VPN & IP Change Alert

A free, open-source Windows VPN exit IP and DNS change monitor that works without administrator rights.

VPN & IP Change Alert is a persistent desktop reminder that shows the public internet identity your Windows PC is currently using. It answers a simple question before you open a location-sensitive account or developer tool: Did my VPN, public IP address, DNS, ISP, or internet exit location change?

The app compares the current connection with the previous successful check and shows a green, yellow, or red warning. It is designed for corporate VPN users, remote workers, travelers, developers, and anyone whose proxy, ISP, or company network may rotate between different internet gateways.

Download the latest release · Ask a question · Help improve it

VPN & IP Change Alert is an awareness tool, not a security verdict and not a way to bypass organizational or service-provider controls.

Why use a VPN and public IP change alert?

Corporate networks and consumer VPNs can move users between public IP addresses, data centers, regions, DNS servers, and autonomous systems. These changes may be completely legitimate, but they can make an account session appear to come from a different network or location.

This Windows utility keeps the current network identity visible and highlights meaningful changes before the user continues working. It does not modify the network, reconnect a VPN, hide an IP address, or interact with online accounts.

Key features

• Detects the public IP address visible after a VPN or corporate gateway
• Compares IPv4 /24 and IPv6 /48 network blocks
• Shows the estimated city, region, and country of the internet exit
• Monitors ISP and autonomous system number (ASN) changes
• Shows DNS servers configured on the active Windows connection
• Remembers the previous successful network fingerprint
• Runs at Windows sign-in without administrator privileges
• Uses only the Python standard library: no pip install required
• Contains no analytics, advertising, credential access, or traffic inspection

What it detects

Signal	Meaning
Public IP	Address an external service sees after VPN/proxy/gateway routing
IP block	Surrounding IPv4 /24 or IPv6 /48 egress network
Location	Estimated city, region, and country associated with the public IP
ISP / ASN	Organization and autonomous system announcing the address
DNS	DNS servers configured on the active Windows network connection

Alert levels

• Green: the saved network fingerprint is unchanged.
• Yellow: only the exact public IP changed while the broader network identity remained stable.
• Red !: the IP block, region, country, ISP/ASN, or DNS configuration changed. The previous exit location is displayed for context.

Does it detect the IP after a VPN?

Yes. The public-IP lookup travels through the active Windows route, so the reported public IP and location are the internet-facing egress seen after a full-tunnel VPN, proxy, carrier NAT, or corporate gateway.

There are two important limitations:

1. A split-tunnel VPN may route this lookup differently from another application or destination.
2. The DNS value is the resolver configured on Windows. A browser using DNS-over-HTTPS, a proxy, or an upstream corporate resolver may use a different final recursive DNS service.

The app therefore provides a useful warning signal, not proof that every application has the same route. See How the network fingerprint works for details.

Requirements

• Windows 10 or Windows 11
• Python 3.9 or newer
• No administrator access
• No third-party Python packages

Quick start

Download or clone this repository, then double-click:

run-ip-alert.bat

Or run it from PowerShell:

python .\vpn_ip_change_alert.py

The reminder stays visible until the user closes it.

Start automatically at Windows sign-in

Run this command from the project folder:

powershell -ExecutionPolicy Bypass -File .\install-startup.ps1

This creates a shortcut in the current user's Startup folder and requires no administrator access. It waits 12 seconds after sign-in so the desktop and network can initialize.

Remove the startup shortcut with:

powershell -ExecutionPolicy Bypass -File .\uninstall-startup.ps1

If company endpoint protection terminates the program, do not disguise or repeatedly relaunch it. Ask IT whether Python GUI applications and personal Startup-folder shortcuts are permitted.

How comparison works

After every successful lookup, the app saves the network fingerprint to:

%LOCALAPPDATA%\VpnIpChangeAlert\state.json

On the next launch, it compares the current fingerprint with the saved one. Failed lookups do not overwrite the last known state.

The IP block comparison intentionally uses /24 for IPv4 and /48 for IPv6. These are practical change indicators, not claims about the ISP's actual route allocation.

Privacy and network access

• Public IP metadata is requested from ipwho.is.
• View details opens whatismyipaddress.com in the default browser.
• Local DNS configuration is read using ipconfig /all.
• No analytics, account credentials, or browsing activity are collected.
• Network state remains in a JSON file under the current Windows profile.

Review your organization's policies before using external IP lookup services.

Frequently asked questions

How can I get an alert when my VPN IP changes on Windows?

Install VPN & IP Change Alert in your per-user Startup folder. At sign-in, it checks the public IP seen after the active Windows route and compares it with the previous successful check. An exact-IP change is yellow; a broader network, location, ISP/ASN, or DNS change is red.

Is this a public IP address monitor for Windows?

Yes. It is a lightweight public IP address monitor and network-change reminder for Windows 10 and Windows 11. Unlike a background logging service, it keeps a small visible banner on the desktop until the user closes it.

Can it detect a VPN server or VPN location change?

It detects the result of the route change: the new public IP, IP block, estimated geographic location, and ISP/ASN. It cannot identify every VPN product by name, and split-tunnel applications may use different routes.

Why did my public IP change?

Normal causes include corporate egress load balancing, VPN reconnection, ISP DHCP rotation, travel, failover, carrier-grade NAT, and IT routing changes.

Does a red warning mean my account or computer is compromised?

No. Red means that a significant part of the observed network fingerprint changed. Verify the expected VPN and network with your IT team when the change is surprising.

Can this prevent a service from challenging or restricting an account?

No. It can remind you that the apparent network identity changed, but each service applies its own policies and risk controls.

Why can DNS differ from the DNS shown in a browser test?

Browsers, VPN clients, proxies, and security software can use DNS-over-HTTPS or another upstream resolver. The app reports the DNS configured on the active Windows connection.

Does it need administrator rights?

No. Installation is per-user and the application uses read-only network information available to the current account.

Is this an IP address tracker?

It tracks changes only on the local computer where it runs. It does not track other people, collect browsing activity, or send a history to the maintainer.

Documentation

• Network fingerprint and alert logic
• Privacy and security model
• Support
• Contributing
• Launch and sharing kit
• Changelog
• Public roadmap

License

VPN & IP Change Alert is available under the MIT License.