IPv4 vs IPv6 for VPN Users

Many people first meet the difference between IPv4 and IPv6 in an unexpected place: a VPN test page that shows two addresses, one that looks like 203.0.113.25 and another that looks like 2001:db8:85a3::8a2e:370:7334. Or a warning that says "IPv6 leak detected" when the app claims to be protecting everything. These pages assume you already know what the two types of address are and why they exist side by side. This article fills that gap for VPN users.

It does not repeat the leak guide, which covers detection in detail in what an IP leak is. The focus here is the more basic question: what are the two address systems, what is your device doing with them, where do they differ in ways that matter for privacy and security, and what should you check on your own setup.

Two numbering systems running at the same time

Every device on the internet needs an address so that replies find their way back. IPv4, described in RFC 791, uses 32-bit numbers written as four groups, such as 203.0.113.25. That gives roughly 4.3 billion possible addresses, a number that sounded enormous in the 1980s and turned out to be far too small once phones, TVs, cameras and bulbs joined the network.

IPv6, specified in RFC 8200, uses 128-bit numbers written in hexadecimal groups, such as 2001:db8:85a3::8a2e:370:7334, where the double colon stands for a run of zeros. The space is so large that every device can have a globally unique address without sharing.

Feature	IPv4	IPv6
Address size	32 bits	128 bits
Example	203.0.113.25	2001:db8:85a3::8a2e:370:7334
Address supply	Exhausted, so addresses are shared	Plentiful
Typical home setup	One public address shared by all devices through NAT	Each device may get its own public address
Local network addresses	Private ranges such as 192.168.x.x (RFC 1918)	Unique local and link-local addresses
Mobile network sharing	Often many users behind one address via carrier-grade NAT	Usually each device has a distinct address
Built-in firewall habit	NAT hides devices by accident	Devices are reachable unless a firewall says no

The internet has been moving from the first to the second for years, and it will keep running both for a long time. Most devices today are dual-stack: they have both kinds of address and use whichever one works best for a given site.

Why IPv4 is shared and IPv6 is not

When IPv4 addresses ran short, networks coped by sharing. At home, your router gets one public address from your provider and hands out private ones (the 192.168 type, defined in RFC 1918) to your devices. The router translates between them, which is NAT. That is why every device in your house appears to websites as one address.

Providers went further. Because they lacked enough public addresses even for customers, many now place customers behind carrier-grade NAT, where hundreds of households share one public address. RFC 6598 reserves a special range, 100.64.0.0/10, for the link between customers and the provider. If your router's WAN address begins with 100.64 to 100.127, you are behind this extra layer.

IPv6 removes the need for all that. There are enough addresses for each device, so the router normally hands out addresses from a block delegated by the provider, and the devices talk to the internet without translation. Many mobile networks now assign IPv6 as the main address and translate to IPv4 only when a site requires it.

This matters to VPN users because what a website sees as "your address" depends on which of the two your device used for that connection, and on how many other people share it.

What your device probably has

Most people have both and do not know. Here is how to find out in a couple of minutes.

1. Open an IP lookup page that shows IPv4 and IPv6 separately. Write down what each reports, or whether IPv6 is reported at all.
2. Check on home Wi-Fi, then on mobile data, because they often differ. Some home providers still give no IPv6, while many mobile operators give IPv6 first.
3. On a computer, open the network details. A line starting with "inet6" or "IPv6 address" shows what the device holds. Addresses starting with fe80 are local to the link and never leave it. A long address starting with 2 or 3 is a public IPv6 address.
4. Look at the router's status page. If it lists a WAN IPv6 address and a delegated prefix, your home has IPv6.
5. Note whether your IPv4 address is in the 100.64 range, which signals shared carrier NAT.

If a test page shows only an IPv4 address and no IPv6, you are on an IPv4-only network. Nothing is wrong. It simply means IPv6 concerns do not apply to that connection today.

How a VPN deals with the two address types

A VPN builds a virtual network interface, and traffic sent into it travels inside the tunnel. The tunnel can be designed to carry IPv4, IPv6 or both. What happens next depends on how the VPN handles each type.

• The tunnel carries both. The VPN gives your device a tunnel address of each kind. Websites see the VPN's addresses, and nothing goes around it. This is the complete arrangement.
• The tunnel carries IPv4 and blocks IPv6. IPv6 packets are dropped on the device, so connections use IPv4 only. This is simple and safe, though a site that is available only over IPv6 will not load.
• The tunnel carries IPv4 only and ignores IPv6. This is the arrangement that causes trouble. The device still has a working IPv6 connection on the local network, and an app or browser that prefers IPv6 sends its traffic out the normal route, outside the tunnel. A website then sees your real IPv6 address, even while the IPv4 side shows the VPN. The full story of that failure is in what an IP leak is.

Devices prefer IPv6 when both work, using a method often called Happy Eyeballs, which tries both and picks the faster. So an IPv4-only tunnel does not just fail to protect IPv6; it fails on the type your device chooses first.

You cannot tell from the outside which design a particular VPN uses, so test it. The steps are further down.

Privacy differences you can actually act on

The two address types give websites different kinds of information about you.

IPv4. At home, a single address represents the whole household and changes from time to time. On a carrier-NAT network, it represents many households at once, so it is a blurry identifier. A VPN replaces it with the VPN's own address, shared with other users.

IPv6. A home usually gets a delegated block, often a /56 or /64, and devices form addresses inside it. The first half stays the same and identifies the household, even if the second half rotates. Operating systems commonly enable privacy extensions, defined in RFC 4941, that generate temporary random interface identifiers. This helps, but it does not hide the prefix. A website that sees the same prefix over weeks can link visits to one household.

This makes a leaked IPv6 address potentially more identifying than a leaked IPv4 address on a shared network. It is still only one signal among many. Browser fingerprints, cookies and logins identify you just as well, as the EFF's tracking test shows. A VPN that correctly handles both address families hides the address layer. It does not hide the rest.

Firewall and exposure differences

With IPv4 behind NAT, your devices have private addresses that the internet cannot reach directly. That is a side effect, not a security design, but it does keep unsolicited connections out. With IPv6, devices can have public addresses, so the protection comes from the router's firewall, which should block unsolicited incoming connections by default.

What to check:

• That your router's IPv6 firewall is on. Most current routers enable it by default, but older firmware may not.
• That consumer devices that you do not intend to expose, such as cameras, printers and storage boxes, are not reachable from the internet. A port scan from outside, using a trusted tool, answers this.
• That remote-access features, including port forwarding, are configured for both address families when you use them. VPN port forwarding explained covers how those rules work.

A VPN does not change the firewall on your home router. It does change where traffic appears to come from, and it routes traffic through the provider's network, which has its own filtering.

Scenarios

The gamer with a smooth connection. Omar plays online on a console at home. The console prefers IPv6 when his provider offers it, and the VPN is only on his laptop. He changes nothing: the game is not routed through the VPN, so his laptop's address types are unrelated to it. Later he uses the VPN on the laptop for work and runs the IP test page. It shows only the VPN's IPv4 address and no IPv6, which is consistent with a tunnel that blocks or handles IPv6.

The traveller on a mobile network. Priya lands abroad and uses a local SIM. The test page shows an IPv6 address but only a shared IPv4 address. Websites that support IPv6 see the first; older ones see the second through a translation step. With the VPN on, both pages show the VPN's addresses. She also notices that one old payment portal fails over IPv6 but works when she turns off IPv6 in the SIM's network settings. That is a site compatibility issue, not a VPN fault.

The remote worker and the leak test. Marcus connects to his VPN and runs a test page. The IPv4 line shows the VPN's address, and the IPv6 line shows an address from his home provider. IPv6 is leaking around the tunnel. He tries the options in order: update the VPN app, reconnect, and check whether the app has a setting to handle IPv6. If it does not, he disables IPv6 on that network adapter as a workaround and retests. After the change, the IPv6 line is empty and the problem is gone.

The student in a dorm. Lin shares a network with hundreds of residents behind carrier NAT. Her IPv4 address is in the shared range, and a streaming site reports unusual activity from her address because other residents used it. A VPN does not change what the other residents do, but it gives her a different address for her own traffic.

What to do about it: a short checklist

1. Run an IP test page that shows both address types with the VPN off. Note the result.
2. Connect the VPN and repeat. You want both lines to show the VPN's addresses or the IPv6 line to be empty.
3. If an IPv6 address from your normal provider appears, update the app, then reconnect.
4. If the problem persists, check the app's settings for anything about IPv6, or consider turning IPv6 off on that network adapter as a temporary workaround.
5. Run the check on every network you regularly use, since home Wi-Fi, mobile data and office Wi-Fi often differ.
6. Retest after operating system updates and app updates, which can change behaviour.
7. Follow up with the full set of checks in how to check if your VPN is working.

If you manage your own router and plan to run a VPN there, VPN router vs VPN app explains how that choice affects which devices are covered.

Common mistakes

• Treating "IPv6 leak" as a sign the VPN is broken, when the setup simply needs a setting changed or an update.
• Disabling IPv6 everywhere permanently without testing, then wondering why some sites are slow or unreachable.
• Checking only one network and assuming the result applies to all of them.
• Confusing a local fe80 address with a public IPv6 address.
• Reading only the IPv4 line on a test page.
• Assuming a shared IPv4 address means the connection is private.
• Believing that IPv6 is somehow always less safe, when it simply needs a firewall rather than NAT.

Summary

IPv4 and IPv6 are two address systems that run side by side. IPv4 is scarce and shared; IPv6 is plentiful and often unique per device. A VPN works well when it carries or blocks both, but an IPv4-only tunnel can leave IPv6 traffic outside it. Check which addresses you have, test with the VPN on across your usual networks, and fix any IPv6 gap by updating the app or adjusting settings. A correct setup hides the address layer; it does not make you anonymous.

If you want a simple way to run these checks on your own devices, the download page links to the free VPNclient app.