A green “Connected” indicator doesn’t mean much on its own. It tells you the tunnel came up — it doesn’t tell you whether DNS, IPv6, or a background process is quietly routing traffic around it. That distinction is the source of most VPN leaks, and it’s why two people can run the exact same app and get completely different levels of protection.

Why “Connected” Isn’t the Same as “Protected”

DNS leaks, WebRTC leaks, and IPv6 leaks each escape the tunnel through a different pathway, which is why a single “leak test” often misses two out of three. A DNS leak happens at the resolver level, a WebRTC leak happens inside the browser’s own API, and an IPv6 leak happens because the VPN only routes IPv4 traffic. Fixing one does nothing for the other two — each needs its own check.

The stakes vary by use case. Someone streaming geo-restricted content mostly risks an annoying content block if their real location leaks through. Someone using a VPN casino platform to reach an international gaming site, logging into financial accounts while traveling, or reporting on a sensitive topic from abroad is risking something closer to real exposure. The technical fix is the same either way — only the cost of skipping it changes.

The 10 Misconfigurations We See Most Often

1. No kill switch enabled

If the tunnel drops — a dead Wi-Fi handoff, a server restart, a sleep/wake cycle — traffic falls back to your normal connection unless a kill switch blocks it. This is off by default in more clients than you’d expect. On Windows it’s usually under Connection or Network settings; on macOS it’s in Preferences. Turn it on for every device, not just your primary machine.

2. DNS leak protection turned off

Your device can keep sending DNS lookups to your ISP’s resolver even while the VPN tunnel is active, because DNS and general traffic don’t always share a routing table. Enable DNS leak protection in the app, then run a leak test immediately after connecting — not once, but after every protocol or server change, since some clients silently reset this setting.

3. Wrong protocol selected

“Auto” protocol selection is convenient but will sometimes fall back to a weaker option for compatibility on restrictive networks (hotel Wi-Fi, some corporate firewalls). OpenVPN and WireGuard are the two protocols worth manually selecting when the app allows it — auto-select is fine at home, but check it manually on any network you don’t control.

4. Split tunneling misconfigured

Split tunneling is useful for keeping bandwidth-heavy local apps outside the VPN, but it’s an easy setting to forget about. An app excluded from the tunnel six months ago for a specific reason can end up carrying sensitive traffic today with no warning. Review the exclusion list periodically, not just when you first set it up.

5. WebRTC not blocked in the browser

WebRTC is a browser feature, not a VPN feature, which is why it leaks around the tunnel entirely — Chrome and Firefox can expose your real IP through a WebRTC request even while every other app is fully protected. Disable WebRTC in browser settings, or use a dedicated extension if your browser doesn’t expose the toggle directly.

6. Auto-connect on startup disabled

Between your device booting and the VPN app launching, traffic flows unprotected by default. That window is short, but background services (sync clients, update checkers) don’t wait politely for you to open your VPN app. Enable auto-connect on startup so the tunnel is up before anything else gets a chance to send traffic.

7. IPv6 leaking

Plenty of VPN clients tunnel IPv4 traffic properly but simply don’t touch IPv6, so a device with a live IPv6 address can leak it in parallel with a fully-tunneled IPv4 connection. This is especially common on Windows. Either disable IPv6 at the OS level or confirm — don’t assume — that your VPN blocks it natively.

8. Auto-reconnect failure on iOS

iOS handles VPN tunneling at the system level differently from Android, macOS, or Windows, and certain system processes can bypass an active VPN tunnel on iPhone and iPad even with a kill switch enabled. This isn’t a one-time fix: check the VPN profile manually after every iOS update, since Apple’s own update process can silently reset it.

9. Outdated VPN client

An old app version can be missing current encryption standards or a leak fix that shipped months ago. Keep every device current, including Android, where background app updates aren’t always installed automatically the way they are on iOS.

10. Never testing after configuration

This is the mistake that makes all the others possible. After any setting change — new server, new protocol, an OS update — check if your real IP is exposed with a dedicated lookup tool. It takes under a minute and it’s the only way to know a setting actually did what you expected instead of what the toggle claimed.

Platform-by-Platform Checklist

• Windows: IPv6 disabled system-wide; kill switch active at the adapter level, not just the app level.
• macOS: VPN profile set to connect on demand; DNS locked to the VPN’s own servers rather than the network default.
• iOS: VPN configuration profile checked manually after every major OS update.
• Android: Always-on VPN mode enabled; “Block connections without VPN” switched on in network settings.

Quick FAQ

How do I know if my VPN is actually leaking?
Run a dedicated IP and DNS leak test right after connecting, and again after any settings change — the result should show your VPN server’s location and DNS, not your ISP’s.

Does a kill switch fix every type of leak?
No. A kill switch only stops traffic when the tunnel drops entirely — it does nothing for a WebRTC or IPv6 leak that happens while the tunnel is still connected.

Is this more of a risk on mobile or desktop?
Both have their own weak points — iOS’s auto-reconnect gap and Windows’s IPv6 handling are the two most common culprits we see, just via different mechanisms.

Fixing the Foundation Before Trusting the Connection

Most people find out their VPN was misconfigured only after something goes wrong — a login gets flagged, content stays geo-blocked, or a privacy scare prompts a closer look. None of the fixes above take more than a few minutes individually, but the trust that matters isn’t in the app’s “Connected” indicator — it’s in checking that each setting is actually doing what it claims. Reviewing Kill Switch and DNS leak protection against your specific provider’s implementation is the fastest way to see which of these are automatic and which still need a manual toggle.

A properly configured VPN gives you real privacy. A misconfigured one gives you a false sense of it — and that’s a worse position than not using one at all.

Start Browsing Privately

iProVPN encrypts your data for protection against hackers and surveillance, with servers built for unblocking your favorite streaming platforms instantly.