How Do I Check for IP, DNS, and WebRTC Leaks and Fix Them?

Updated

Connect to your VPN, open ipleak.net, and compare what it shows against what you expect. If any field still shows your ISP's IP address or DNS servers, you have a leak. The page tests four things at once: your public IP addresses (including WebRTC-discovered ones), your DNS resolvers, your torrent-visible address, and your geolocation. This guide walks through reading each result and fixing the common causes.

What ipleak.net actually checks

The page runs several independent detections, and each one can fail separately:

  • IP addresses — your public IPv4/IPv6 as seen by the server, plus a WebRTC detection that can reveal a second address your browser exposes.
  • DNS detection — the recursive resolvers your queries reach. It lists each one it observes.
  • Torrent address detection — a magnet-style check that reports the IP your BitTorrent client would announce.
  • Geolocation — browser-based location (requires permission) and IP-based location with an accuracy radius.

The page's own guidance is the key to reading results: if you are connected to a VPN and you see your ISP IP, your system is leaking WebRTC requests; and if between the detected DNS you see your ISP DNS, your system is leaking DNS requests.

Step 1: Establish a baseline before connecting the VPN

  1. Disconnect the VPN.
  2. Load ipleak.net and note your IP, ISP, and the DNS servers listed.
  3. This is your "leak signature" — the values that should disappear once the VPN is on.

Without a baseline you can't tell whether a result is your real ISP or your VPN provider's own infrastructure.

Step 2: Re-test with the VPN connected

  1. Connect the VPN and confirm the client reports an active tunnel.
  2. Reload ipleak.net (hard-refresh to avoid cached JavaScript).
  3. Check each section against the table below.
Section Clean result Leak indicator
IP addresses VPN provider's IP and ASN Your ISP name or home IP appears
WebRTC detection No extra address, or the VPN address only Your ISP IP appears alongside the VPN IP
DNS detection Only the VPN's DNS servers Any ISP DNS server in the list
Torrent detection VPN IP Your real IP or ISP
Geolocation VPN's exit country Your actual city/region

If every row is clean, you're done. If not, fix the matching section below.

Fixing a DNS leak

A DNS leak means your queries bypass the VPN tunnel and reach your ISP's resolver. The page notes this is common because systems can send DNS queries outside the tunnel even when other traffic is routed through it.

Check these in order:

  1. VPN client DNS handling — most clients have a setting to force all DNS through the tunnel (often labeled "DNS leak protection" or "use VPN DNS"). Enable it.
  2. System DNS settings — on Windows, check the adapter's DNS servers; on macOS, check Network settings. If they point to your router or ISP, the VPN may not be overriding them.
  3. Browser encrypted DNS (DoH) — if your browser uses its own DNS-over-HTTPS resolver, it can bypass the VPN's DNS. Either disable secure DNS in the browser or point it at a resolver you trust.
  4. IPv6 — if your VPN only tunnels IPv4, IPv6 DNS queries can leak. Disable IPv6 on the adapter or confirm the VPN handles it.

Re-run the DNS detection after each change until only VPN resolvers appear.

Fixing a WebRTC leak

WebRTC uses STUN (Session Traversal Utilities for NAT) to discover your public IP address — which is exactly why it can expose you even behind a VPN. The page gives a direct fix for Firefox:

  • Firefox: type about:config in the address bar, search for media.peerconnection.enabled, and double-click to set it to false.

For Chrome and Chromium-based browsers, the page points to extensions or policy-based restrictions rather than a built-in toggle. Practical options:

  • Install a WebRTC-blocking extension and verify it actually blocks the detection.
  • Use enterprise policy (WebRtcIPHandlingPolicy) if you manage the browser.
  • Or simply use a browser profile where WebRTC is disabled for sensitive sessions.

After changing anything, reload ipleak.net and confirm the WebRTC section no longer shows your ISP address.

Checking your torrent client

The torrent detection works by having you add a test torrent and reporting the IP your client announces to peers. If that IP is your real one, your BitTorrent traffic is bypassing the VPN.

Common causes:

  • The client was already running before the VPN connected — restart it after connecting.
  • The client is bound to the wrong network interface. Most clients let you bind to the VPN adapter specifically; do that.
  • IPv6 traffic escaping an IPv4-only tunnel.

Re-test after each fix; the torrent section should report the VPN IP.

Verifying the fix

Once all sections are clean, do one final pass:

  1. Disconnect and reconnect the VPN.
  2. Hard-refresh ipleak.net.
  3. Confirm IP, WebRTC, DNS, and torrent all show VPN values.
  4. Optionally repeat after a reboot, since some leaks only appear on a fresh network stack.

If a leak returns after reboot, the cause is usually a system-level DNS or IPv6 setting rather than the VPN client itself.