Browser VPN Extension or Desktop App: Which One Is Running?

The browser shows a foreign address, the mail client still connects from home, and the download tool ignores the VPN entirely. Nothing is broken; three different products are doing three different things. A browser extension can change only browser proxy settings, and a desktop app can capture traffic from many applications, subject to its routing policy. The product name on the icon does not say which one you have.

Read what the icon cannot tell you

Close the companion app, if there is one, and watch the extension. Does it keep proxying, stop working, or ask to start the desktop client? If a companion owns the tunnel, the two indicators may report different kinds of status: one is a browser setting, the other is a tunnel. Check both before concluding anything about coverage.

Extensions in Chrome and Firefox use browser proxy APIs. Those APIs configure the browser, not the operating system. Open the extension's proxy settings page and note whether the mode is fixed, automatic, or controlled by a companion.

So a mail client, a game, or a separate downloader will not use that proxy unless it has its own settings. An OpenVPN profile downloaded from the provider's site still needs a compatible client.

A proxy is not an encrypted tunnel

A proxy is an intermediary path, and whether the hop to it is encrypted is a property of the protocol and its configuration. A SOCKS label by itself guarantees nothing. Correctly validated HTTPS protects browser-to-site content separately, and that protection matters with or without a VPN.

Desktop apps can also exclude specific applications or destinations, so a device-level install is not a promise that every request uses it. List the applications you need and test those, rather than assuming coverage from the installer.

DNS takes a path of its own

Lookups can leave through the browser's secure DNS, the proxy, or the operating system resolver, and those are three different paths. A changed public address in one browser request is not a DNS test. Query a name that only the VPN's resolver should answer, and compare the answer with what the operating system returns outside the browser.

If internal names fail in the browser but resolve in a terminal, the extension is not carrying the lookup. If both fail, the resolver path is the problem and the proxy is a distraction.

Break the connection and watch

In a permitted test, break the connection and watch. Does the browser stop, show an error, or fall back to a direct path? Set that against what the desktop client promises when the tunnel drops, because automatic reconnection and blocking outside the tunnel are different guarantees.

Also review the extension's permissions independently of its transport claims, and install it from the publisher's verified channel. Record which mode the extension reports during the failure test, because that value explains the fallback.

Then choose the setup that covers the task. Device-level access needs a client with a routing policy; one browser tab may only need a proxy. Keeping one understandable policy beats stacking extensions and hoping the sum is protection.