How to check that your connection is really protected

A “connected” badge proves nothing. It only says the tunnel was established — whether data actually travels through it, whether your real address is still visible, whether lookups slip past it, the badge does not know. The four checks below take a minute and answer those questions precisely. They do not depend on whose app you use.

1. Did the IP address change

The simplest and most telling check. Open the IP address check before connecting and remember what it says. Then connect and reload the page.

• The address changed to one in the country you picked — traffic goes through the tunnel, all good.
• The address is the same — the connection is not working, whatever the badge looks like. A common cause: the page came from the browser cache, so force-reload it or open it in another tab.

The address the check shows with protection on is the server’s address, and that one, not yours, is what Russian services see. That is why a bank or Gosuslugi may refuse to let you in while protection is on — why and what to do about it. From abroad you may need the opposite, a Russian address: what it changes on Russian sites and where it does not help.

2. Is traffic flowing at all

A tunnel can be established and silent: the network blinked, the server stopped answering, equipment in between dropped the session. From the outside this looks like “connected”, while in fact nothing works.

The check is simple: open a site you have not opened in this session. It loaded — data travels both ways. It did not, while it loads without the tunnel — the connection is dead and needs reconnecting. A detailed account of that case is in “Connected but nothing loads”.

3. Is DNS leaking

Before opening a site, your device asks what its address is — that is a DNS lookup. Sometimes the traffic itself goes through the tunnel while those lookups go straight to the provider's servers. The contents stay encrypted, but the list of sites you visit is fully visible to the provider.

Any public DNS leak test will show it: the list of servers should contain only servers in the country you connected to. If your home provider is in there, you have a leak.

4. Is IPv6 still yours

Modern networks have two kinds of addresses: the familiar IPv4 and the newer IPv6. An app may carry only the first through the tunnel — and then sites that speak IPv6 will see your real address even though everything looks right over IPv4.

The check: open a page that shows both versions. There are two correct outcomes: either both addresses belong to the country you connected to, or IPv6 is not shown at all (the app closed that version entirely). A mixed picture — “IPv4 foreign, IPv6 mine” — is a leak.

For this particular check our own page will not do, and we say so plainly: it shows one address — the one your browser reached it with — and labels which version that is. It has nowhere to get the second one from: the server only knows the connection it was spoken to on. To compare both versions, use a service that deliberately shows them side by side — just as with the DNS check above.

When to repeat the checks

Three moments when the connection is rebuilt and the picture may change:

• A network change — Wi-Fi to mobile and back, the underground, a lift.
• An app update — settings may have moved.
• A change of country — that is a new server and a new route.

What Mayak does on its own

The first and the second check the app performs for you on every connection: it does not trust the fact that a tunnel was established, it makes a real request to the outside and waits for the answer. No answer — the path is dead, and the app tries the next one without asking you (how that ladder works — “One tap, three paths”). If traffic disappears on an already established connection, it says so plainly rather than leaving a “Protected” badge glowing for nothing.

DNS and IPv6 are a matter of tunnel settings. Name lookups go to public resolvers through the tunnel, not straight to your provider's servers; as for IPv6, the outcome is the one called correct above — where an exit speaks IPv6, it is carried through the tunnel alongside IPv4, and where it does not, the second version is closed entirely so that it cannot leak. Checking for yourself is still worth it — nobody's word about your own safety should be taken on trust, ours included.