Linux IP Leak Test: Complete Guide to Testing VPN Leaks on Ubuntu, Debian, Fedora & Arch

Why Linux Systems Leak IPs (Even With VPN)

Linux offers superior control over networking compared to Windows and macOS, but this flexibility creates opportunities for misconfiguration. VPN leaks on Linux typically occur due to:

1. No Built-in Kill Switch in OpenVPN/WireGuard

Unlike commercial VPN apps, OpenVPN and WireGuard don't include automatic kill switches. When the VPN connection drops, your system immediately uses the default route (your regular internet connection), exposing your real IP. You must manually configure iptables/nftables rules.

2. NetworkManager VPN Plugin Limitations

NetworkManager's VPN plugins (network-manager-openvpn, network-manager-vpnc) don't enforce traffic routing through VPN. They add routes but don't block non-VPN traffic. DNS leaks are particularly common with NetworkManager setups.

3. IPv6 Preference

Most Linux distributions enable IPv6 by default. If your VPN only tunnels IPv4, all IPv6 traffic bypasses the VPN completely. Modern applications prefer IPv6 when available, making this a critical leak vector. See our IPv6 leak guide.

4. DNS Configuration Conflicts

Linux has multiple DNS resolution systems (systemd-resolved, dnsmasq, resolv.conf, NetworkManager). VPN clients may update one system while another handles actual DNS queries, causing DNS leaks.

5. Routing Table Priorities

When VPN connects, it should add routes with higher priority than your default gateway. Misconfigurations can cause traffic to use the wrong interface. Container networks (Docker, Podman) often bypass VPN routing entirely.

Command-Line IP Leak Testing

Linux's command-line tools make leak testing fast and scriptable:

Basic IP Leak Test

1. Check Your Real IP (VPN Disconnected)

# Using curl (most common)
curl ifconfig.me
curl ipinfo.io/ip
curl api.ipify.org

# Using wget
wget -qO- ifconfig.me

# Check both IPv4 and IPv6
curl -4 ifconfig.me  # IPv4 only
curl -6 ifconfig.me  # IPv6 only

2. Connect to VPN and Verify

# After connecting to VPN, check IP again
curl ifconfig.me
# Should show different IP (your VPN server's IP)

# Verify VPN interface is up
ip addr show tun0       # OpenVPN typically uses tun0
ip addr show wg0        # WireGuard uses wg0
ip addr show utun       # Some VPNs use utun

3. Test Kill Switch (Force Disconnect)

# Find VPN process
ps aux | grep openvpn
ps aux | grep wg

# Kill VPN process (simulates crash/disconnect)
sudo killall openvpn
# OR
sudo wg-quick down wg0

# Immediately check IP (should FAIL or timeout if kill switch works)
curl ifconfig.me
# If this shows your real IP, you have NO kill switch!

DNS Leak Test (Command Line)

Check Current DNS Servers

# Method 1: Check resolv.conf
cat /etc/resolv.conf
# Should show VPN's DNS servers (not your ISP's)

# Method 2: systemd-resolved status
resolvectl status
# OR on older systems
systemd-resolve --status

# Method 3: NetworkManager DNS
nmcli dev show | grep DNS

Test DNS Resolution Path

# Query OpenDNS to see what IP they see
dig +short myip.opendns.com @resolver1.opendns.com
# Should return your VPN IP, not real IP

# Check which DNS server is actually being used
dig google.com
# Look at "SERVER:" line in output

# DNS leak test via curl
curl -s https://1.1.1.1/cdn-cgi/trace | grep ip=

Routing Table Inspection

# Show all routes
ip route show
# Look for default route—should go through tun0/wg0 when VPN active

# Show routes for specific interface
ip route show dev tun0

# Check route priorities (metrics)
ip route show | grep default
# VPN route should have lower metric (higher priority)

# Show routing policy database
ip rule show

Distribution-Specific Testing

Ubuntu / Debian Testing

Check NetworkManager VPN Status

# List all connections
nmcli connection show

# Show active VPN connection details
nmcli connection show --active | grep vpn

# Check VPN connection status
nmcli connection show "VPN_NAME"

# Monitor connection in real-time
nmcli monitor

Test DNS on Ubuntu (systemd-resolved)

# Check DNS settings per interface
resolvectl status

# Query specific DNS server
resolvectl query google.com --interface=tun0

# Check if DNS goes through VPN
sudo tcpdump -i any port 53 -n
# Then visit a website—DNS queries should show VPN IP

Disable IPv6 (Ubuntu/Debian)

# Temporary disable
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1

# Permanent disable
echo "net.ipv6.conf.all.disable_ipv6 = 1" | sudo tee -a /etc/sysctl.conf
echo "net.ipv6.conf.default.disable_ipv6 = 1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Fedora / RHEL / CentOS Testing

Check FirewallD Rules

# List all firewall rules
sudo firewall-cmd --list-all

# Check if VPN interface is in trusted zone
sudo firewall-cmd --get-active-zones

# Add VPN interface to trusted zone
sudo firewall-cmd --zone=trusted --add-interface=tun0 --permanent
sudo firewall-cmd --reload

SELinux Considerations

# Check if SELinux is blocking VPN
sudo ausearch -m avc -ts recent | grep openvpn

# Temporarily set to permissive (for testing only)
sudo setenforce 0

# Check current SELinux status
getenforce

Arch Linux / Manjaro Testing

Check systemd Service Status

# Check OpenVPN service
systemctl status openvpn@client

# Check WireGuard
systemctl status wg-quick@wg0

# View service logs
journalctl -u openvpn@client -f
journalctl -u wg-quick@wg0 -f

pacman Package Check

# Verify VPN packages are installed
pacman -Qs openvpn
pacman -Qs wireguard

# Check for DNS leak prevention packages
pacman -Qs openresolv

Creating iptables Kill Switch (Permanent)

The most reliable way to prevent IP leaks on Linux is creating firewall rules that only allow traffic through VPN:

Basic iptables Kill Switch Script

#!/bin/bash
# VPN Kill Switch - Save as /usr/local/bin/vpn-killswitch.sh

VPN_INTERFACE="tun0"              # Change to your VPN interface (tun0, wg0, etc.)
VPN_SERVER_IP="198.51.100.1"     # Your VPN server IP
LOCAL_NETWORK="192.168.1.0/24"   # Your local network (for LAN access)

# Clear existing rules
sudo iptables -F
sudo iptables -X
sudo iptables -t nat -F
sudo iptables -t nat -X
sudo iptables -t mangle -F
sudo iptables -t mangle -X

# Set default policies to DROP (block everything by default)
sudo iptables -P INPUT DROP
sudo iptables -P OUTPUT DROP
sudo iptables -P FORWARD DROP

# Allow loopback
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A OUTPUT -o lo -j ACCEPT

# Allow established connections
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow local network (LAN) access
sudo iptables -A INPUT -s $LOCAL_NETWORK -j ACCEPT
sudo iptables -A OUTPUT -d $LOCAL_NETWORK -j ACCEPT

# Allow connection to VPN server (CRITICAL - must allow before VPN connects)
sudo iptables -A OUTPUT -d $VPN_SERVER_IP -j ACCEPT
sudo iptables -A INPUT -s $VPN_SERVER_IP -j ACCEPT

# Allow all traffic through VPN interface
sudo iptables -A OUTPUT -o $VPN_INTERFACE -j ACCEPT
sudo iptables -A INPUT -i $VPN_INTERFACE -j ACCEPT

# Block IPv6 (if not using IPv6 VPN)
sudo ip6tables -P INPUT DROP
sudo ip6tables -P OUTPUT DROP
sudo ip6tables -P FORWARD DROP

echo "VPN Kill Switch enabled!"
echo "Only VPN traffic allowed through $VPN_INTERFACE"

Make Kill Switch Permanent

Ubuntu/Debian (iptables-persistent)

# Install iptables-persistent
sudo apt install iptables-persistent

# Run your kill switch script
sudo bash /usr/local/bin/vpn-killswitch.sh

# Save current rules
sudo netfilter-persistent save

# Rules will restore on reboot automatically

Fedora/RHEL (firewalld alternative)

# Save iptables rules
sudo iptables-save > /etc/iptables/rules.v4
sudo ip6tables-save > /etc/iptables/rules.v6

# Create systemd service to restore on boot
sudo systemctl enable iptables.service

Arch Linux

# Install iptables and save/restore tools
sudo pacman -S iptables iptables-nft

# Save rules
sudo iptables-save > /etc/iptables/iptables.rules
sudo ip6tables-save > /etc/iptables/ip6tables.rules

# Enable iptables service
sudo systemctl enable iptables ip6tables

Test Your Kill Switch

# 1. Apply kill switch rules (VPN should be connected)
sudo bash /usr/local/bin/vpn-killswitch.sh

# 2. Verify internet works through VPN
curl ifconfig.me
# Should show VPN IP

# 3. Kill VPN connection
sudo killall openvpn  # or: sudo wg-quick down wg0

# 4. Try to access internet (should FAIL)
curl ifconfig.me
# Should timeout or show "connection refused"

# 5. If it shows your real IP, kill switch FAILED
# Check iptables rules:
sudo iptables -L -v -n

NetworkManager VPN Testing & Configuration

NetworkManager is the default network management system on Ubuntu, Fedora, and many other distributions. It requires specific configuration for leak-free VPN operation:

Check NetworkManager VPN for Leaks

# Show all connections
nmcli connection show

# Connect to VPN via NetworkManager
nmcli connection up "VPN_NAME"

# Verify connection is active
nmcli connection show --active | grep vpn

# Check routing table
ip route | grep tun0

# Test for DNS leak
resolvectl status | grep "DNS Servers"
# Should show VPN's DNS, not your ISP's

Force All Traffic Through VPN (NetworkManager)

Method 1: GUI Configuration

1. Open Settings → Network → VPN
2. Click ⚙️ gear icon next to your VPN
3. IPv4 tab → Routes → Enable "Use this connection only for resources on its network" → DISABLE THIS
4. This forces all traffic through VPN (not just VPN network resources)
5. IPv6 tab → Method → Disable (or Link-Local Only)

Method 2: CLI Configuration

# Edit VPN connection
nmcli connection modify "VPN_NAME" ipv4.never-default no
nmcli connection modify "VPN_NAME" ipv6.method disabled

# Set VPN DNS servers (prevents DNS leak)
nmcli connection modify "VPN_NAME" ipv4.dns "9.9.9.9 149.112.112.112"
nmcli connection modify "VPN_NAME" ipv4.ignore-auto-dns yes

# Reconnect for changes to take effect
nmcli connection down "VPN_NAME"
nmcli connection up "VPN_NAME"

OpenVPN & WireGuard Leak Testing

OpenVPN Configuration Testing

Check OpenVPN Config for Leak Protection

# Essential settings in .ovpn file:
cat your-vpn-config.ovpn | grep -E "redirect-gateway|block-outside-dns|pull-filter|dhcp-option"

# Should contain:
# redirect-gateway def1          → Routes all traffic through VPN
# block-outside-dns              → Blocks DNS leaks (Windows)
# pull-filter ignore "dhcp-option DNS"  → Use custom DNS
# dhcp-option DNS 9.9.9.9        → Set VPN DNS servers

Start OpenVPN with Leak Protection

# Connect with script-security for DNS updates
sudo openvpn --config your-vpn-config.ovpn \
  --script-security 2 \
  --up /etc/openvpn/update-resolv-conf \
  --down /etc/openvpn/update-resolv-conf

# Or create systemd service (recommended)
sudo systemctl start openvpn@config-name

Monitor OpenVPN Connection

# Watch OpenVPN logs
sudo journalctl -u openvpn@config-name -f

# Check if TUN interface is up
ip addr show tun0

# Verify routing
ip route | grep tun0

WireGuard Leak Testing

Check WireGuard Configuration

# View WireGuard config
sudo cat /etc/wireguard/wg0.conf

# Should contain in [Interface] section:
# DNS = 9.9.9.9, 149.112.112.112
#
# In [Peer] section:
# AllowedIPs = 0.0.0.0/0, ::/0      → Routes ALL traffic through VPN

Start WireGuard with Monitoring

# Start WireGuard
sudo wg-quick up wg0

# Check connection status
sudo wg show

# Verify handshake is recent (should update every ~2 minutes)
sudo wg show wg0 latest-handshakes

# Check if traffic is flowing
sudo wg show wg0 transfer

WireGuard Kill Switch (Built-in)

# WireGuard's wg-quick includes automatic kill switch
# Add to [Interface] section of /etc/wireguard/wg0.conf:

PostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT

# This blocks all non-WireGuard traffic automatically

Advanced Leak Testing Scripts

Continuous Leak Monitoring Script

#!/bin/bash
# Save as vpn-leak-monitor.sh

REAL_IP="YOUR_REAL_IP_HERE"  # Get from: curl ifconfig.me (without VPN)
VPN_INTERFACE="tun0"          # Change to wg0 for WireGuard

echo "VPN Leak Monitor Started"
echo "Real IP: $REAL_IP"
echo "Monitoring interface: $VPN_INTERFACE"
echo "Press Ctrl+C to stop"
echo "---"

while true; do
    # Check if VPN interface exists
    if ip addr show $VPN_INTERFACE &> /dev/null; then
        VPN_STATUS="UP"
    else
        VPN_STATUS="DOWN"
    fi

    # Get current public IP
    CURRENT_IP=$(curl -s --max-time 5 ifconfig.me)

    # Check for leak
    TIMESTAMP=$(date +"%H:%M:%S")
    if [ "$CURRENT_IP" == "$REAL_IP" ]; then
        echo "[$TIMESTAMP] ❌ LEAK DETECTED! Real IP exposed: $CURRENT_IP (VPN: $VPN_STATUS)"
        # Optional: Send notification
        notify-send "VPN LEAK DETECTED" "Your real IP is exposed!" -u critical
    elif [ -z "$CURRENT_IP" ]; then
        echo "[$TIMESTAMP] ✅ Kill switch active - No internet (VPN: $VPN_STATUS)"
    else
        echo "[$TIMESTAMP] ✅ Protected - IP: $CURRENT_IP (VPN: $VPN_STATUS)"
    fi

    sleep 5
done

Automated VPN Leak Test

#!/bin/bash
# Complete automated VPN leak test

echo "=== VPN Leak Test ==="
echo ""

# Test 1: IP Leak
echo "Test 1: IP Leak Check"
PUBLIC_IP=$(curl -s ifconfig.me)
echo "Public IPv4: $PUBLIC_IP"

PUBLIC_IPV6=$(curl -s -6 ifconfig.me 2>/dev/null)
if [ -n "$PUBLIC_IPV6" ]; then
    echo "Public IPv6: $PUBLIC_IPV6 ⚠️  (May indicate leak if VPN doesn't support IPv6)"
else
    echo "Public IPv6: None (Good)"
fi
echo ""

# Test 2: DNS Leak
echo "Test 2: DNS Leak Check"
DNS_IP=$(dig +short myip.opendns.com @resolver1.opendns.com)
echo "DNS reports IP: $DNS_IP"
if [ "$DNS_IP" != "$PUBLIC_IP" ]; then
    echo "⚠️  WARNING: DNS leak detected (DNS IP ≠ Public IP)"
fi
echo ""

# Test 3: Check DNS servers
echo "Test 3: DNS Server Check"
if [ -f /etc/resolv.conf ]; then
    echo "Current DNS servers:"
    cat /etc/resolv.conf | grep nameserver
fi
echo ""

# Test 4: Routing check
echo "Test 4: Default Route Check"
DEFAULT_ROUTE=$(ip route | grep default)
echo "$DEFAULT_ROUTE"
if echo "$DEFAULT_ROUTE" | grep -q "tun\|wg"; then
    echo "✅ Traffic routes through VPN"
else
    echo "⚠️  WARNING: Default route may not be VPN"
fi
echo ""

# Test 5: WebRTC Leak (if Firefox installed)
echo "Test 5: WebRTC Leak (Manual)"
echo "Visit: https://dovpn.com/ip-leak-test"
echo "Check 'WebRTC' section for local IP leaks"
echo ""

echo "=== Test Complete ==="

Best VPNs for Linux (Native Apps & Leak Protection)

Based on testing Linux-specific clients, kill switch reliability, and native app quality:

VPNs to Avoid on Linux

• VPNs with only .ovpn files: No kill switch, manual setup, high leak risk
• ExpressVPN: Linux app is CLI-only, limited features, no GUI
• Free VPNs: No Linux clients, require manual OpenVPN config
• CyberGhost: Linux support is minimal, outdated packages

Frequently Asked Questions

Related Guides