Privacy Tools Guide

Audit your VPN provider’s claims by running DNS leak tests with dig and dnsleaktest.com, verifying encryption protocols with nmap and wg show, checking for IP leaks via WebRTC and IPv6, and benchmarking real-world speeds with speedtest-cli and iperf3. These open source tools let you independently verify whether a provider’s no-logs, encryption, and performance promises hold up outside of their marketing materials.

Why Audit Your VPN?

VPN providers have significant financial incentives to make their services appear more secure and private than they actually are. Independent audits have revealed discrepancies between marketing claims and reality. By learning to audit your VPN yourself, you gain:

Testing DNS Leak Protection

One of the most critical tests for any VPN is whether it properly routes all DNS requests through its encrypted tunnel. DNS leaks can expose your browsing activity even when connected to a VPN.

Using dnsleaktest.com

The simple DNS Leak Test (dnsleaktest.com) provides a straightforward way to check for DNS leaks:

  1. Note your ISP’s DNS servers before connecting to the VPN
  2. Connect to your VPN and run the extended test on dnsleaktest.com
  3. Review the returned IP addresses—they should all belong to your VPN provider

If you see your ISP’s DNS servers in the results, your VPN has a DNS leak.

Command-Line Testing with dig

For more advanced testing, use the dig command to perform manual DNS lookups:

# Test DNS resolution through your VPN tunnel
dig +short myip.opendns.com @resolver1.opendns.com

# Compare with and without VPN to identify leaks

Open Source DNS Leak Testing Tools

Several open source projects provide DNS leak testing:

Verifying Encryption Standards

VPN providers claim to use “AES-256” or “military-grade encryption,” but you should verify the actual protocols and ciphers in use.

Using nmap for Protocol Analysis

The nmap network scanner can identify what encryption protocols a VPN server supports:

# Scan for OpenVPN ports
nmap -sV -p 1194,443,1723 <VPN_SERVER_IP>

# Check for specific VPN protocols
nmap --script ssl-enum-ciphers -p 443 <VPN_SERVER_IP>

Wireguard-Specific Verification

For WireGuard VPNs, you can verify the handshake and encryption:

# Check WireGuard status
sudo wg show

# Verify active tunnel with wg-quick
sudo wg show wg0 latest-handshakes

The latest-handshakes field shows when the last key exchange occurred. A recent timestamp indicates an active, properly functioning tunnel.

Testing for IP Leaks

Beyond DNS leaks, your real IP address can leak through WebRTC, IPv6, or browser fingerprinting.

WebRTC Leak Testing

WebRTC allows browsers to make direct connections but can expose your real IP. Test for WebRTC leaks using:

To test manually, open the browser console and run:

// Simple WebRTC leak test
const pc = new RTCPeerConnection({iceServers:[]});
pc.createDataChannel('');
console.log(pc.localDescription);
pc.close();

IPv6 Leak Testing

Many VPNs focus on IPv4 traffic, leaving IPv6 connections exposed:

  1. Visit test-ipv6.com with and without your VPN
  2. Compare the results—if you see your real IPv6 address when connected, you have an IPv6 leak
  3. Some VPNs provide IPv6 tunnel features to address this

Speed Testing Methodology

Marketing speed test results often come from optimized servers. Test real-world performance yourself:

Using speedtest-cli

The official Speedtest CLI works from your terminal:

# Install speedtest-cli
pip install speedtest-cli

# Run multiple tests at different times of day
speedtest-cli
speedtest-cli --server 12345  # Test against specific server

iperf3 for Bandwidth Testing

For more technical speed testing between your machine and the VPN server:

# Start iperf3 server on a remote machine
iperf3 -s

# Test throughput through your VPN
iperf3 -c <SERVER_IP> -R  # Reverse direction test

Run tests during different times of day and connect to various server locations to get realistic performance data.

Verifying No-Logs Claims

The ultimate test of privacy is whether your VPN actually keeps no logs. While you cannot definitively prove a no-logs policy from the outside, you can:

Check for Known Log-Keeping Incidents

Search for court cases, subpoenas, or security incidents where VPN providers were forced to reveal user data. Several “no-log” VPNs have been compromised in this way.

Analyze Connection Metadata

Use network analysis tools to see what metadata might be visible:

# Monitor network connections while using VPN
sudo tcpdump -i any -n | grep <VPN_SERVER_IP>

# Check for unexpected DNS queries
sudo tcpdump -i any port 53

If you see unexpected DNS queries or unusual traffic patterns, your VPN may not be as private as claimed.

Using VPN Testing Frameworks

Several frameworks exist for testing VPN security:

Deploying your own test VPN using these tools provides complete visibility into how the technology works.

Building Your Audit Toolkit

Collect these essential tools for ongoing VPN testing:

Tool Purpose Platform
nmap Protocol and port scanning Cross-platform
Wireshark Network traffic analysis Cross-platform
speedtest-cli Speed testing CLI (all platforms)
dig DNS queries Cross-platform
tcpdump Packet capture Linux/macOS
Browserleaks.com Browser leak testing Web-based

Interpreting Your Results

After running tests, evaluate your VPN provider honestly:

Built by theluckystrike — More at zovo.one

Explore Our Developer Guides

© 2026 theluckystrike Developer Guides