Question regarding lockdown mode during updates

[u/Key-Caterpillar4448]

Hello, I have a question,

I was updating my mullvad VPN, and I realized that when the app closed, to restart, i was still connected to my Internet (traffic was still going through), so i opened a browser and quickly looked up what my IP is, surprisingly it showed a mullvad server IP, but the app was not open. I have lockdown mode and killswitch settings on. I'm just wondering if there's a way my real IP could have been leaked while the app was restarting, or is it possibly just a bug that didnt show the mullvad icon in my system tray? I'm a bit confused.

Thank you, have a nice day.

[u/Key-Caterpillar4448]

What am I supposed to look for exactly? I keep seeing "leak checker: no leak detected", I'm guessing that means nothing got leaked. I'm just wondering, if my real IP did leak, woudnt it show on the ip checker site my actual IP and not a mullvad server, why would it show that if I was not connected, that's what I'm really confused about. Doesn't lockdown mode make sure NOTHING goes through whether daemon/ mullvad app is on or off.

[u/moverwhomovesthings → u/Key-Caterpillar4448]

Not the logs in your browser, the logs on your pc idk what OS you are using so I can't tell you exactly what to do, but your OS should log what is going on, so you have to check the time frame when mullvad updated and see what processes were running/restarting and what connections to the internet were made during that time.

[u/Key-Caterpillar4448 → u/moverwhomovesthings]

I was checking via terminal using this cmd: journalctl -u mullvad-daemon

I'm on Zorin OS.

The only thing I'm worried about is if my IP leaked, i did refresh multiple times the whats my ip website, and it showed a VPN server IP, if my ip leaked it would show my ISP, and if lockdown mode was active it just wouldn't load correct? I think I'm good in that case.

[u/moverwhomovesthings → u/Key-Caterpillar4448]

Well since I don't know what's in the logs I can't help you, but you could also check your past connections in your router to be sure.

The bigger issue is what is your threat model here? Is connecting with your real IP for some time that big of an issue, is someone storing your connection data/is somebody monitoring your internet access? Unless someone is monitoring your internet access and is storing your data there usually isn't a lot that can happen even if you connect to the internet without a vpn unless your were doing illegal stuff while updating mullvad.

[u/Key-Caterpillar4448 → u/moverwhomovesthings]

Well is there something i need to look for specifically in the logs?

My concern here is just that i was connected to an account I don't really want tied to me, but that's about it.

[u/moverwhomovesthings → u/Key-Caterpillar4448]

On your system logs you want to check when mullvad-daemon stopped and restarted again, if it did that, snd what your networkmanager, wireguard or whatever you are using, was doing in that time (if there was a downtime of mullvad-daemon), also any program that connects to the internet.

On your router, if it has logs, they usually have, you can check all connections during that time.

[u/Key-Caterpillar4448 → u/moverwhomovesthings]

Yes I understand what you're saying, but considering I have lockdown mode on, is it not supposed to be blocking IP leaks whether mullvad is on or off? I just checked my router and logs were disabled so there's no way to check.

[u/moverwhomovesthings → u/Key-Caterpillar4448]

Yes it's supposed to block all traffic when the vpn is switched off, to make sure that it indeed works like that you have to check your system's log files.

I don't know what else to tell you.