Full-tunnel profile checks
The repair project requires one peer, DNS settings and both IPv4 and IPv6 default routes. The initial gateway captures but blocks IPv6 internet traffic instead of advertising native IPv6 support.
Check what leaves the device
Confirm working DNS and the expected external address through your gateway. The operator’s own-domain DNS check is an infrastructure tool; it is not a customer DNS-leak test.