How do you detect a VPN bypass?
TunnelVision routes your traffic around the tunnel — while the VPN still says “connected.” Here’s the one place it shows, and the Windows command that finds it.
You don’t detect a VPN bypass in the VPN app — the traffic never reaches it. You detect it in your device’s routing table. TunnelVision uses a rogue DHCP server to install routes that send chosen traffic to a device on your network instead of into the tunnel. On Windows, Get-NetRoute shows the rogue route: a next hop that’s a neighbor, not your router.
The VPN says connected. The routing table says your traffic left through the neighbor’s door.
What TunnelVision actually does
When your device joins a network, the DHCP server that gives it an IP address can also give it routes, using a standard feature called option 121. Your operating system trusts them. A rogue DHCP server abuses that to install routes more specific than the VPN’s catch-all route, with the next hop set to the attacker — so that traffic follows the more-specific route out of the tunnel, in the clear.
Nothing is exploited; the OS is obeying DHCP. For the full mechanism, see how TunnelVision works and the related rogue DHCP server attack. This guide is about the other side: how you see it on your own machine.
What a VPN bypass looks like on your device
- A route through a non-router neighbor. Your routing table has an entry whose next hop is a LAN IP that isn’t your gateway — the single strongest signal.
- The tell-tale /1 routes. TunnelVision often installs
0.0.0.0/1and128.0.0.0/1— together, the whole internet — because each is more specific than the VPN’s0.0.0.0/0. - The VPN still says “connected.” The tunnel is genuinely up; the traffic is simply routed around it, so the app and its kill switch see nothing wrong.
- It appears right after joining a network. The routes arrive with your DHCP lease, so the leak starts the moment you connect (or renew).
How to check for a VPN bypass on Windows
Read your routing table and look at the next hops. On a healthy machine there’s essentially one: your router.
# Show IPv4 routes that have a real next hop (skip on-link 0.0.0.0 rows).
Get-NetRoute -AddressFamily IPv4 |
Where-Object { $_.NextHop -ne "0.0.0.0" } |
Format-Table DestinationPrefix, NextHop, RouteMetric
# Find your real gateway to compare against:
Get-NetIPConfiguration | Select-Object InterfaceAlias, IPv4DefaultGateway
# RED FLAG: a route (often 0.0.0.0/1 or 128.0.0.0/1) whose NextHop is a
# LAN address that is NOT your gateway. That traffic is bypassing the VPN.If you find one, note the next-hop IP — that’s the device your traffic is being sent to — and get off the network. The routes are tied to the DHCP lease, so they clear when you leave (or when a clean lease replaces them).
Why a kill switch doesn’t catch it
Most VPN kill switches ask one question: is the tunnel up? Under TunnelVision, the tunnel is up — the leak happens because traffic is routed around it before it ever arrives. The VPN, sitting inside the tunnel, simply never sees the packets that left through the rogue route. Detection has to happen where the attack acts: the routing table, on the network side of the VPN.
It’s also why encryption alone isn’t the answer. A VPN protects what goes through it; it can’t protect what’s steered around it. Knowing your routes are honest is a separate problem from encrypting the tunnel.
Catching it automatically
WifiThreatWatch watches your routing table continuously and alerts the moment a route points your traffic through a device that isn’t your gateway — the exact fingerprint of TunnelVision — naming the destination and the neighbor it’s being sent to. No commands to run, no table to read. Detection is free.
Go deeper: how we detect TunnelVision · rogue DHCP servers · the threats library
VPN bypass: quick answers
Can traffic really leak around a VPN?
Yes. TunnelVision (CVE-2024-3661) uses the network’s DHCP server to install routes on your device that are more specific than the VPN’s route, so chosen traffic follows them out of the tunnel in the clear. The VPN app still shows “connected” because the tunnel itself is fine — the traffic just never enters it. It affects any VPN that relies on the operating system’s routing table, which is almost all of them.
How do I know if my VPN is being bypassed?
The reliable tell is a route in your device’s routing table whose next hop is a device on your local network that isn’t your router. On Windows, run Get-NetRoute and look for extra routes (often 0.0.0.0/1 and 128.0.0.0/1) pointing at a LAN address that isn’t your gateway. A healthy machine routes everything through your router or through the VPN’s virtual adapter — not through a random neighbor.
Does a kill switch stop TunnelVision?
Usually not. Most kill switches watch whether the VPN tunnel is up — and under TunnelVision the tunnel stays up. The leak happens because traffic is routed around the tunnel before it ever gets there, so the kill switch sees nothing wrong. Detecting the rogue routes on the network side is the reliable approach.
What is DHCP option 121?
Option 121 is a standard DHCP feature called “classless static routes.” It lets the server that gives your device its IP address also give it extra routes. It exists for legitimate reasons on complex networks, but on a home network your DHCP server should not be pushing routes that send your traffic through another device. TunnelVision abuses option 121 to install attacker-controlled routes.
Is TunnelVision an attack on the VPN software?
No — and that’s what makes it hard to fix in the app. Nothing about the VPN is exploited. The attacker uses a normal DHCP feature to change your device’s routing table, and your operating system obeys. Because it’s a routing decision made below the VPN, the fix is to notice the malicious route, not to patch the VPN.