Is CyberGhost Leaking Your Real IP?
Connect to CyberGhost, then run the test below. We check IPv4, IPv6, DNS, WebRTC and geolocation consistency - the five channels that can expose you while the app still reports a healthy connection.
What This Test Tells You About CyberGhost
CyberGhost runs its own DNS resolvers and keeps its kill switch permanently enabled on Windows, with no user toggle to disable it. That removes the most common configuration mistake, but it also means the kill switch cannot be turned off when it interferes with a local network service.
The result you see above measures your own connection, right now - your device, your operating system, your version of the app and the server you happen to be on. It is not a verdict on CyberGhost as a product, and it is not a lab benchmark. Leak behaviour varies enormously between platforms and client versions, which is precisely why measuring your own setup beats reading anyone’s provider ranking.
Supported protocols: WireGuard, OpenVPN, IKEv2
CyberGhost Settings That Affect Leak Results
Before concluding anything from a failed row, check these. Most reported leaks turn out to be a setting rather than a defect.
| Setting | Where to find it | What it does |
|---|---|---|
| Kill switch | Always on (Windows) | Not user-configurable in the Windows client. Verify the behaviour rather than looking for a setting. |
| Protocol | Settings → Connection | WireGuard is the default and fastest choice. |
| Content blocker | Settings → Privacy | Blocks ads and trackers at DNS level, changing which resolver answers. |
| Split tunneling | Settings → Connection (Windows/Android) | Excluded apps deliberately use your real IP. |
Setting names and menu locations shift between app versions and platforms. If a control is not where this table says, search the app’s settings for the nearest equivalent term rather than assuming the feature is absent.
Common CyberGhost Leak Scenarios
Local network devices unreachable
The always-on kill switch blocks non-tunnel traffic, which includes printers and NAS devices on your LAN. This is expected behaviour rather than a fault.
The DNS row shows an unexpected resolver
Check whether the content blocker is active - it redirects queries to a filtering resolver by design.
An IPv6 address appears
CyberGhost blocks IPv6 rather than tunnelling it. Any IPv6 address means the block is not covering your interface; disabling IPv6 at OS level is the definitive fix.
How to Read Your Results
Expand any row to see the raw values. The single most reliable way to interpret an ambiguous result is to run the test twice - once with CyberGhost disconnected, once connected. Any value identical across both runs is travelling outside the tunnel.
- IPv4: the ISP and organisation fields should name CyberGhost or its hosting partners, not your home ISP.
- DNS: resolvers should belong to CyberGhost or to a filtering service it operates. Your ISP’s name here means your browsing history is going to your ISP regardless of the tunnel.
- WebRTC: a
192.168.x.xor10.x.x.xaddress is your local network and harmless. A public address differing from your exit IP is a real leak. - IPv6: either nothing at all, or an address belonging to CyberGhost. Anything else escaped the tunnel.
- Geolocation: your browser timezone should match the exit country. A mismatch does not expose your IP, but it marks the session as VPN traffic to streaming services and fraud systems.
Why a Connected VPN Can Still Leak
The word “connected” in any VPN client describes one thing: the IPv4 tunnel came up. It says nothing about DNS resolution, IPv6 routing or WebRTC, each of which uses a different part of the operating system and can bypass the tunnel independently. A client that fails to capture them will still display a green badge.
This is why single-number IP checkers are misleading. They query one endpoint over IPv4, see the VPN’s address, and report success - while DNS queries go to your ISP and your IPv6 prefix identifies your household to every site that supports it.
Re-test after anything that touches the network stack: a client update, an OS upgrade, a protocol change or a new server. Those are the moments when leak protection regresses, and a regression produces no visible symptom at all - which is the entire problem.
🧰 Test CyberGhost Further
Every test runs entirely in your browser - nothing is stored unless you choose to share the result.
CyberGhost Leak Test - FAQ
Provider-specific questions about CyberGhost, its settings, and what a failed check actually means.
Can I turn off CyberGhost’s kill switch?
Not in the Windows client, where it is permanently enabled and has no user-facing toggle. This is defensible - it removes the single most common configuration mistake in VPN use - but it also means you cannot disable it when it blocks access to local network devices such as a printer or NAS. Disconnecting the VPN is the only workaround.
Does CyberGhost leak DNS?
CyberGhost operates its own resolvers and routes DNS through the tunnel, so a healthy connection shows CyberGhost-operated servers. If the content blocker is enabled you will see a filtering resolver instead, which is expected. A genuine leak shows your ISP’s resolver and usually traces to a system-level DNS override or browser DNS-over-HTTPS.
Why can I not reach my printer with CyberGhost connected?
The always-on kill switch blocks all traffic that does not go through the tunnel, and local network traffic falls into that category. Some providers offer a “allow local network access” exception; where CyberGhost does not expose one on your platform, disconnecting the VPN is the only way to reach LAN devices.
Does CyberGhost support IPv6?
No - it blocks IPv6 traffic rather than carrying it through the tunnel. On a correctly working setup the test above shows no IPv6 address at all. If one does appear, the client’s block is not covering your network interface, and disabling IPv6 in your operating system settings is the reliable fix.
How do I test CyberGhost for leaks?
Connect to CyberGhost as you normally would, then run the test at the top of this page. It checks IPv4, IPv6, DNS, WebRTC and geolocation consistency in a single pass. For a definitive reading, run it once disconnected and once connected - any value that stays the same across both runs never entered the tunnel.
Do you store my CyberGhost test results?
Not unless you ask us to. Every check runs in your browser, and by default the results exist only in the page in front of you - closing the tab discards them. After a test you can tick a box to share the result anonymously for our public VPN database; it is off by default. When you do share, we store the outcome, the provider and your exit country - never your IP address.
Is this page affiliated with CyberGhost?
No. VPNMeter is independent and this page is not endorsed by or connected to CyberGhost. We describe settings you can verify in the app yourself, and the test measures your own connection rather than reporting results from a lab. Provider and product names are trademarks of their respective owners.