How to check that your VPN is actually working

Most guides reduce this to one action: open a site, look at the address. That is the right first step and a poor only step. A matching address answers exactly one question out of four, and the other three are what explain every case of "the VPN is on, but something is off".

Below are four checks in order, from fastest to most useful. All work with any WireGuard client, not only ours.

Check 1. Your address changed

The simplest and therefore the best known.

Open any IP-checking service — there are dozens, the first one will do. Look at two fields: the address itself and the country derived from it.

What you should see. An address different from the one you had before connecting, and a country matching the server you chose rather than your own.

What this proves. That web traffic went through the tunnel. That, and nothing more.

What it doesn't prove. That DNS isn't leaking, that the tunnel is alive right now, or that every app uses it. Hence the three checks that follow.

A useful habit: check your address before connecting and note it down. Otherwise, faced with unfamiliar numbers, you cannot tell the server's address from your own address having simply changed.

What your IP address says about you

An IP address is the number your provider or mobile carrier assigns you, and the one sites use to send replies to your device. Without it the internet has nowhere to deliver the page.

How to see it. Open any IP-checking service and it shows the address you appear as from outside. The address shown in your router or phone settings is usually different: that is your internal number on the home network, and it never leaves it.

It changes on its own. Most home connections get a dynamic address: restart the router and it differs. On mobile data it changes more often still. So "the address differs from yesterday" proves nothing, while "it differs from what it was a minute ago, before connecting" proves a great deal.

What it reveals. Your country and usually the city or region of your provider — to the resolution of a settlement, not a building. A street address cannot be derived from an IP, contrary to a widespread fear. What it does reveal plainly is who your provider is.

That is why the address check comes first: note it down before connecting, and you will have something to compare against afterwards.

Check 2. DNS isn't leaking

The most underrated check, and the only one where everything can look correct while a real problem is present.

When you open a site, your device first asks a DNS server for its address. If that question travels outside the tunnel, your provider sees the list of sites you visit — even though the traffic itself is encrypted and the IP check shows a foreign country.

How to check. Open any DNS leak testing service and run the test. It shows which DNS servers answered your device's queries.

What you should see. The servers named in your configuration, or servers in the country where your VPN server stands. OKNO configurations ship with 1.1.1.1 and 8.8.8.8 by default.

What a leak looks like. Your home provider or mobile carrier in the results. That means DNS queries are travelling outside the tunnel. The fix is to set DNS explicitly in your configuration and reconnect.

Check 3. The tunnel is alive right now

Here is the part guides usually omit.

WireGuard does not hold a connection in the ordinary sense. If the server stops accepting your key — device revoked, subscription expired, server rebuilt — nothing comes back. The interface stays up, the system keeps showing the VPN icon, the app keeps saying Connected. From the outside everything looks fine while no packet arrives.

So the label on screen is not proof. There is exactly one proof:

The received-bytes counter is growing.

Sent bytes always grow: your device dutifully pushes packets into the tunnel even when nobody on the far side is accepting them. Received bytes grow only when something over there actually answers.

Where to look. In system VPN settings, not inside the VPN app. On iPhone: Settings, VPN, your configuration. On Android: the VPN section of network settings. Both show data sent and received.

A twenty-second version. Note the received figure, open a couple of sites, look again. Grown — the tunnel is alive. Unchanged while sent bytes climbed — you are transmitting into nothing, and it is time to reconnect.

There is an indirect sign too: a healthy connection under traffic renews its handshake roughly every two minutes. If your client shows the last handshake time and it is several minutes old during active use, reconnect. On its own an old handshake means nothing — a phone sitting in a pocket legitimately has one, because there is no traffic to carry.

Check 4. Nothing is bypassing the tunnel

The last check explains the most confusing case of all: everything works, and one app behaves as though the VPN were switched off.

Almost every modern client has split tunnelling — a list of apps that reach the internet directly. An app on that list is not protected by the tunnel, and that is the intended behaviour rather than a fault.

How to check. Open the exclusion list and read it. If the app that worries you is there, the question is answered.

The detail that saves an evening. Some apps detect a VPN from the state of the device itself rather than from your address — banking apps in particular, along with a number of government and marketplace apps. Adding them to the exclusion list does not help, because the phone still reports that a tunnel is up. The only thing that works is turning the VPN off temporarily or pausing it.

The converse rule is useful too: if an app fails to open without the VPN as well, putting it on the exclusion list is pointless and will only make things worse. The same logic applies to any app you are tempted to add out of frustration.

If any check failed

What's wrong	What it means	Where to go
Address unchanged	The tunnel didn't come up, or traffic bypasses it	Check whether the VPN is connected at all
Foreign address, your own DNS	DNS leak	Set DNS in the configuration and reconnect
Received bytes not growing	The tunnel is dead while looking alive	Reconnect, then switch locations
One app bypasses the VPN	Split tunnelling, or device-level detection	Check the exclusion list

If the tunnel won't come up at all, or sites won't load on a connection that looks fine, that is a separate diagnosis: VPN not working — find the cause in five minutes.

The short checklist

Once a month, and after every network change:

1. Address and country have changed.
2. The DNS leak test shows no sign of your provider.
3. Received bytes grow when you open sites.
4. Nothing unexpected sits on the exclusion list.

Four items, three minutes. Everyone knows the first one. The other three are what answer the question of whether you are actually protected.

---

OKNO is a WireGuard VPN: up to 10 devices per subscription, unlimited traffic, 30-day refund. See how it works.