How to Keep Tor Browser Tests Separate From VPN Traffic

The experiment is not the browser; it is the whole set of paths on the machine while the browser runs. If you change a global proxy or a route to test Tor Browser with a VPN, every other application inherits the change, including the ones syncing files and checking mail in the background. The safe pattern is to give the experiment its own application, its own profile and its own route, and to know exactly how to put everything back. A public-IP page tells you one exit was used; it does not tell you what the rest of the machine did.

Check 1: name the three connections

Name them before touching any setting. The normal path is what your work applications use today; the experimental path is what you want Tor Browser to use; the intended failure behaviour is what should happen when a layer drops.

Write those three down in one place, including which application belongs to which path. The reason is not bureaucracy: most accidental leaks during this kind of test come from an application nobody remembered was running, not from the browser being tested. A password manager, a chat client and a file sync daemon are all background traffic that will take whatever route the system gives them. Naming them is what makes the boundary real.

Check 2: keep each setting with its owning program

Tor Browser's supported configuration is not the same thing as a system proxy setting, and it is deliberately not designed to be pointed at an arbitrary proxy from the environment.

An environment variable or a browser extension can create a third path that neither the browser documentation nor your notes describe. Prefer the supported setting inside the application over a global override.

The same applies to anything the browser hands off. A downloaded document opened in an external viewer does not inherit the browser's route; it uses the system's, which may be the VPN, the LAN or nothing. That handoff is a common and quiet way for content you meant to keep inside the experiment to travel outside it. Decide whether the external viewer is part of the experiment or not, and if it is not, keep the file inside the browser.

Check 3: use a payload that is safe to lose

Network checks should use pages that do not require a personal account, because an account session turns a routing test into an authenticated event on someone's server. A check page that returns your apparent exit is enough for the routing question.

Concretely, curl --socks5-hostname 127.0.0.1:9150 https://check.torproject.org/api/ip exercises the same SOCKS endpoint the browser uses and returns the exit it sees, which separates a browser problem from a Tor problem. ss -tnp on the machine shows which process is talking to which address, and that is the check that catches the application you forgot. Neither command needs a login, and both are repeatable. Keep the results as a before-and-after pair rather than a single observation.

Check 4: restore ordinary use deliberately

Remove test exclusions and temporary settings through the component that created them, not through a different tool that happens to offer a similar switch.

Then check the normal applications, including DNS resolution and any private resource the work path needs. A test that ends with working browsing but broken internal names is not finished.

Keep notes good enough to reproduce a useful finding and no more. Record the VPN profile in use, the app exclusions, the exit addresses observed and the time; do not record account credentials or the contents of pages you visited. If the combination provides no clear benefit, do not leave its extra settings active just because one test page loaded. An experiment that stays in place becomes an undocumented part of the production path.

The Tor Project's guidance on managing identities in Tor Browser is the reference for what the browser keeps separate on its own, and it is worth reading before adding another layer on top.

A test is finished when the intended setup is restored or the new setup is understood, not when one application stops showing an error. Those are different end states and only one of them is safe to leave behind. If you cannot describe the current path of every application you listed in check one, the experiment is still running. Close it deliberately.