A VPN is passing a leak test only when your connected tests show the VPN server’s public address and DNS resolvers—not the address, resolver identity, or IPv6 connection you recorded with the VPN off. Test this with a controlled two-round comparison on the same device and browser: record the results without the VPN, connect it, repeat the checks, then test WebRTC, IPv6, split tunneling, and network changes.
A client can display “Connected” while traffic still reaches an ISP resolver, a browser WebRTC API, or an unprotected IPv6 interface. The procedure below separates those failure modes and gives you a retestable pass/fail record.
As an Amazon Associate I earn from qualifying purchases.
What a VPN leak exposes
A VPN leak occurs when information that should travel through the encrypted tunnel instead goes directly to your internet provider or another network interface. The exposed information can be an address, a DNS query, or browser network metadata.
- Public IP leak: A website sees the public IPv4 address assigned by your ISP instead of the VPN server’s exit address.
- DNS leak: Domain lookups are handled by your ISP’s resolvers, or another resolver outside the VPN, even though other traffic uses the tunnel.
- IPv6 leak: Your device sends IPv6 traffic outside an IPv4-only VPN tunnel. AMTSO’s 2025 guidance notes that IPv6 traffic cannot remain encrypted by an IPv4-only connection.
- WebRTC leak: Browser WebRTC functions reveal a public address that matches your VPN-off baseline. A private local address such as
192.168.x.xis normally a LAN detail, not the ISP address that identifies your connection publicly. - Split-tunnel exposure: Applications or destinations excluded from the tunnel continue to use the ISP route by design or because of a configuration error.
The useful question is not whether an icon says “connected.” It is whether every address and resolver visible in the connected state belongs to the VPN path you selected.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Prepare a controlled test
Use one device, one browser, and one network connection for the initial comparison. Changing several variables at once makes a result difficult to interpret.
Record the VPN-off baseline
Disconnect the VPN completely. On an IP-checking page, record the public IPv4 address, any public IPv6 address, the apparent provider and country, and the time. On a DNS-leak page, record every resolver organization and location shown. Save a screenshot or copy the result so you can compare exact values later.
Keep the browser and applications consistent
Use the browser in which you normally browse when running the WebRTC test. A terminal lookup can confirm some routing and DNS behavior, but it cannot reproduce every browser WebRTC path. Close or note applications that use their own networking stack, and write down any split-tunnel exclusions configured in the VPN client.
Understand what the test can and cannot prove
A clean result describes the tested device, browser, network, VPN server, and settings at that moment. It does not prove that another browser, an excluded application, or a different server behaves identically. AMTSO recommends documenting configuration differences and test methods for that reason.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
Run the two-round leak test
- Test with the VPN disconnected. Open the IP checker and DNS test in the same browser you will use later. Record the public IPv4, public IPv6 if present, provider or ISP, country, and resolver names. This is your comparison baseline.
- Connect one VPN server. Wait until the client reports a completed connection, then confirm that the operating system has not fallen back to another interface. Do not start by changing browsers or networks.
- Repeat the IP check. The public address should change to the VPN server’s exit address. If the exact VPN-off address remains, investigate a failed route, split tunneling, a client configuration error, or a connection that did not complete. ExpressVPN’s documented comparison uses this same disconnect, record, reconnect, and repeat method; seeing a baseline public address again indicates a leak.
- Repeat the DNS test while connected. Inspect the organizations and locations of all resolvers, not merely the number of results. The VPN’s documented resolvers or a resolver associated with its path should appear. An ISP resolver appearing during the connected test means DNS requests are bypassing the tunnel. FortiSafe defines a leak as traffic leaving the tunnel and revealing the internet provider.
- Run the WebRTC test in the normal browser. Compare every public WebRTC address with the VPN-off record. A repeated public baseline address is an exposure. A private LAN address such as
192.168.x.xis reused inside local networks and is not the public ISP address by itself. - Check IPv6 separately. If the VPN-off baseline contained an IPv6 address, reconnect and verify that no ISP IPv6 address or other IPv6 traffic appears outside the VPN path. A connected result may show no IPv6 at all, or an IPv6 address belonging to the VPN service; either is different from silently exposing the baseline IPv6 connection. If your baseline had no IPv6, repeat the check on a network that provides it before declaring IPv6 protection proven.
- Compare browser and non-browser traffic. Perform a DNS or address lookup from a terminal as a second view, while remembering that command-line results do not test all browser WebRTC behavior. If the browser and terminal disagree, treat the difference as a configuration lead rather than averaging the results.
- Repeat after changing conditions. Change to another VPN server, switch Wi-Fi access points, and move between Wi-Fi and mobile data. Run the address, DNS, WebRTC, and IPv6 checks after each transition. AMTSO specifically calls for testing server changes, hotspot changes, Wi-Fi-to-mobile handoffs, unexpected split-tunnel exclusions, and all connection states.
How to classify the result
| Observed while connected | Meaning | Result |
|---|---|---|
| Only the VPN exit IPv4 and VPN-associated DNS resolvers | The tested public traffic and DNS appear to follow the tunnel. | Pass for those checks |
| Your VPN-off public IPv4 appears again | The public route did not move fully to the VPN. | Fail |
| Your ISP’s resolver organization or hostname appears | DNS queries are leaving through an ISP or other non-VPN path. | Fail |
| Your VPN-off public IPv6 appears | IPv6 is bypassing an IPv4-only or incorrectly configured tunnel. | Fail |
| Your VPN-off public WebRTC address appears | The browser is exposing a public address through WebRTC. | Fail |
Only a private LAN address, such as 192.168.x.x, appears in WebRTC |
This is a local-network address, not the ISP-assigned public address. | Not automatically a fail |
| Browser shows the VPN path but an excluded application shows the ISP path | Split tunneling is applying to that application or destination. | Expected only if deliberately configured; otherwise fail for that app |
Do not judge a DNS test by geography alone. A resolver may be operated by a VPN service in a different city or country from the server you selected. Identify the organization and compare it with the VPN’s published DNS design or the client’s documented setting.
Diagnose each leak type
Public IP remains unchanged
First verify that the client completed the connection rather than merely starting it. Then inspect split-tunnel rules, per-application exclusions, and routing settings. Test a second VPN server. If every server leaves the same public address visible, the problem is likely the client route or the operating system interface rather than one server.
ISP DNS appears
DNS can bypass an otherwise working tunnel when the operating system keeps the original resolver, when split DNS is enabled, or when an application uses its own resolver. Check whether the client offers a setting labelled “Use VPN DNS,” “DNS leak protection,” or equivalent, and whether split DNS can be disabled. Reconnect after changing the setting and run the complete DNS test again.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWebRTC reveals the baseline address
WebRTC is a browser feature, so a clean terminal result does not clear it. Disable WebRTC using the browser’s supported privacy controls or install a reputable WebRTC-blocking extension. Apply the change in every browser used for sensitive browsing, then repeat the test; a control applied to one browser does not automatically affect another.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
IPv6 bypasses the tunnel
If the VPN cannot carry IPv6 end to end, the operating system may continue using its native IPv6 interface. Disable IPv6 at the operating-system level only when that is an acceptable workaround for your network, or choose a service that explicitly supports IPv6 through the tunnel. After either change, verify both IPv4 and IPv6 again rather than assuming that an IPv4 address change solved the problem.
Leaks occur only during reconnection
A steady-state test can pass while a server switch or network handoff briefly sends packets over the ISP interface. Enable the client’s kill switch or fail-closed option if available. Then repeat server changes, Wi-Fi changes, and Wi-Fi-to-mobile transitions while checking that no baseline address or resolver appears during the interruption and reconnection.
Test transitions and split tunneling deliberately
Use a written matrix so that a passing result is not limited to one ideal connection:
| Scenario | What to do | What must not appear |
|---|---|---|
| Initial connection | Connect from the original Wi-Fi and run all checks. | VPN-off IPv4, ISP DNS, baseline IPv6, or baseline WebRTC address |
| VPN server change | Switch servers without closing the client; test during and after reconnection. | Unprotected packets or the old ISP identity during the handoff |
| Wi-Fi access-point change | Move to another hotspot and reconnect. | ISP baseline information outside the tunnel |
| Wi-Fi to mobile data | Disable Wi-Fi, enable mobile data, and repeat the checks. | Native mobile or previous ISP details when the VPN is meant to remain active |
| Split-tunnel exclusion | Test an excluded application and then remove the exclusion for comparison. | Unexpected ISP routing from an application that should be protected |
AMTSO’s 2025 guidance describes DNS, IP, and packet leaks as problems that can occur in all connection states and network environments, including the transitions between them. A kill switch that works only after a new tunnel is established is not the same as a fail-closed policy during the gap.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
What to change, then retest
- For WebRTC: apply the browser’s WebRTC privacy control or a reputable blocking extension in every browser you use. Re-run the connected WebRTC test and compare it with the original public baseline.
- For DNS: turn on the VPN client’s DNS-leak-protection or “Use VPN DNS” option, and disable split DNS when the client allows it. Reconnect before testing; a setting change made during an existing session may not replace the resolver immediately.
- For IPv6: either use a VPN with end-to-end IPv6 support or disable IPv6 at the operating-system level as a deliberate workaround. Check for both an IPv6 address and IPv6 DNS results afterward.
- For transitions: enable a kill switch or fail-closed mode, then repeat server and network-change scenarios. Confirm that applications cannot fall back to the ISP interface while the VPN is reconnecting.
- For application differences: review split-tunnel and per-app rules. Test the application itself, not only a browser, and remove exclusions that were not intentional.
Choosing a VPN by its leak-test behavior
When comparing services, use observed behavior and documented controls rather than the connection badge. Record the following for each service and server:
- Which DNS resolvers appear, whether the client forces VPN DNS, and how split DNS is handled.
- Whether IPv6 is tunneled, blocked, or left to the operating system.
- What browser WebRTC protection is provided and whether it requires a separate browser setting.
- How split tunneling is configured and whether exclusions are per application or per destination.
- Whether the kill switch remains fail-closed during server changes, Wi-Fi changes, and mobile-data handoffs.
- Whether browser, terminal, and non-browser application traffic follow the same tunnel.
Run identical tests on the same device and network for a meaningful comparison. AMTSO recommends disclosing configuration differences and test methods because a result from one setup is not a universal score for a service.
Limits, privacy precautions, and evidence
Leak-test pages can see the address and resolver information your browser sends to them. Use a test service you trust, avoid entering account credentials, and do not treat a screenshot as proof that every application is protected. Keep the date, server, network type, client version, browser, and settings with each record so a later change can be reproduced.
BrowserLeaks’ DNS test, as described by FortiSafe in 2026, resolves 50 random names: 25 IPv4-only and 25 IPv6-only. That number describes the test design, not a failure rate for VPNs. The available guidance provides procedures and interpretations, but it does not establish a reliable percentage of consumer VPNs that leak. Any prevalence claim would require a separate primary study.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
FAQ
How often should I repeat a leak test?
Repeat it after installing or updating the VPN client, changing browsers, enabling split tunneling, changing networks, or switching to a new operating system. A scheduled monthly check is useful for people who regularly move between home, public Wi-Fi, and mobile data, but the important trigger is a configuration or network change.
Why can two DNS tests show different resolver lists?
Resolvers can rotate, use different addresses for IPv4 and IPv6, or answer from different regional locations. Compare the organizations and the VPN-off baseline, and run the same test more than once before treating a single transient entry as conclusive.
Does a clean browser test protect a desktop application?
No. An application can have its own DNS, proxy, or split-tunnel rule. Test the application’s traffic separately and compare it with the browser and terminal results on the same connection.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What should I save when reporting a suspected leak?
Save the VPN server and protocol shown by the client, connection type, operating system, browser, split-tunnel and kill-switch settings, VPN-off baseline, connected results, and the exact transition that reproduced the exposure. This lets support distinguish a DNS, route, WebRTC, IPv6, or handoff failure.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
