How I Built ActiveVPN: A Terminal Tool That Proves (or Exposes) Your VPN

The problem
Your VPN client shows a green "Connected" toggle. That's a marketing claim, not a proof. A tunnel can be up while DNS leaks, IPv6 bypasses the route, or your "anonymous" egress sits in a datacenter that any service can fingerprint.

How ActiveVPN works
The scan collects five groups of signals:

1. Network interfaces — checks psutil.net_if_addrs() against patterns like tun, tap, utun, wg, ipsec, tailscale, zerotier.
2. Processes — iterates running processes and matches them against known VPN/Tor binaries using exact/CLI-token matching (this removed a lot of naive-substring false positives, e.g. "vpn" matching random apps).
3. External IP — queries ip-api.com, ipinfo.io, and ipapi.co in a failover chain for IP, ISP, country, hosting, and proxy flags.
4. DNS — calls edns.ip-api.com to find the resolver IP your DNS queries actually go through.
5. IPv4/IPv6 — fetches both via ipify to spot IPv6 leaks around an IPv4-only tunnel.

Verdict scoring
Each signal has a weight (interface 50, VPN process 40, Tor 35, hosting 25, proxy 30). The sum, capped at 100, maps to:

• 0-19 CLEAN
• 20-39 SUSPICIOUS
• 40-74 LIKELY VPN/PROXY
• 75-100 VPN DETECTED

Extras worth mentioning

• Kill switch: sudo activevpn --kill / --kill-force.
• Watch mode: activevpn --watch 30 with on_change callbacks for VPN-drop alerts.
• History & export: JSON/CSV/TXT from the platform data directory.
• Exit codes (0/1/2) so you can wire it into CI.
• Library API: import activevpn; result = activevpn.scan(); result.verdict.label.
• Docker image + GitHub Pages docs + full pytest suite running on 3 OSes across Python 3.8 and 3.12.

Install
pip install activevpn
activevpn

GitHub: https://github.com/rkriad585/ActiveVPN
Docs: https://rkriad585.github.io/ActiveVPN