Types of VPN Leaks
Three leak types expose your real identity even when a VPN is active. IP leak: your real IP address is visible to websites instead of the VPN server IP. DNS leak: your DNS queries go to your ISP's DNS server instead of the VPN's, revealing which sites you visit. WebRTC leak: your browser's WebRTC protocol reveals your real IP even when the VPN is connected, because WebRTC bypasses the VPN tunnel on some systems.
How to Test
With your VPN connected, visit ipleak.net or browserleaks.com. These sites show your visible IP, your DNS servers, and any WebRTC-exposed IPs. Your visible IP should match your VPN server's IP. Your DNS servers should be operated by your VPN provider or a third-party privacy DNS (1.1.1.1, 9.9.9.9), not your ISP. WebRTC should show no IPs or only the VPN IP.
Fixing DNS Leaks
Most VPN clients have a DNS leak protection setting: enable it. If leaks persist, manually set your DNS to your VPN provider's DNS servers in your network settings. On Windows, this is in Network Settings > Adapter Options > IPv4 Properties. On macOS: System Preferences > Network > Advanced > DNS.
Fixing WebRTC Leaks
WebRTC leaks are browser-specific. In Firefox, set media.peerconnection.enabled to false in about:config. In Chrome, install the uBlock Origin extension and enable WebRTC leak prevention in its settings. In Safari, WebRTC is partially disabled by default. Test again after any change to confirm the fix worked.