VPN Leak Testing Guide

Learn how to detect WebRTC, DNS, and IPv6 leaks that can expose your real IP even when a VPN is connected.

This guide walks through a repeatable VPN leak testing workflow using curl, a small open-source CLI helper, and the browser-based RookCheck suite. You can run every step without installing RookVPN — these tools work with any VPN provider.

Why VPN leak tests matter

A VPN encrypts traffic between your device and an exit server, but leaks occur when metadata or parallel network paths bypass the tunnel. The three most common leak types are WebRTC (browser STUN queries revealing local and public IPs), DNS (queries to your ISP resolver instead of the VPN), and IPv6 (traffic routed outside the tunnel when IPv6 is enabled but not tunneled).

A VPN can show “Connected” while still exposing your identity to websites, DNS logs, or peer-to-peer APIs. Leak testing is the only way to verify that your real ISP IP, DNS resolver, and browser metadata stay hidden.

Step 1: Baseline IP check (VPN off)

Disconnect your VPN and record your public IP. Use curl against the RookCheck API or the rookvpn-leak-test CLI script:

curl -s https://rookvpn.com/check/api/ip/address

Or run the helper script (bash + curl; jq optional):

git clone https://github.com/mktwix/rookvpn-leak-test.git
cd rookvpn-leak-test && ./leak-test.sh

You can also use the in-browser IP checker to compare curl output with browser-reported IP, headers, and geolocation.

Step 2: Connect VPN and re-test

Connect your VPN client and run the same curl command or script again. The visible IP should change to your VPN exit location — typically a datacenter in another city or country. If the IP is unchanged, HTTP traffic is not traversing the tunnel (split tunneling, failed route, or client misconfiguration).

Note the new IP and country. You will compare all later browser tests against this exit IP only — any appearance of your baseline ISP IP is a leak.

Step 3: Browser leak tests (WebRTC, DNS, IPv6)

Curl and terminal scripts cannot detect WebRTC or full DNS behavior inside the browser. With VPN still connected, open each RookCheck page:

• WebRTC leak test — detects STUN/ICE leaks that expose local LAN and ISP IPs to JavaScript
• DNS leak test — shows which DNS resolvers answer queries from your system
• IPv6 leak test — confirms IPv6 traffic is tunneled or disabled

Run tests in the same browser you use daily. Privacy browsers (Brave, Firefox with resist fingerprinting) may block WebRTC by default and show different results than Chrome.

Interpreting results

Pass: only your VPN exit IP and VPN DNS resolvers appear across all tests. WebRTC shows no local ISP or LAN addresses. IPv6 is either absent or matches the VPN path.

Fail: your ISP IP, home LAN address (192.168.x.x, 10.x.x.x), or ISP DNS hostname appears alongside or instead of the VPN values.

Common fixes

• WebRTC: disable WebRTC in browser settings, use uBlock or a WebRTC-blocking extension, or pick a VPN client that forces WebRTC through the tunnel.
• DNS: enable “Use VPN DNS” or disable split DNS in the VPN app; on Linux check systemd-resolved and NetworkManager.
• IPv6: disable IPv6 at OS level, or use a VPN that supports IPv6 tunneling end-to-end.

Terminal vs browser on the same machine

Split tunneling routes some apps through the VPN and others through your ISP. Mobile OS profiles often tunnel browser traffic but leave terminal/curl on the local interface. Always compare curl and browser results on the same device when auditing VPN coverage. See also Check Public IP via Curl and RookCurl VPN leak example.

Related tools

rookvpn-leak-test (MIT) — CLI IP check step for scripts and CI. RookCheck — full browser suite. rookvpn.com/free — free VPN profiles for testing. Setup guide — Hiddify import walkthrough.