What Does a VPN Actually Hide? Independent Verification of AirVPN, WireGuard, DNS and Kill-Switch Behaviour

This paper documents an independent technical verification of a Linux Mint 22.3 virtual machine using AirVPN over WireGuard. Direct routing inspection, packet capture, DNS analysis, controlled physical-interface bypass tests, IPv4 and IPv6 testing, deliberate firewall-startup failure injection, shutdown testing, and reboot verification were used to determine what traffic remained visible outside the VPN tunnel.Version 1.1 substantially extends the original investigation. It clarifies that the tested kill switch was a tester-maintained nftables policy used with wg-quick, not AirVPN Eddie or Network Lock; establishes a known-working non-VPN IPv6 underlay before testing firewall enforcement; demonstrates fail-closed startup using explicit systemd service dependencies; identifies and removes an OUTPUT conntrack rule that permitted an established connection to emit a packet during shutdown; documents how wg-quick and systemd-resolved configured DNS; and provides a sanitized reproducibility package with configurations, software versions, evidence indexes, hashes, and reviewed packet-capture artifacts.The results show that the tested VPN configuration materially reduced destination-related metadata visible to a local observer or ISP while leaving tunnel metadata observable. Client-side testing cannot establish AirVPN's server-side logging practices. Provider no-logging and bare-metal infrastructure statements are therefore distinguished from independently observed results and third-party reporting.