A leak test you can run twice

Write down the disconnected result first. The connected result only means something next to that baseline.

A VPN client can say Connected while the browser still uses the network you had before. The test is a comparison, not a screenshot of a status icon.

Disconnect the VPN. Open the public IP check and note the address, the DNS resolver name, and whether an IPv6 address is listed. Run the same IP check from a terminal on that computer:

curl -s https://rookvpn.com/check/api/ip/address

The browser and the terminal should agree while you are disconnected. If they do not, you already have two paths, and the VPN test will be hard to read.

Connect the VPN. Reload the leak test. Pass, for this step, means the public IP changed to the exit you selected. Fail means the IP is unchanged. Do not change browser settings yet. Repeat the curl command. If the browser changed and curl did not, the tunnel is only a proxy for the browser.

Then read WebRTC candidates and IPv6. A new HTTP IP with the old home address still listed in WebRTC is not a pass. An IPv6 address from the ISP, next to an IPv4 VPN exit, is not a pass. DNS should be the resolver your VPN claims to use. An ISP resolver name is a fail only after you compare it to that claim. One public resolver is not automatically a leak.

Run the connected check a second time without changing settings. If the two runs disagree, something else changed: a second VPN profile, a browser extension, or a network handoff. Fix that before you publish the first result.

The long version of the same workflow is the VPN leak testing guide. The browser tool is the VPN leak test.