# How to check if your VPN is working

Compare public IP, DNS and WebRTC observations, then test the app you use. Learn what each result establishes and what to investigate next.

Website: https://zenshield.com/learn/check-vpn-working

Canonical URL: https://zenshield.com/learn/check-vpn-working

Page reviewed: 2026-09-12

Start with the VPN app’s connection status, then check the public IP visible from your browser. A changed IP is useful evidence for that browser request. It does not prove that every app, DNS lookup or IPv6 connection follows the same route.

## Make a before-and-after comparison

1. Use a network you are allowed to manage. Close sensitive work before deliberately disconnecting a VPN. Keep a required workplace VPN connected and ask your administrator instead.
2. Open [What is my IP?](https://zenshield.com/tools/what-is-my-ip) and run a check. Note the address and network name. You do not need to publish or send this information to anyone.
3. Connect in the VPN app and wait for its connected status. Refresh the same IP tool in the same browser. Keep Wi-Fi or mobile data unchanged between checks.
4. Compare the two addresses. If the second belongs to the expected VPN route, that supports the app’s status for this request. If it is unchanged, check whether the browser is excluded from the VPN, whether another proxy is active, and whether the app actually connected.

The location label is approximate. A city mismatch can come from an outdated geolocation database or the network operator’s routing. It does not automatically mean the VPN selected the wrong server.

## Use the test that answers your question

| Question | Check | What to do with the result |
| --- | --- | --- |
| Which public address does this browser show? | [IP lookup](https://zenshield.com/tools/what-is-my-ip) | Compare the same address family before and after connecting |
| Which resolvers receive browser lookups? | [DNS test](https://zenshield.com/tools/dns-leak-test) | Compare resolver operators with your intended DNS configuration |
| Does WebRTC reveal another address? | [WebRTC check](https://zenshield.com/tools/webrtc-leak-test) | Investigate unexpected public addresses; local addresses have a different role |
| Does my everyday app work? | Open that app and complete a normal task | A browser check cannot establish the route taken by another app |

## If the DNS result looks unexpected

Run the same test before and after connecting. Browser Secure DNS, device DNS settings and VPN configuration can affect which resolver is observed. A public resolver name is not enough to declare a leak. Check whether you deliberately chose that resolver, then compare the behavior with your VPN provider’s instructions. Do not change several settings at once: you will lose the ability to tell which change mattered.

## If WebRTC shows no address

The check collects addresses offered by your browser for a possible real-time connection. It does not start a call or ask for microphone access. Browser privacy controls, blocked STUN traffic or unsupported WebRTC can prevent numeric results. An empty result is inconclusive, not a certificate that your device is protected.

## Finish with a practical test

Load a familiar HTTPS website, then try the task that brought you to the VPN: a work call, ordinary browsing or another permitted activity. If one service fails while others work, follow [one website not working with a VPN](https://zenshield.com/help/vpn-one-website-not-working). If everything stops loading, use [VPN connected but no internet](https://zenshield.com/help/vpn-connected-no-internet).

Record the app version, time, network type and exact symptom before contacting support. Send only the details needed to reproduce the problem. Never include passwords, session tokens or your browsing history.

## Sources
- https://www.dnsleaktest.com/
- https://developer.mozilla.org/en-US/docs/Web/API/RTCPeerConnection/icecandidate_event
- https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Transport_Layer_Security