A VPN is the closest thing most of us have to a privacy switch. Flip it on, watch the icon turn green, and assume the tunnel is sealed. The trouble is that a tunnel is only as good as the settings wrapped around it. Most leaks are not dramatic hacks. They are small gaps: a kill switch that never armed itself, a DNS request that slipped out before the tunnel came up, an app you excluded last year and forgot about.
None of those failures announce themselves. Your status light stays green while your real IP address, your approximate location, or your browsing history travels in the open. Here are the mistakes that cause it, and what to do about each one.
Kill Switch Failures: The Drop Nobody Notices
When the tunnel collapses — a router hiccup, a laptop waking from sleep, a handoff from Wi-Fi to cellular, a server reboot — the kill switch is meant to cut your internet entirely until the VPN returns. Leaks start here more often than anywhere else, because kill switches fail quietly.
- It was never switched on. A surprising number of clients ship with the kill switch disabled. Look under Settings, then Network, Firewall, or Advanced, depending on the app.
- It only covers part of your traffic. App-level kill switches sometimes block the VPN client's own connections while other traffic continues. Firewall-level lock modes are stronger.
- Something else overwrote the rules. A second firewall, a gaming "booster", or a major OS update can wipe the firewall entries your VPN relies on.
- It only works with one protocol. Switch from WireGuard to OpenVPN and the protection may not follow.
Test it instead of trusting it. Connect, confirm your IP on an IP-check page, then break the tunnel on purpose: disable Wi-Fi, or kill the VPN process from Task Manager or Activity Monitor. Try to load a site. If it loads, you are leaking. Repeat the test after your machine sleeps and wakes, since that is a common blind spot.
DNS and IPv6 Leaks: Traffic That Slips Past the Tunnel
Encrypted traffic can stay inside the tunnel while the lookups that precede it escape. If your device sends DNS queries to your ISP's resolver instead of your VPN's, that provider still sees every domain you visit, even though the pages themselves are encrypted. Common causes include a VPN that does not force DNS settings, a "smart DNS" service running alongside it, or a browser configured to use its own secure DNS provider. That last one is easy to miss: the browser quietly bypasses your VPN's resolver.
IPv6 is the other classic escape. Many VPNs handle IPv4 only. If your ISP hands you an IPv6 address and your device prefers it, traffic can route around the tunnel without touching it. The fix is either a provider that supports IPv6 properly or disabling IPv6 on the device's network adapter.
Browsers add a third gap. WebRTC, the technology behind in-page calls and screen sharing, can expose local and sometimes public IP addresses to a site that asks. Turn it off in your browser settings, or use an extension that blocks it when you do not need it.
To check all three, run a DNS leak test and an IPv6 test after connecting. You want to see only your VPN provider's servers, and no trace of your ISP.
Free VPNs and the Real Cost of "Free"
Running servers and bandwidth costs money. An app that charges nothing has to recover it somewhere: capped speeds, injected ads, aggressive tracking, or selling aggregated usage data. Some free proxy apps are worse than that, bundling adware or asking for permissions that have nothing to do with networking.
That does not mean every free option is hostile. A limited free tier from a provider that also sells paid plans is a different animal from a standalone free app of unknown origin. Ask a few blunt questions before you install:
- Who owns the company, and is there a real privacy policy with a stated logging position?
- Does the app request access to contacts, SMS, or your files? It should not need any of that.
- Are there independent audits of its no-logs claims, or only marketing language?
Whatever you decide, keep free tools away from banking, work email, and anything tied to your identity. If a service is protecting your most sensitive accounts, it needs to be one you can reasonably trust.
Split Tunneling Errors That Expose Your Real IP
Split tunneling lets selected apps skip the VPN. It is genuinely useful for a printer on your home network or a local file server. It also causes some of the messiest leaks, because exclusions are set once and never revisited.
The most common pattern: you exclude a browser for one streaming site, then keep using that same browser for email and banking weeks later. Everything typed into it leaves through your ISP. The second pattern is misreading the toggle. Some clients list the apps that use the VPN, others list the apps that bypass it, and the two look nearly identical at a glance.
A few habits keep this under control. Keep your exclusion list at zero to two entries. Never exclude a general-purpose browser, an email client, or a password manager. If you need one site to bypass the tunnel, use a separate browser for it and leave your main one fully tunnelled. Audit the list once a month, and check it after every app update, since renames and reinstalls can shift entries around.
Habits That Quietly Undo a Good Tunnel
Configuration is only half of it. Day-to-day behaviour creates leaks too. Auto-connect is switched off, so the phone joins café Wi-Fi unprotected while you order coffee. The VPN runs as a browser extension only, leaving every other app on your laptop exposed. You disable the VPN to click through a hotel captive portal and never turn it back on. Or the phone is protected and the laptop is not, which is exactly where work documents live. Turn on auto-connect for untrusted networks, and make a rule that the VPN returns the moment you finish logging into public Wi-Fi.
A Ten-Minute Leak Check
Run this once now, then again after any major update:
- Connect the VPN and confirm your IP and location on a test page.
- Run a DNS leak test. Only your provider's resolvers should appear.
- Run an IPv6 test. No IPv6 address should show up unless your provider supports it.
- Check WebRTC exposure in the browser you use most.
- Kill the VPN process and try to load a page. Nothing should load.
- Open your split-tunnel list and remove anything you do not recognise.
- Confirm auto-connect is on for public networks on every device you carry.
Ten minutes of checking beats a year of assuming. A VPN is a tool, not a guarantee, and the difference between the two is usually a setting nobody looked at twice.
Photo: Engin_Akyurt / Pixabay
