VPN's address. They are tested differently and one can happen without the other.
Can an IP leak happen on mobile data?
Yes, and IPv6 is the usual route. Most mobile carriers hand phones an IPv6 address, so a VPN that only carries IPv4 leaks it to any site that supports IPv6.
Does a kill switch stop IP leaks?
It stops the leak that happens in the gap between a tunnel dropping and coming back, which is the most common one. It does not fix a tunnel that is up but ignoring IPv6; that is the app's job.