What Are VPN Leaks, and How Do You Fix Them?

A ‘VPN leak’ refers to a security flaw that allows your IP address, DNS requests, or other identifying information to be revealed to any third party monitoring your internet connection.

VPN software is primarily designed to hide your public IP address and encrypt your web traffic by rerouting it through a secure tunnel to a remote server. When your VPN leaks, some or all of this sensitive information passes outside of the encrypted tunnel.

If your real IP address or DNS requests are leaking, your ISP can still see your browsing activity and any websites you visit can see your real IP address. Your privacy is not protected, and your identity is exposed, making the VPN service useless.

To find out if your VPN is working as it should, you can run your own test at home using our VPN and torrent IP leak testing tool. It requires very little technical knowledge and takes just a matter of minutes.

You can also conduct a basic manual test for IP leaks using our What Is My IP checker tool. Simply check your IP address before and after connecting to a VPN server – if your IP address doesn’t change, your VPN isn’t working.

Here is a summary of the three main types of VPN leak:

IP Address Leaks

IP address leaks occur when your VPN service fails to mask your public IP address with one of its own. This is a significant privacy risk as any websites you visit will be able to see your real identity and geographic location.

If your IP address is leaking, your VPN is simply not doing its job. Your online privacy is not protected, and streaming services will be able to detect your true location.

IPv4 leaks are rare, but IPv6 leaks are quite common – especially amongst low-quality VPN services. Only VPNs specifically developed to reroute or block IPv6 traffic will offset this problem.

Premium VPNs should include a kill switch to protect your IP address in the event of a connection loss. However, our VPN kill switch testing revealed that many top services still leak your IP address if you change VPN servers while connected.

DNS leaks

DNS leaks occur when your DNS requests are revealed to your ISPs DNS servers even when connected to a VPN server.

DNS requests are essentially records of the websites you visit when browsing the internet. Normally, this process is carried out by your ISP’s DNS servers, which often log the requests along with your IP address.

A VPN is supposed to encrypt your DNS queries and route them to its own private DNS servers. This prevents your ISP from monitoring the websites you visit. If your VPN fails to reroute your DNS requests and routes them to your ISP’s default DNS servers instead, it’s called a DNS leak.

To find out which servers your device is using, you can test your DNS servers using our tool.

WebRTC leaks

WebRTC is a browser-based technology that allows audio and video communications to work inside web pages. It’s enabled by default in popular browsers such as Chrome, Firefox, and Opera.

Websites can use your browser’s WebRTC functionality to discover your true IP address, even when you’re using a VPN. If this happens and your true IP address is not blocked by your VPN, it’s known as a WebRTC leak.

We’ve reviewed over 55 VPNs and tested every individual service for IP, DNS, and WebRTC leaks.

Our testing revealed that some of the most-downloaded VPNs on the Apple and Google app stores leak some kind of user data through DNS or WebRTC. In the table below, you can see some of the most popular culprits.

For an in-depth analysis of over 150 free Android VPNs and their security tests, read our Free VPN Risk Index.

*Leaks detected during testing of Chrome extension.

Investing in a reliable and secure VPN is the simplest and most important decision you can make if you’re concerned about your privacy online.

If you’ve tested your VPN for leaks and found any issues, you can follow the instructions in this section to fix them and stop your VPN from leaking.

If you’re consistently experiencing data leaks with your current VPN service, you should also consider subscribing to a more secure VPN provider.

Your VPN could be leaking DNS requests for a number of reasons. Luckily, there are a few simple ways to fix the most common issues.

Firstly, if you have manually set your device’s DNS to a third-party service like Google’s, then you can ignore any DNS leaks. To double check, use our DNS server test to make sure your device is using the servers you’ve chosen.

If you haven’t manually changed your device’s DNS and your device is still using your ISP’s default servers – even when using a VPN – then your VPN is leaking your DNS requests.

The most effective way to fix these DNS leaks is to switch to a VPN service that maintains its own zero-log DNS servers.

If you don’t want to switch VPN services, you’ll need to follow the instructions below to fix your DNS leaks.

Change Your DNS Settings

If your VPN doesn’t automatically connect to a private DNS server, you’ll have to manually connect to a third-party DNS server. To do this, you will need to change the DNS settings on your device.

We recommend choosing a third-party DNS server that does not reveal your true location, such as Google Public DNS or OpenDNS. Here’s how to do it:

How to Change Your DNS Settings on Windows 10

1. Right-click on the Network or WiFi icon in your system tray and click Open Network & Internet settings.
2. Select Change adapter options.
3. You will be presented with a list of all your computer’s adapters. Find the one you’re currently using to connect to the internet, right-click on it, then click Properties.
4. The new window will open on the Network tab. There will be one option labeled Internet Protocol Version 4 (TCP/IPv4) and another labeled Internet Protocol Version 6 (TCP/IPv6). Select Internet Protocol Version 4 (TCP/IPv4) then click Properties.
5. You will see two checkboxes towards the bottom of the window, one labeled Obtain DNS server automatically and one labeled Use the following DNS server addresses. Click on the second option.
6. The two previously grayed-out text fields should now be white. In the Preferred DNS server field enter 8.8.8.8. In the Alternative DNS server field enter 8.8.4.4. This will set your DNS to Google’s.
7. If your router is also IPv6 compatible, repeat steps 4-6 but for the Internet Protocol Version 6 (TCP/IPv6) option.
8. Check your DNS address with your VPN on to make sure the issue is resolved.

How to Change Your DNS Settings on macOS

1. Open System Preferences then select Network.
2. A list of network adapters will appear on the left-hand side of the window. The one which is currently in use will have a green dot by it. Select it, then click on Advanced.
3. Click on the DNS tab. The left-hand side of the window will now show a list of your DNS servers. Click the + icon in the bottom-left-hand corner.
4. Enter 8.8.8.8 and press the Enter key. This should now have replaced the greyed-out default DNS server that was previously at the top of the list (or the only item in it).
5. Click the + icon again and enter 8.8.4.4, then press the Enter key. Your DNS will now be changed to Google’s.
6. Check your DNS address with your VPN on to make sure the issue is resolved.

How to Change Your DNS Settings on iOS Devices

1. Open the Settings app.
2. Tap on Wi-Fi, then tap on the ‘i’ symbol next to the network you’re connected to.
3. Scroll down to the DNS section and tap on Configure DNS. By default, this will be set to Automatic. Tap Manual > Add Server then enter 8.8.8.8, 8.8.4.4 and tap Save.
4. Check your DNS address to make sure the changes are working properly.

How to Change Your DNS Settings Android Devices

1. Open the Settings app.
2. Tap on Connections > More connection settings > Private DNS.
3. Check the box next to ‘Private DNS provider hostname’. In the field below, type in dns.google and tap Save.
4. Check your DNS address to make sure the changes are working properly.

Update Your OpenVPN Version

Some ISPs use a transparent DNS proxy – a ‘middleman’ that captures and redirects web traffic – to make sure your requests are sent to their own servers.

Transparent DNS proxies effectively ‘force’ a DNS leak without notifying the user. Luckily, most leak detection websites and online tools will be able to identify a transparent DNS proxy in the same way as a normal DNS leak.

The latest versions of the OpenVPN protocol have a simple method to tackle this problem:

1. Find the .ovpn or .conf file for the server you’re trying to connect to. These files will be stored in folders on your machine, usually in C:\Program Files\OpenVPN\. For more information, read the OpenVPN manual.
2. Once you’ve found it, open the file in an editing program like Notepad. Add: block-outside-dns to the bottom.
3. Rerun a DNS leak test to check the leak is resolved and find any additional issues.

If you haven’t already, update to the latest version of OpenVPN. If your VPN service doesn’t support this or is using an older version of the protocol, it’s worth looking for a different VPN service.

Fortunately, most premium VPN services have their own solutions for tackling transparent proxies. For more details, contact your provider’s customer support service.

Disable Teredo

Teredo is a built-in feature of Windows operating systems. It’s designed to help IPv4 and IPv6 coexist by allowing IPv6 addresses to be transmitted and understood on IPv4 connections.

However, because Teredo is a tunneling protocol, it can sometimes take priority over your VPN’s encrypted tunnel, causing a DNS leak.

Here’s how to disable Teredo on Windows devices:

1. Open Command Prompt and type netsh interface teredo set state disabled
2. Press the Enter key to disable Teredo.
3. Rerun a DNS leak test to check the leak is resolved and find any additional issues.

You might experience occasional issues with certain websites or servers when Teredo is disabled. That said, it is a much more secure choice for VPN users.

If you’ve tested for leaks and your real location is still visible on the map, there are two possibilities. One is that your public IPv4 or IPv6 address is still leaking. To fix this, follow the steps outlined above.

If the problem persists, it’s likely that HTML5 geolocation is revealing your true location. This technology determines your location using techniques that can’t be protected by a VPN. For example, it can detect WiFi hotspots near you, or use cellular data to triangulate your longitude and latitude.

To fix these location leaks you need to disable HTML5 geolocation in your browser. You can also use the ExpressVPN browser extension, which has built-in HTML5 leak protection.

Here’s how to do it in the most popular web browsers. Once you’ve followed these steps, make sure you clear your browser’s cache, cookies, and history.

How to Disable HTML5 Geolocation in Google Chrome

1. Open the Chrome menu, then click Settings.
2. Scroll down to the Privacy and security section and click Site settings.
3. Scroll down to Permissions and click on Location.
4. Ensure that Ask before accessing (recommended) is toggled on.

This won’t disable HTML5 geolocation entirely, but it will give you the choice of enabling or disabling the technology for each individual website you visit.

How to Disable HTML5 Geolocation in Mozilla Firefox

1. Open Firefox and type about:config into the address bar and press Enter. Click the button labeled Show All.
2. Type geo.enabled into the search bar and press Enter.
3. A bar will appear labeled geo.enabled. Double-click it so that it now says false.

How to Disable HTML5 Geolocation in Safari

1. Click the Safari menu button in the top left-hand corner, then click Preferences.
2. Click on the Privacy tab, then next to Website Tracking check the box labeled Prevent Cross-site tracking.

How to Disable HTML5 Geolocation in Microsoft Edge

1. On your Windows PC press Win + A. This will open up the Action Center on the right-hand side of your screen
2. Right click on Location and then click Go to Settings.
3. Scroll down to the Allow apps to access your location section and change the slider to the Off position.
4. Scroll down further to the Location history section and click Clear.

How to Disable HTML5 Geolocation in Opera

1. Open Opera and type about:config into the address bar and press Enter.
2. Click Advanced in the left-hand menu, then click Privacy & security.
3. Click Site Settings then Location.
4. Toggle the slider next to Ask before accessing (recommended) to Off.

If your IP address has been identified as belonging to a data center, that almost certainly means that your VPN is running. This type of leak won’t necessarily expose your identity, but it will reveal the fact you’re using a VPN.

IP addresses can be identified by the type of connection they’re used for. Your standard home or mobile connection will be labeled as a residential IP address, as you’re a normal person using a normal amount of data.

IP addresses belonging to data centers are easy to identify due to the huge amounts of data that flow to and from them at all times of day. Most VPN IP addresses will fall into this category.

To fix this, simply turn off your VPN or proxy.

If you experience a DNS leak while torrenting using a VPN, there is an easy solution you can try to fix it.

Before you attempt this solution, make sure that your VPN is running and connected to a server before you open up your BitTorrent client and before you add any torrent magnet files. It’s possible that your client could still use your ISP’s DNS if not.

You should also check that, if it has the option, your VPN is set to use first-party DNS servers. Once you’ve done so, you can attempt to fix the leak by changing your device’s DNS settings.

How to change your default DNS server to a public DNS server

By default, your device will use your ISP’s DNS servers to resolve DNS requests (even those coming from your BitTorrent client). This can result in your ISP identifying the torrent you are downloading. By switching to a public DNS server you can prevent this – we explain how further up the page.

It’s also vital that you still use your VPN while torrenting, even if you follow the above steps.

Once you’ve tested your VPN and fixed any leaks you may have found, it’s worthwhile taking some steps to minimize your chances of leaking data in the future.

To begin with, make sure that you’ve followed any relevant steps outlined above. This includes making sure your VPN blocks or supports IPv6 traffic, disabling Teredo, and if necessary, changing your settings to an independent DNS server.

Afterwards, consider the following steps to reduce your chances of VPN leaks:

1. Block Non-VPN traffic

Some VPN clients include a feature to automatically block any traffic traveling outside the VPN tunnel — often called IP-binding. If your provider has this option, make sure to enable it.

Alternatively, you can configure your firewall to only allow traffic sent and received via your VPN.

2. Invest In VPN Monitoring Software

VPN monitoring software allows you to inspect your network traffic in real time. This means you can check for suspicious traffic and see if a DNS request is sent to the wrong server. Some variations also offer tools for automatically solving DNS leaks.

This software is rarely free, so will add an extra expense on top of your existing VPN subscription. Examples of VPN monitoring software include PRTG Network Monitor and Opsview Monitor.

3. Use a Different VPN

The best VPNs will have IPv6 compatibility, DNS and WebRTC leak protection, the latest version of OpenVPN and the ability to bypass transparent DNS proxies.

A VPN kill-switch is another critical part of your VPN client. It will continuously monitor your network connection and make sure that your true IP address is never exposed in the event of a dropped connection.

If you’re repeatedly suffering from data leaks with your existing provider, it’s probably time to invest in a new VPN service.