Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
A VPN’s green Connected status confirms that the client authenticated and established a session. It does not prove that every connection is entering the tunnel. Split tunneling, an incomplete route, DNS configuration, IPv6 traffic, or a reconnect transition can leave some traffic on your ordinary network interface.
To force a full-tunnel connection, disable split-tunnel and exclusion rules, verify that the VPN owns the default IPv4 route (and ::/0 for IPv6), route DNS through the VPN, then reconnect and test IPv4, IPv6, DNS, and intentionally excluded destinations separately.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat “connected” actually proves
When a VPN application reports that it is connected, it has normally completed authentication and created a tunnel interface. Routing policy is a separate decision made by the operating system and, in some clients, by the VPN profile itself. The system can therefore show a healthy tunnel while selecting the physical Wi‑Fi or Ethernet interface for particular destinations.
Microsoft’s Windows VPN documentation distinguishes two routing modes:
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
| Mode | How destinations are selected | What you should expect |
|---|---|---|
| Split tunnel | Specified routes use the VPN; all other traffic uses the physical interface. | Your public IP can remain unchanged for ordinary websites, and excluded apps or networks deliberately bypass the tunnel. |
| Force tunnel (full tunnel) | All traffic is sent through the VPN route unless a more-specific policy overrides it. | Internet traffic, including traffic from apps that do not have their own exclusions, should leave through the VPN. |
That distinction explains most “VPN connected but my IP is unchanged” reports. An unchanged address is expected when the browser is in a split-tunnel exclusion, but it indicates a routing problem when you intended a full tunnel.
DNS is independent enough to require its own test. A website can load through the VPN while the DNS lookup that found the website was sent to your local resolver. IPv6 is another independent path: an IPv4-only VPN can leave applications that prefer IPv6 on the ordinary connection.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsIdentify the bypass before changing settings
Record what fails rather than treating every symptom as a route failure. Use a browser or command-line test that reports your public IPv4 address, an IPv6 address test, a DNS-leak test, a known private resource reachable only through the VPN, and a destination that you intentionally excluded (if you use split tunneling). The pattern tells you which layer needs repair.
- Only ordinary websites show your normal IP: check split-tunnel routes and application or destination exclusions.
- IPv4 changes but IPv6 does not: the profile probably lacks an IPv6 tunnel route.
- Websites work but DNS identifies your home or mobile resolver: DNS queries are bypassing the VPN even if web traffic is tunneled.
- Everything stops when the VPN drops, but traffic leaks during reconnect: review kill-switch behavior and reconnect transitions.
- A private VPN resource is unreachable while internet sites work: the VPN route, internal DNS, or access policy may be incomplete.
Do not use an intentionally excluded destination as proof that the tunnel is broken. Its bypass is the expected result of the exclusion rule.
Fix the connection step by step
1. Confirm that you actually want a full tunnel
Open the VPN client or the operating system’s VPN profile and look for settings named split tunneling, allowed apps, excluded apps, excluded destinations, inverse split tunnel, or local network access. A profile that lists only selected networks or applications is behaving as configured.
- Disable split tunneling and every application or destination exclusion if all traffic must use the VPN.
- If you need split tunneling, remove only the exclusion that is causing the unexpected bypass. Keep deliberate local-network or work-resource exceptions documented.
- Save the profile, disconnect, and reconnect. Many clients do not replace routes until a new session is established.
Windows VPN profiles can define route lists and a force- or split-tunnel mode. Check the profile’s routing options rather than relying on the client’s status icon. Microsoft describes the result precisely: in split mode, listed routes use the VPN and other traffic uses the physical interface.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
2. Inspect the routing table
The routing table determines which interface receives each packet. On Windows, open Command Prompt and run:
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
route printFind the VPN adapter and inspect the IPv4 routes. For a full tunnel, the VPN should own the intended default route, shown as 0.0.0.0 with mask 0.0.0.0, or otherwise install an equivalent set of routes that covers all destinations. A physical adapter’s default route can remain for the VPN server’s own reachability, but ordinary internet destinations should resolve to the VPN interface.
Compare the route’s interface and metric with the adapter you expect to use. A more-specific route can legitimately win over a default route; that is how split tunneling and private-network exceptions work. If an excluded network has a more-specific physical-interface route, it will bypass the VPN by design.
In WireGuard, open the peer configuration and inspect AllowedIPs. A full IPv4 tunnel normally requires 0.0.0.0/0. If IPv6 is in use, add the IPv6 default route ::/0 as well. A peer configured with a default AllowedIPs route can also trigger WireGuard for Windows’ kill-switch firewall rules, which block traffic that would otherwise leave outside the tunnel. If the configuration contains only a few private subnets, it is a split tunnel, not a full tunnel.
Recommended Free Tools
After editing routes or AllowedIPs, disconnect and reconnect, run route print again, and verify that the new route is present. If the VPN route disappears after sleep, docking, or a network change, the client may need to be reconnected or updated; do not assume the original route remains active.
3. Check DNS as a separate path
Routing web traffic through the VPN does not automatically force DNS queries through it. A local resolver can reveal the network you are using and can return different answers from the VPN’s resolver. OpenVPN’s troubleshooting guidance recommends checking the DNS path and reachability of the VPN DNS server with platform tools.
On Windows, inspect the DNS configuration with:
netsh interface ip show dnsReview every active adapter, including Wi‑Fi, Ethernet, and the VPN interface. The VPN’s DNS server should be reachable through the VPN route, while the physical adapter should not remain the preferred resolver for tunneled queries. If your client exposes a “use VPN DNS” or “prevent DNS leaks” option, enable it for a full-tunnel profile and reconnect.
On macOS, display resolver state with:
scutil --dnsLook for the resolver associated with the VPN service and confirm that it is reachable while the tunnel is active. macOS can maintain multiple resolver scopes, so seeing a local resolver in the output is not by itself proof of a leak; test which resolver answers an actual query and whether the query follows the VPN interface.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
WireGuard documents a Windows multihomed-DNS issue: when several interfaces have DNS settings, queries can be sent to a non-VPN resolver unless the configuration constrains them. Set the tunnel to use the VPN DNS server and apply the client’s leak-prevention setting where available. Do not simply delete every local DNS entry if that would prevent access to required local devices; choose the policy that matches your security requirement.
4. Cover IPv6 or make an intentional IPv4-only policy
Many apparent leaks are IPv6 leaks. If the VPN profile installs only IPv4 routes, an application that prefers IPv6 can connect directly through the ISP or mobile carrier while IPv4 traffic uses the tunnel. Check both public address families while connected.
- For a full WireGuard tunnel, include
0.0.0.0/0for IPv4 and::/0for IPv6 when your service and network support IPv6. - For an operating-system VPN profile, enable its IPv6 tunneling or force-tunnel option and verify the resulting route.
- Disable IPv6 only when that is an intentional, tested policy. It can remove the leak but may break IPv6-only services, local networks, or applications that expect IPv6.
Do not claim success after checking only an IPv4 address. A full-tunnel policy is incomplete until the IPv6 path is either tunneled or deliberately disabled.
5. Review firewall and kill-switch behavior
A kill switch is meant to prevent traffic from leaving through the ordinary interface when the VPN is unavailable, but implementations differ by platform and protocol. One implementation may terminate internet access immediately; another may protect only selected traffic or only while a particular protocol is connected.
Check the client’s documentation and settings for:
- whether the switch applies at startup, during reconnect, and after sleep;
- whether local-network access is exempted;
- whether it covers both IPv4 and IPv6;
- whether it applies to every application or only traffic routed through the VPN profile; and
- whether split tunneling disables or changes the switch.
Proton documents platform and protocol limitations and notes a Linux interaction in which split tunneling must be disabled to use its kill switch. NordVPN describes its kill switch as terminating internet access when disconnected and documents an interaction between split tunneling and the switch. These examples illustrate why the label alone is not a guarantee; read the behavior for your operating system and selected protocol.
Do not disable the operating-system firewall as a troubleshooting shortcut. If the kill switch blocks all traffic after a configuration change, turn off the VPN, restore the previous profile or remove the conflicting rule using the client’s own controls, then reconnect with a known-good route. A temporary loss of connectivity is safer than silently allowing traffic outside a policy that is supposed to prevent leaks.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
6. Reconnect after network transitions
Pause, resume, sleep, wake, Wi‑Fi-to-cellular changes, and roaming can temporarily disengage a tunnel. OpenVPN Connect warns that during pause, resume, and reconnect states— including transitions between Wi‑Fi and cellular data—the tunnel may disengage and network traffic may bypass it.
- Disconnect the VPN completely rather than leaving it paused.
- Wait for the client to report that the session is closed.
- Reconnect on the current network.
- Repeat the IPv4, IPv6, DNS, and private-resource tests.
If leaks occur only after waking a laptop or changing networks, enable the client’s auto-connect or block-outside-traffic option if it provides one, and test the exact transition. A connection that is safe immediately after login but unsafe during roaming is not a reliable full-tunnel configuration.
7. Retest by category and document the result
Run the same checks after every material change. Use a small record so you do not mistake one successful website load for complete coverage:
| Test | What a full-tunnel result should show | If it fails |
|---|---|---|
| Public IPv4 | The VPN egress address rather than the ordinary ISP or carrier address. | Inspect split-tunnel settings, the IPv4 default route, and exclusions. |
| Public IPv6 | The VPN’s IPv6 egress, or no IPv6 connectivity when an intentional IPv4-only policy disables it. | Add ::/0 or correct the IPv6 policy. |
| DNS resolver | The resolver assigned by the VPN policy, reachable through the tunnel. | Inspect adapter resolver scopes and VPN DNS or leak-prevention settings. |
| Private VPN resource | The internal site or service resolves and connects through the VPN. | Check internal routes, VPN DNS, and access permissions. |
| Intentional exclusion | The excluded app or destination remains on the physical interface. | If it no longer bypasses, verify that you did not accidentally remove required split-tunnel policy. |
Testing both a tunneled resource and an intentional exclusion distinguishes a broken tunnel from a policy that is working exactly as configured.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common cases and the right remedy
“My IP address never changes”
First determine whether the browser or application is excluded. If not, inspect the default route and reconnect. A tunnel can be authenticated while the physical adapter still owns the route used for ordinary internet destinations.
“Only some apps bypass the VPN”
Application-based split tunneling is the most likely explanation. Remove the app from the bypass list, disable inverse split tunneling, or switch to a force-tunnel profile. Also check whether the app uses IPv6 or a separately configured proxy.
“DNS tests show my home resolver”
Keep the traffic route and DNS route separate in your diagnosis. Check the VPN DNS assignment with netsh or scutil, then constrain queries to the VPN resolver. A browser’s cached results can make a DNS change appear ineffective; retest after reconnecting and clearing the application’s resolver state.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
“IPv4 is protected but IPv6 is not”
Add the IPv6 default route and confirm that the VPN service supports it. If it does not, an intentional IPv4-only policy can disable IPv6, but test applications and local resources afterward because the change can affect connectivity.
“The internet works until I switch networks”
Treat the transition as a separate state. OpenVPN documents temporary bypass during pause, resume, and reconnect. Enable auto-connect or block-outside-traffic behavior where available, and reconnect manually after a transition if the client cannot enforce that policy.
“The kill switch blocks everything after I enabled split tunneling”
Some implementations cannot combine those policies. Proton documents that split tunneling must be disabled for its Linux kill switch. Restore a supported combination, then test both normal connectivity and the disconnected state before relying on it.
How to evaluate a different VPN client or service
If the current client cannot express the policy you need, compare documented behavior rather than choosing on the basis of a green status icon. The important questions are:
- Full-tunnel control: Can you force a default IPv4 route and, where needed, an IPv6 route?
- Exclusions: Are bypasses controlled by application, destination, port, or subnet, and can you see the resulting routes?
- DNS handling: Does the client assign its own resolver, prevent queries on other interfaces, and explain multihomed behavior?
- IPv4 and IPv6 coverage: Are both address families tunneled, or is IPv6 intentionally blocked?
- LAN access: Can you reach printers, NAS devices, or corporate subnets without undermining the full-tunnel policy?
- Kill-switch semantics: Does protection cover startup, reconnect, sleep, protocol changes, and every application?
- Protocol support: Are the protocols available on your operating system, and do their route and firewall behaviors differ?
- Network changes: What happens after sleep, roaming, Wi‑Fi-to-cellular changes, and a server handoff?
Private Internet Access documents desktop split tunneling with DNS controls; Proton documents protocol and platform limitations; NordVPN documents the interaction between split tunneling and its kill switch. Their documentation demonstrates the level of detail you should expect from any replacement: route scope, DNS behavior, platform support, and failure-state behavior should be explicit.
When the configuration is correct but traffic still bypasses
Check for a second network policy outside the VPN client. A corporate management profile, another VPN, a manually configured proxy, a virtual machine adapter, or security software can install more-specific routes or DNS rules. Disconnect other VPNs, disable a manually configured proxy for the test, and inspect route print again. Re-enable each component one at a time so you can identify which policy changes the route.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Also test with a newly connected session. Cached DNS answers, persistent browser connections, and long-lived application sockets can continue using the path selected before the VPN connected. Closing the application, reconnecting the VPN, and opening a new session removes that ambiguity.
If the VPN route, DNS resolver, IPv6 policy, and firewall state all look correct but a particular service still reports the ordinary address, verify whether that service uses a separate protocol or transport that the VPN profile excludes. Record the destination and protocol, then compare it with the profile’s route and application rules rather than weakening the firewall globally.
Bottom line
A VPN connection indicator reports session status, not universal traffic coverage. Full protection requires an explicit full-tunnel policy, a VPN-owned default route for every address family you use, DNS constrained to the VPN path, and a kill switch whose reconnect behavior matches your threat model. Verify each layer independently after editing the profile and after network transitions; only then is “connected” meaningful evidence that the traffic you care about is actually using the VPN.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →
