A VPN’s green Connected status proves that authentication and the encrypted session succeeded; it does not prove that every connection is entering the tunnel. Split-tunnel rules, an unchanged default route, local DNS, uncovered IPv6, firewall policy, or a reconnect transition can all leave some traffic on your ordinary internet connection. To force a full tunnel, remove bypass rules, verify the VPN owns the default IPv4 and IPv6 routes, direct DNS through the VPN, then retest after reconnecting.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
What a VPN connection actually guarantees
A VPN client normally performs several separate jobs: it authenticates you to a server, creates a virtual network interface, installs routes, selects DNS behavior, and optionally adds firewall rules. The status indicator usually reports the first two jobs. It may not report whether the operating system chose the virtual interface for a particular destination.
As an Amazon Associate I earn from qualifying purchases.
Microsoft’s Windows VPN documentation distinguishes two routing models:
- Split tunneling: specified networks or applications use the VPN, while all other traffic keeps using the physical interface.
- Force tunneling: the VPN receives the default route, so traffic for destinations not otherwise specified is sent through the tunnel.
Split tunneling can be deliberate. A player might keep local multiplayer, a home printer, or a low-latency game service on the normal connection while sending selected destinations through the VPN. If the goal is to hide the public address of every connection, however, an exclusion or split route is the expected explanation for a connected VPN with an unchanged IP.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
First, identify exactly what is bypassing the tunnel
Do not change several settings at once. Test each traffic category so you know whether the fault is routing, DNS, IPv6, or policy.
| Test | What it tells you | Typical interpretation |
|---|---|---|
| Public IPv4 address | Whether IPv4 web traffic exits at the VPN endpoint | An unchanged address points to a default-route or exclusion problem. |
| Public IPv6 address | Whether IPv6 is covered | A different, ordinary ISP IPv6 address means IPv6 is bypassing an IPv4-only tunnel. |
| DNS resolver identity | Where name lookups are sent | A local ISP or router resolver indicates a DNS path outside the VPN, even if web traffic is tunneled. |
| A private resource intended to be reachable through the VPN | Whether the VPN route and access policy work together | Failure can mean a missing route, server-side restriction, or firewall rule. |
| A destination intentionally excluded by split tunneling | Whether the exclusion is active | Success outside the VPN is expected when that destination is on the bypass list. |
Record the result of each test before and after every change. For a game, test the launcher and the game process separately if your client supports application rules; they may not share the same exclusion.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →1. Turn off split tunneling and exclusions when you need a full tunnel
Find the policy that is overriding the default route
Open the VPN profile or client settings and look for labels such as Split tunneling, Excluded applications, Bypass VPN, Allowed networks, or Only these destinations. An exclusion can be defined by application, IP range, hostname, or local-network option. Remove the exception or switch the profile to full-tunnel or force-tunnel mode.
Windows VPN profiles can contain route lists that explicitly send selected networks over the VPN. Microsoft documents that, in a split configuration, routes can be specified for the VPN while all other traffic uses the physical interface. Therefore, a green status and a working VPN-only resource do not contradict an unchanged public IP: both are normal outcomes of a split route.
Decide whether local-network access is worth keeping
Some clients offer a separate Allow LAN traffic setting. Keeping it enabled can preserve access to a local game host or console, but it is an intentional bypass. Disable it if your policy is that every packet, including local-subnet traffic, must be filtered by the VPN. If you need local multiplayer, document that exception rather than treating it as a failed tunnel.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
2. Inspect the routing table instead of trusting the status icon
Windows
- Connect the VPN.
- Open Command Prompt and run
route print. - Locate the VPN virtual interface and inspect the default IPv4 route, shown as
0.0.0.0with a mask of0.0.0.0. - Confirm that the preferred default route points to the VPN interface or its gateway, rather than only to the physical Wi-Fi or Ethernet adapter.
A VPN may install only specific network routes while leaving the ordinary default route preferred. That is split tunneling, not a broken authentication session. If two defaults exist, route metrics determine which one wins; the VPN client’s full-tunnel option should install the preferred route rather than requiring you to delete routes manually.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
WireGuard profiles
WireGuard uses the peer’s AllowedIPs as both a routing declaration and an access-control list. A full IPv4 tunnel normally includes 0.0.0.0/0. If the system uses IPv6 and that traffic must also be tunneled, include ::/0. A profile containing only a private VPN subnet will reach that subnet but will not capture ordinary internet destinations.
WireGuard for Windows explains that a peer with a default AllowedIPs route can also trigger kill-switch firewall rules that block traffic from leaving through another interface. This is useful protection, but it means that an incomplete profile can produce either a leak or a total loss of connectivity, depending on the firewall policy. Correct the profile supplied by the VPN administrator rather than adding arbitrary routes.
Do not “fix” routes by deleting the physical default
Manually removing your Wi-Fi or Ethernet route can break recovery, captive-portal access, or reconnection. Let the VPN client manage route precedence. If a managed work, school, or game-network profile restores its routes after every connection, the profile owner must change the policy; local edits will not be durable.
3. Check DNS separately from ordinary traffic
DNS is a distinct path. A browser can load a site through the VPN while name queries still go to the router or ISP. That exposes the domains you resolve and can also cause a game or launcher to select a region or endpoint based on the wrong resolver.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
Windows diagnostic path
- Keep the VPN connected and use the Windows
netshnetworking diagnostics recommended by the VPN documentation to inspect interface and DNS state. - Identify which resolver addresses are configured on the active interface.
- Check that the VPN-provided DNS server is reachable through the VPN route and that the physical adapter is not still preferred for queries.
If the VPN has a setting such as Use VPN DNS, DNS leak protection, or Block DNS outside tunnel, enable it for a full-tunnel policy. A resolver address alone is not proof of protection: the route to that address must also use the VPN interface.
macOS diagnostic path
On macOS, use scutil while connected to inspect the active DNS configuration and resolver reachability. Compare the result with the VPN profile’s DNS server. A resolver inherited from Wi-Fi or Ethernet indicates that the VPN controls routes but not DNS, or that a higher-priority network service is taking precedence.
Windows multihoming and WireGuard
WireGuard documents Windows multihomed DNS behavior: when several interfaces are active, queries can be sent to more than one resolver unless the configuration constrains them. For a leak-resistant full tunnel, restrict DNS queries to the VPN DNS server and ensure the corresponding route is inside the tunnel. If you intentionally retain local DNS for a LAN service, treat that as an explicit exception.
4. Cover IPv6 or make an intentional policy decision
Many VPN profiles handle IPv4 but leave IPv6 enabled on the physical adapter. Applications that prefer IPv6 can then connect directly even while IPv4 is tunneled. This produces the confusing combination of a VPN-assigned IPv4 address and an unchanged ISP IPv6 address.
Recommended Free Tools
Full-tunnel IPv6
Use a VPN profile that supports IPv6 and installs the IPv6 default route ::/0. Verify that the VPN interface owns that route and repeat the public-address test over IPv6. For WireGuard, the peer’s AllowedIPs must include ::/0 when IPv6 traffic is part of the policy.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
Disabling IPv6
Disabling IPv6 can be an intentional, tested policy choice when the VPN cannot tunnel it, but it is not a universal repair. It can affect local services, enterprise networks, and games that prefer IPv6. Do not disable it permanently merely because an IPv4-only profile is easier to configure; first check whether the client offers IPv6 tunneling or IPv6 leak protection.
5. Verify kill-switch and firewall behavior
A kill switch is designed to block internet access when the VPN disconnects instead of allowing a fallback through Wi-Fi or Ethernet. Implementations differ by operating system and protocol. Some operate only while the client is open; others install persistent firewall rules. Some allow LAN traffic, while others block every non-VPN interface.
Use the kill switch as a safety net, not as proof of routing
With the VPN connected, confirm that ordinary traffic works and that the firewall permits the VPN process and tunnel interface. Then perform a controlled disconnect and verify that internet traffic stops. Reconnect before continuing. If traffic continues during the test, the kill switch is not active for that state, or an excluded application is outside its coverage.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Understand split-tunnel conflicts
Client documentation may impose conditions on combining split tunneling and a kill switch. One documented Linux behavior requires split tunneling to be disabled before the kill switch can operate. Other platforms or protocols may have different limitations. If enabling both causes a total block, follow the client’s stated compatibility rules instead of weakening the firewall.
Never solve a bypass by turning off the operating-system firewall wholesale. Identify the rule, interface, or application exception that permits traffic outside the tunnel and change only that policy.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
6. Reconnect after every route or DNS change
Disconnect and reconnect the VPN after changing split-tunnel settings, AllowedIPs, DNS, IPv6, or firewall options. Existing sockets can retain their original path, and a client may not rebuild routes until a new session is established.
OpenVPN’s troubleshooting guidance warns that pause, resume, and reconnect transitions—including movement between Wi-Fi and cellular data—can temporarily disengage the tunnel and allow direct traffic. A short bypass during a network change is therefore different from a persistent split-tunnel configuration. If privacy during transitions matters, keep the kill switch enabled and retest after the new interface is fully connected.
7. Use the symptom to choose the next fix
| Observed result | Most likely class of problem | Next action |
|---|---|---|
| IPv4 and IPv6 both show the ordinary ISP addresses | No full default route, or an active bypass policy | Disable split tunneling, inspect route print, and confirm the VPN owns both defaults. |
| IPv4 changes but IPv6 remains ordinary | IPv6 is outside the profile | Add ::/0 through an IPv6-capable profile, or deliberately disable IPv6 after assessing the trade-offs. |
| Public IP changes but DNS remains local | DNS is using the physical interface | Enable VPN DNS and leak protection, then verify resolver routing with netsh or scutil. |
| Only one game or launcher bypasses | Application exclusion, separate process rule, or cached connection | Review per-application rules, close the application completely, reconnect, and retest. |
| Everything works until Wi-Fi changes or the computer wakes | Reconnect transition temporarily disengages the tunnel | Use the client’s reconnect and kill-switch controls, then test after the new network is stable. |
| Nothing works when the VPN is connected | Firewall or kill-switch rule is blocking traffic, or the profile has an invalid default route | Check that the tunnel interface is allowed, validate the profile, and temporarily test with documented protection settings rather than disabling the system firewall. |
Forcing all traffic through a VPN: a safe procedure
- Define the scope. Decide whether “all traffic” includes IPv6, local LAN devices, DNS, game launchers, and background services. Write down any exception you deliberately need.
- Select full-tunnel mode. Disable split tunneling and destination or application exclusions in the VPN profile.
- Set complete routes. On Windows, confirm the VPN owns the preferred
0.0.0.0/0route. In WireGuard, useAllowedIPs = 0.0.0.0/0and add::/0when IPv6 is included. - Route DNS through the tunnel. Select the VPN DNS server and enable leak protection. Confirm the resolver is reachable through the VPN interface.
- Enable the kill switch. Check its documented behavior for your platform and protocol, including whether LAN traffic is exempt.
- Reconnect. End the old session and establish a new one so routes, DNS, and firewall rules are rebuilt.
- Run the category tests. Check IPv4, IPv6, DNS, a VPN-only resource, and any intentional exclusion. Save the results for future troubleshooting.
Gaming-specific trade-offs
A full tunnel can change the route and region seen by every game service, while split tunneling can preserve a direct path for a title that is sensitive to latency. Neither mode guarantees a particular ping, matchmaking result, or connection quality. The useful question is which traffic must be protected and which traffic must remain local.
- Protecting only a game process requires an application rule that covers the actual executable, not merely its launcher.
- Keeping LAN access for a console or local host requires an explicit LAN exception and means those packets are not protected by the VPN.
- Changing networks while a match or download is active can trigger the reconnect bypass described by OpenVPN; reconnect before relying on the new path.
- If a game works but its sign-in, voice, or update service does not, test each process and DNS behavior separately rather than assuming the VPN is uniformly applied.
What to compare when replacing a VPN client or service
If the current client cannot express the policy you need, compare capabilities rather than relying on its connected label.
| Capability | Questions to ask |
|---|---|
| Routing mode | Can you choose full tunnel, split tunnel, application exclusions, and destination exclusions independently? |
| IPv4 and IPv6 | Does the profile tunnel both address families, and does it provide an explicit IPv6 leak policy? |
| DNS handling | Can DNS be forced through the tunnel, constrained to a VPN resolver, and blocked on other interfaces? |
| Kill switch | Does it block during disconnect, sleep, network changes, and client shutdown? Are LAN and excluded applications treated separately? |
| Protocol support | Does the client support the protocol and profile format required by your network, including WireGuard or managed Windows VPN profiles? |
| Network transitions | How does it behave after sleep, Wi-Fi changes, cellular handoff, and captive-portal authentication? |
| LAN accessibility | Can local devices remain reachable without silently allowing general internet traffic outside the tunnel? |
Prefer documentation that explains route precedence, DNS selection, IPv6 coverage, and firewall behavior. A provider that only promises a connected icon has not established that your game, DNS queries, and IPv6 sessions all use the tunnel.
When the VPN is connected but the IP still will not change
Work through the order above: remove exclusions, inspect the default route, reconnect, and test IPv4. If the route is correct but the reported address is unchanged, check whether the test application is using a cached connection, a proxy, or a separate process outside the VPN rule. Test with a fresh browser session or newly launched game process after reconnection, then compare both address families and DNS. If only one destination remains direct, it may be an intentional exclusion rather than a failed tunnel.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsHow to document a reliable result
Keep a short record containing the VPN profile name, split-tunnel state, IPv4 and IPv6 route ownership, DNS resolver, kill-switch state, network type, and the five category-test results. Repeat it after a major client update or network change. This turns “connected but bypassing” from a guess based on one web page into a reproducible routing diagnosis.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
