VPN Connected but IP Doesn't Change: 2026 Troubleshooting Checklist

Your VPN may show "connected" status, yet websites still see your original IP address. Usually this isn't "magic" and not a reason to reinstall everything: the cause is more often in routes, split tunneling, DNS settings, a device profile, or router policy. Below is a safe diagnostic checklist for Windows, macOS, Android, iPhone, routers and apps like Telegram, YouTube and Discord.

Short answer: what's actually happening

When a VPN connects, it creates a secure tunnel and adds rules telling traffic to go through that tunnel. But the connection status doesn't guarantee that all traffic went through the VPN. In 2026, hybrid setups are increasingly common: split routing, VPN only for selected apps, per-device router policies, Private DNS, iCloud Private Relay, corporate profiles and system exceptions.

So the right question isn't "did the VPN turn on?" but "which traffic is going through the VPN right now, and which is going direct?" For a regular user, this can be checked without complex commands: compare your external IP before/after, check DNS, disable app exceptions, and see whether behavior changes on a different network.

If you want a simple start without overloaded settings, you can use Foli VPN and then run the checklist below: it helps distinguish a server issue from a device or home router issue.

Quick 5-minute diagnostics

The minimum sequence is: reconnect the VPN, change the server, disable split tunneling, check Private DNS/iCloud Private Relay, restart the app, then check the router. Don't start with a full system reset: in most cases it's unnecessary.

1. Split tunneling: some apps go direct

The most common cause is split routing. Split tunneling lets you send only selected apps through the VPN or, conversely, exclude individual apps from the tunnel. This is convenient for banks, the local network, printers, games and work services, but it easily creates confusion: in the browser the IP can be a VPN address, while another app shows your home or mobile one.

On Android, check whether "VPN only for these apps" mode or an exclusion list is selected. On Windows and macOS, similar logic may live in the VPN app, a corporate profile, or client settings. On the router, it's called policy routing, device list, VPN Client list, or per-device routing rules.

If you're already using split routes, keep a separate note: which apps go through the VPN, which go direct, and why. A detailed scenario walkthrough is in Split tunneling VPN: how to enable VPN only for the apps you need.

What to check

• Disable split tunneling for 2–3 minutes and recheck the external IP.
• Make sure the browser, Telegram, Discord, YouTube or the game you need aren't on the exclusion list.
• If VPN is configured on the router, verify that the specific device made it into the VPN client list.
• After rule changes, fully close the app and reopen it: some apps hold on to old connections.

2. The default route doesn't go through the VPN

The tunnel may come up, but the default route can stay the same. Then the device is connected to the VPN server, but regular websites open through your ISP. In OpenVPN documentation this logic is described via gateway redirection (redirect-gateway): if it didn't apply or was forbidden by the profile, internet traffic isn't required to flow through the tunnel. On Windows, a similar issue appears when the VPN profile only works for the remote network, not the whole internet.

A regular user doesn't need to manually edit route tables. It's enough to recognize the symptom: VPN is "green", internal resources or the server itself are accessible, but the external IP on websites doesn't change. That means the profile is set up as a partial tunnel or the routing rule didn't apply.

Safe actions

1. Switch the app's mode from "only selected apps/sites" to full VPN.
2. Recreate the profile from the current app or dashboard if the profile is old.
3. Don't copy random routing commands from forums: they can break access to your local network or corporate VPN.
4. If this is a work VPN, check the rules with your administrator: a partial tunnel may be intentional policy.

3. Android: Always-on VPN, Private DNS and apps outside the profile

Google's Android help describes system VPN settings, including always-on connection and blocking connections without VPN. These features are useful, but if the wrong profile is selected or an app is excluded, the user sees a strange picture: the VPN icon is there, but a specific service behaves as if there's no VPN.

Separately, check Private DNS. It doesn't change your external IP, but it can affect how apps find servers. Because of this, it feels like "the IP didn't change," while the real issue is in the DNS channel or app cache. If Telegram, YouTube or Discord open unstably, compare behavior with automatic DNS and with Private DNS on. More details — in Private DNS and VPN.

Android checklist

• Settings → Network and internet → VPN: check the active profile.
• Temporarily disable "Always-on VPN" and "Block connections without VPN," then turn them back on with the correct profile.
• Check the list of apps that don't use VPN.
• Switch Private DNS to automatic mode for the test.
• Switch from Wi-Fi to mobile data: this quickly separates a phone problem from a router problem.

4. iPhone: VPN profile, Connect on Demand and iCloud Private Relay

On iPhone, VPN is usually managed by a profile or app. It's important to check not just the VPN toggle but the profile itself: an old profile may connect but not route all traffic the way you expect. Apple also separately describes iCloud Private Relay: some sites, networks and services may require seeing the IP address or behave differently with private relay. It's not the same as a VPN, but in real-world troubleshooting these features are often confused.

If Safari shows one behavior and an app shows another, check whether VPN, Private Relay, a content filter, a corporate profile or a DNS app are all on at once. The more privacy layers enabled simultaneously, the harder it is to tell where exactly the route changes.

iPhone checklist

• Open VPN settings and make sure the right profile is active.
• If Connect on Demand is enabled, temporarily disable it and connect the VPN manually.
• Check iCloud Private Relay for Safari and Wi-Fi networks if you use iCloud+.
• Restart Safari/Telegram/Discord after switching profiles.
• Only delete a profile if you have a fresh way to restore it from the app or dashboard.

5. Router: VPN isn't enabled for all devices

On modern routers, the VPN client often works selectively. For example, the Smart TV goes through VPN, the laptop goes direct, the set-top box goes through a different server, and the phone uses mobile data entirely. This is a normal home architecture, but it's exactly what often explains why the IP "doesn't change" on one device.

Check the device list in VPN Client, policy routing rules, and the router's DNS mode. If the router has multiple WAN connections, a guest network or a Mesh system, the device may have ended up in the wrong group. Also remember: if the phone is connected to Wi-Fi but some traffic goes via mobile data or a Wi-Fi assist feature, IP check results may vary.

6. Is the browser showing an old IP because of cache or WebRTC?

Sometimes the issue isn't the VPN but the checking method. One site may cache the result, another shows IPv6, a third determines the region by account, cookies or browser language. So use two different IP checkers and check the actual external IP, not "account country" or YouTube recommendations.

WebRTC and DNS leaks are a separate topic. They don't always mean all traffic is bypassing the VPN, but they can reveal additional network information. For everyday diagnostics it's enough to compare: external IPv4/IPv6, DNS servers and behavior