EasyGeoIP guide · Published July 24, 2026
How to check if your VPN is actually working
A connected icon is not proof that every connection leaves through the VPN. A useful test checks the public address, network owner, IPv6 path, browser exposure, and the result before and after the tunnel starts.
Run the live VPN testStart with a clean before-and-after comparison
Open EasyGeoIP before connecting the VPN and save the displayed result as your local baseline. The baseline stays in your browser. Record the public IP, protocol, country, autonomous system number, and network organization. Then connect the VPN, wait for the tunnel to settle, and reload the page.
A working full-tunnel VPN should normally change the public IP and network organization. A country change is optional: you may deliberately choose a server in your own country. If the IP remains identical, traffic probably did not enter the tunnel, split tunneling excluded the browser, or a browser extension is using a different route.
Check IPv4 and IPv6 separately
Many connections have both IPv4 and IPv6. A VPN may carry IPv4 correctly while leaving IPv6 outside the tunnel. That produces an IPv6 leak: websites can still receive an address issued by the original internet provider even though the visible IPv4 belongs to the VPN.
If the diagnostic reports an IPv6 connection, compare its network organization with the expected VPN provider. If your VPN does not support IPv6, a safe configuration usually disables external IPv6 connectivity while the tunnel is active instead of silently sending it outside the tunnel.
Interpret VPN detection carefully
Detection and tunnel operation are different questions. A VPN can work even when a database does not recognize its exit address. New servers, rented residential ranges, dedicated addresses, and small providers are often absent from free lists. Conversely, a cloud server may be labelled as hosting without proving that it carries VPN traffic.
EasyGeoIP reports the evidence behind a verdict. An exact match in an official relay list is strong evidence. A hosting ASN is only context. Reverse-DNS terms such as vpn or wireguard are supporting clues, not definitive proof. No evidence means that the free sources did not find a positive signal; it never means that a VPN is impossible.
Run the browser leak checks
WebRTC can expose network candidates to a page while browsers negotiate real-time connections. Modern browsers often replace local addresses with temporary mDNS names, which is a privacy improvement. The important warning is a public address that differs from the VPN-facing address shown by the server.
DNS leaks require a controlled authoritative DNS endpoint because the test must observe which resolver asks for a unique hostname. EasyGeoIP does not claim to perform that test without the required infrastructure. Use your VPN provider's leak tool or another service whose data handling you trust.
Investigate a failed result
Reconnect the VPN, change server, disable split tunneling for the browser, and test again in a private window. Check whether a browser proxy extension overrides the system tunnel. On mobile devices, switch between Wi-Fi and cellular data only after the VPN reports that the tunnel has reconnected.
If the original ISP still appears over IPv6, disable IPv6 temporarily or enable the VPN's IPv6 protection. If the public address changes correctly but websites still know your account or location, remember that cookies, logins, device characteristics, and location permission are separate from the IP address.