> For the complete documentation index, see [llms.txt](https://docs.ipcheck.ing/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ipcheck.ing/knowledge-base/diagnose/is-my-vpn-working.md).
# Is My VPN or Proxy Working?
You turned the VPN on and the icon says "connected". That only proves the app is happy. It does not prove that every kind of traffic your computer sends is going through the tunnel.
{% hint style="success" %}
**Quick answer.** Your VPN is working when three things are true at the same time: every IP card shows the VPN's exit address, the WebRTC test shows that same address (or nothing at all), and the DNS Leak Test shows resolvers belonging to the VPN rather than to your home ISP. If any one of them shows your real network, you have a leak.
{% endhint %}
## Before you start
Do one thing first: **write down your real IP.** Turn the VPN off, open [ipcheck.ing](https://ipcheck.ing), and copy the address on the first card. Note the ISP name and the country too.
You now have a "before" picture. Every step below is a comparison against it. Without it you are guessing.
{% hint style="info" %}
MyIP can keep this record for you. **Preferences → IP History** logs the addresses it sees, in your browser only.
{% endhint %}
## The four checks
{% stepper %}
{% step %}
#### Connect, then reload the page
Turn the VPN on. Then **reload** ipcheck.ing — do not just press the refresh buttons. A full reload clears anything the page picked up before the tunnel came up.
{% endstep %}
{% step %}
#### Check the IP cards
Look at the [IP Infos](/knowledge-base/connection-tools/ip-information.md) section at the top. Each card asks a different server: "what address do you see me coming from?"
**What you want:** every card that returns an address shows the VPN's exit IP, its country, and the VPN provider's ISP or hosting name — not your home ISP.
MyIP shows two cards by default. Switch to four or six in **Preferences → Servers To Check IPs** for a stricter test: each extra card is a different destination, and so a different chance for traffic to escape the tunnel.
| Card | What it asks |
| ---------------------- | -------------------------------------------------------------------- |
| IPCheck.ing IPv4 | Your IPv4 address |
| IPCheck.ing IPv6 | Your IPv6 address (blank is fine — see below) |
| Cloudflare IPv4 / IPv6 | The same question, asked of Cloudflare's network |
| CN Source | A China-based lookup service — useful if your proxy has region rules |
| IPCheck.ing IPv6/4 | Whichever protocol your browser reaches for first |
{% hint style="warning" %}
**An empty IPv6 card is not a failure.** Many VPNs carry IPv4 only and block IPv6 outright. Blank means blocked, which is safe. An IPv6 card showing *your home ISP* is the dangerous case — see [Am I Leaking My Real IP?](/knowledge-base/diagnose/am-i-leaking-my-real-ip.md)
{% endhint %}
{% endstep %}
{% step %}
#### Check WebRTC
Scroll to the [WebRTC Leak Test](/knowledge-base/connection-tools/webrtc-test.md). WebRTC is the browser feature behind video calls. It can open its own connections that ignore normal proxy settings, so it is the classic way a real address escapes.
MyIP asks four public STUN servers what address they see. Read the four cards like this:
| Result | Meaning |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------ |
| Same IP as your VPN exit | Good. WebRTC is inside the tunnel. |
| Your real home IP | **Leak.** A site can read this with a few lines of JavaScript. |
| "WebRTC Unavailable" | Good. Your browser has WebRTC switched off, so there is nothing to leak. |
| "Connection Error" | Inconclusive. Something blocked the STUN request. Retry; if it keeps happening, treat it as neither pass nor fail. |
| {% endstep %} | |
{% step %}
#### Check DNS
Scroll to the [DNS Leak Test](/knowledge-base/connection-tools/dns-leak-test.md). Your IP can be perfectly hidden while your computer still asks *your ISP's* name servers which sites to open. Your ISP then has a list of everywhere you go.
MyIP looks up freshly generated domain names and reports which resolvers actually did the work — their exit IP, their operator, and their region.
**What you want:** resolvers belonging to your VPN provider, or to a public resolver you chose yourself, in a plausible region.
**What is bad:** your home ISP's name in the ISP field, or your home country in the Endpoint Region field.
{% hint style="info" %}
Seeing several different resolvers, or a country that is neither yours nor your VPN's, is normal. Large resolver operators run servers everywhere and pass queries between them. The signal that matters is **your own ISP**.
{% endhint %}
{% endstep %}
{% endstepper %}
## Optional: are your split-tunnel rules right?
If you use proxy software with rules — some sites through the proxy, some direct — the checks above only describe the destinations MyIP happens to use.
Open **Advanced Tools → Rule Test**. It fetches eight separate test domains, `ptest-1.ipcheck.ing` through `ptest-8.ipcheck.ing`, and shows the exit IP, ISP, and region for each one. Point each domain at a different rule in your proxy config, run the test, and you can see at a glance which rule sends traffic where.
Full instructions: [Proxy Rule Test](/knowledge-base/network-tests/proxy-rule-test.md).
## When something fails
| Symptom | Likely cause | What to do |
| ---------------------------------------------- | ----------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| IP cards still show your real IP | The VPN never actually connected, or the browser is using a system proxy that bypasses it | Disconnect, reconnect, reload the page; check the VPN app's own status |
| Some cards show the VPN, others your real IP | Split tunnelling, or proxy rules sending certain destinations direct | Check your rules with the [Rule Test](/knowledge-base/network-tests/proxy-rule-test.md), then read [Why Do Sites See a Different IP?](/knowledge-base/diagnose/why-do-sites-see-a-different-ip.md) |
| IPv6 card shows your home ISP | The VPN tunnels IPv4 only | Enable IPv6 in the VPN, or turn IPv6 off on your device — see [Am I Leaking My Real IP?](/knowledge-base/diagnose/am-i-leaking-my-real-ip.md) |
| WebRTC shows your real IP | WebRTC is bypassing the tunnel | Use the VPN's own app instead of a browser extension, or disable WebRTC — see [WebRTC Test](/knowledge-base/connection-tools/webrtc-test.md) |
| DNS Leak Test shows your ISP | Your device is still using the ISP's resolver | Turn on the VPN's own DNS, or set a public resolver by hand — see [DNS Leak Test](/knowledge-base/connection-tools/dns-leak-test.md) |
| Everything looks right, but a site still knows | Your exit IP is on a public VPN list, or your browser gives you away | See [Invisibility Test](/knowledge-base/connection-tools/invisibility-test.md) and [Browser Fingerprint](/knowledge-base/lookup-privacy/browser-fingerprint.md) |
The exit country is not the country I picked
Two ordinary explanations. First, providers move server capacity around and the geolocation databases lag behind by days or weeks — read [Why Is My IP Location Wrong?](/knowledge-base/diagnose/why-is-my-ip-location-wrong.md). Second, MyIP lets you switch database in **Preferences → IP Geolocation Database**; different vendors genuinely disagree about the same address. Try two or three before you conclude anything.
MyIP itself runs through the VPN — does that skew the test?
No, and it is worth understanding why. The page runs in your browser, so every test travels the same path your normal browsing does. That is exactly what you want to measure. If you deliberately want MyIP's own lookups to go direct while everything else is proxied, add rules for `4.ipcheck.ing` and `6.ipcheck.ing` in your proxy software.
## Still stuck?
* [Am I Leaking My Real IP?](/knowledge-base/diagnose/am-i-leaking-my-real-ip.md) — the three leak paths in detail
* [Invisibility Test](/knowledge-base/connection-tools/invisibility-test.md) — how detectable your proxy is, beyond the IP alone
* [Sharing a Diagnostic Report](/knowledge-base/getting-started/sharing-a-diagnostic-report.md) — bundle your results for a friend or an AI assistant
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.ipcheck.ing/knowledge-base/diagnose/is-my-vpn-working.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.