How I Built ActiveVPN: A Terminal Tool That Proves (or Exposes) Your VPN
The problem Your VPN client shows a green "Connected" toggle. That's a marketing claim, not a proof. A tunnel can be up while DNS leaks, IPv6 bypasses the route, or your "anonymous" egress sits in a datacenter that any service can fingerprint. How ActiveVPN works The scan collects five groups of signals: Network interfaces — checks psutil.net_if_addrs() against patterns like tun, tap, utun, wg, ipsec, tailscale, zerotier. Processes — iterates running processes and matches them against known VPN/Tor binaries using exact/CLI-token matching (this removed a lot of naive-substring false positives, e.g. "vpn" matching random apps). External IP — queries ip-api.com, ipinfo.io, and ipapi.co in a failover chain for IP, ISP, country, hosting, and proxy flags. DNS — calls edns.ip-api.com to find the resolver IP your DNS queries actually go through. IPv4/IPv6 — fetches both via ipify to spot IPv6 leaks around an IPv4-only tunnel. Verdict scoring Each signal has a weight (interface 50, VPN process 40, Tor 35, hosting 25, proxy 30). The sum, capped at 100, maps to: 0-19 CLEAN 20-39 SUSPICIOUS 40-74 LIKELY VPN/PROXY 75-100 VPN DETECTED Extras worth mentioning Kill switch: sudo activevpn --kill / --kill-force. Watch mode: activevpn --watch 30 with on_change callbacks for VPN-drop alerts. History & export: JSON/CSV/TXT from the platform data directory. Exit codes (0/1/2) so you can wire it into CI. Library API: import activevpn; result = activevpn.scan(); result.verdict.label. Docker image + GitHub Pages docs + full pytest suite running on 3 OSes across Python 3.8 and 3.12. Install pip install activevpn activevpn GitHub: https://github.com/rkriad585/ActiveVPN Docs: https://rkriad585.github.io/ActiveVPN