IPv6 Leaks and VPNs: A Practical Guide

A VPN promises that the websites you visit see the VPN's address instead of yours. That promise has a quiet loophole. The internet now runs two address systems side by side, and a VPN that handles only one of them can leave the other lane wide open. When traffic slips through that open lane, it is called an IPv6 leak, and many people with a working VPN have one without knowing.

This guide is practical. It explains why the gap exists, what a leaked IPv6 address actually reveals, how to test for it in about five minutes, and what to fix, in order from easiest to most drastic. If you want a broader view of leaks first, see what an IP leak is; here the focus is the IPv6 side only.

Why two address systems create a gap

Every device on the internet needs an address. The older system, IPv4, uses short numbers such as 203.0.113.7 and has run out of space. The newer system, IPv6, defined in RFC 8200, uses much longer addresses and has room for far more devices. The transition has been slow, so most networks today run both at once. This is called dual stack.

On a dual-stack network your device has an IPv4 address and an IPv6 address at the same time. When you open a website that is reachable both ways, your device chooses. Modern systems tend to prefer IPv6 when it works, because it avoids address sharing and is often more direct. Browsers add their own logic to race connections and use the faster one.

Now add a VPN. Many VPN products were built around IPv4. They create a tunnel interface, give it an IPv4 address and send IPv4 traffic through it. IPv6 may be left alone, which means it still travels over the ordinary network connection, outside the tunnel. The result is a split: IPv4 requests exit through the VPN, while IPv6 requests go direct. A site that supports IPv6 sees your real provider-assigned IPv6 address, and so does anyone observing that path.

Three conditions must all be true for this leak to occur: your network provides IPv6, the VPN does not tunnel or block it, and the destination supports IPv6. Remove any one and there is nothing to leak. Many home users meet all three without realising.

What a leaked IPv6 address reveals

An IPv6 address is long, and it is worth seeing what is in it. A typical address has two halves.

• The prefix (the first half). This is assigned by your internet provider to your household or line. It identifies the network, and often your area or provider. Sites that see it can usually tell which provider and rough region you are on, and it is stable for the household over time.
• The interface part (the second half). This identifies the device within your network. Older systems derived it from the hardware address of the network card, which would be a stable label for that device. Modern systems use temporary, randomised addresses for outgoing connections, designed to prevent that kind of long-term tracking.

So a leak does two things. It tells the destination which provider you use, and it gives a stable household identifier in the prefix. It does not give your name, phone number or exact street address, but it contradicts the point of the VPN, because the VPN is meant to replace that information with its own. For what websites generally do and do not learn from your address, see does a VPN hide your IP.

Four ways the leak happens

The same symptom has different causes. Knowing which one applies tells you which fix to try.

Cause	What is going on	Typical sign
VPN handles only IPv4	The tunnel has no IPv6 route, so IPv6 uses the normal connection	Test page shows a VPN IPv4 address and your provider's IPv6 address
IPv6 route added after the tunnel	The system picks a more specific IPv6 route over the VPN's default	Leak appears on some networks but not others
Router sends IPv6 settings	Your router announces IPv6 to the device, which starts using it after the tunnel is up	Leak appears after a router restart or when a new device joins
VPN drops and reconnects	IPv6 keeps working while the tunnel is down	Brief exposure, hard to see on a one-time test

The last row is related to the kill switch, which should stop all traffic when the tunnel drops. Read what a VPN kill switch is to see how the two protections work together, and why a kill switch that ignores IPv6 is only half a kill switch.

A five-minute test

You need a device, a browser, and any IP test page that checks both address types. The EFF's Cover Your Tracks can show a lot about what your browser reveals, and many general IP checkers display IPv4 and IPv6 separately.

1. Record the baseline. With the VPN off, open the test page. Write down the IPv4 address and, if shown, the IPv6 address. These identify your provider. If the page shows no IPv6 address, your connection is probably IPv4-only, and you can stop: there is nothing to leak at the moment.
2. Connect the VPN. Wait until the app shows a stable connection, then reload the test page.
3. Compare. The IPv4 address should be different from your baseline. Check the IPv6 line. There are three outcomes.
   • No IPv6 shown. The VPN is blocking or not offering IPv6. This is a pass.
   • An IPv6 address that differs from your baseline. The VPN tunnels IPv6. This is a pass. Ideally it belongs to the VPN's range, not yours.
   • The same IPv6 address as your baseline. This is a leak.
4. Repeat on another network. Test on home Wi-Fi and on mobile data, because some networks offer IPv6 and others do not. A pass on one tells you nothing about the other.
5. Test a reconnect. Disconnect and reconnect, or switch from Wi-Fi to mobile data with the VPN on, and test again. A good result in one state is not a good result in all.

Our broader guide, how to test a VPN, puts this check alongside the DNS and kill switch tests. For a quick check in the help centre, see how to check if your VPN is working.

Fixes, in order

Try these from top to bottom and retest after each. Stop as soon as the test passes.

1. Update the VPN app and the operating system. Many leaks are fixed by newer builds. This costs nothing and often works.
2. Look in the VPN app's settings for an IPv6 option. Some apps let you block IPv6 while connected or route it through the tunnel. Choose either one rather than neither. Wording varies by app and version, so read the app's own labels, and keep other settings at their defaults unless support advises otherwise.
3. Reconnect and retest. After toggling a setting, disconnect and reconnect so the routes are rebuilt.
4. Disable IPv6 on the network adapter you use. This is the blunt and reliable fix. On most systems it is a per-adapter checkbox or setting in the network options. Wording differs by system and version, so look for the IPv6 entry in the properties of your Wi-Fi or Ethernet connection.
5. Turn off IPv6 at the router. If your router has an IPv6 setting, disabling it stops the whole household from receiving IPv6 settings, which also covers phones, TVs and consoles that cannot be configured individually. Note the original value before you change it.
6. Contact support. If the app has no IPv6 handling and your device refuses to give up the address, ask the provider what it recommends for your device.

None of these steps is dramatic. Disabling IPv6 is a common, reversible workaround that has been used for years, and the vast majority of websites still work over IPv4.

Device notes

Each platform handles IPv6 differently, so the leak looks different.

• Windows. IPv6 is on by default and is configured per adapter. The leak is usually fixed by turning IPv6 off for the adapter in use, or by an app update. Note that disabling it on one adapter does not affect another.
• macOS. IPv6 is set per network service, such as Wi-Fi. The setting can be changed, but it belongs to the service, so a new service needs the same change.
• Android. There is usually no simple on-off switch for IPv6 in the system settings. The reliable fixes are an app that handles it, mobile network settings from your provider where offered, or router-level changes for Wi-Fi.
• iPhone and iPad. There is no ordinary switch for IPv6 either. The practical route is app behaviour, the router for Wi-Fi, and testing on both Wi-Fi and mobile data.
• Router and consoles. Devices that cannot run a VPN app often sit behind a router that provides IPv6. If you run a VPN on the router itself, make sure the IPv6 side is handled there too. See the router setup guide for the broader picture.

Mobile networks and IPv6-only setups

Some mobile providers run IPv6-first. The phone has an IPv6 address, and a translation system provides access to IPv4-only websites. Because of this, you may see an IPv6 address on mobile data even if your home Wi-Fi shows none. This is normal, and it is why tests on both networks matter.

If your mobile network is IPv6-only with translation, disabling IPv6 may not even be possible on the phone, and attempts to do it elsewhere can break connectivity. In that situation the right fix is a VPN app that supports IPv6 properly, not a workaround. If a workaround causes problems, undo it first and test the normal state again.

Side effects and how to undo

Before you disable IPv6 anywhere, note three things.

• Write down the original setting. A screenshot or a line in a notes app is enough.
• Expect little change. Most websites, apps and games still work over IPv4. A few services that prefer IPv6 may feel slightly different.
• Know the undo. Re-enabling is the same step in reverse. If something unrelated breaks, such as a home device on the network, undo the change and test again.

If you manage devices at work, check with the administrator before changing network settings, because company policies and tools may depend on IPv6.

When to re-test

A one-time pass does not last forever. Run the test again:

• After an operating system or VPN app update.
• After moving to a new network, such as a hotel or a new home.
• After changing the router or its firmware.
• After the kill switch or any related setting changes.
• Whenever a test page reports an unexpected provider or location.

Summary

An IPv6 leak happens when a device with IPv6 sends some traffic outside a VPN tunnel that handles only IPv4. It exposes your provider-assigned IPv6 address to websites that support IPv6, which undercuts the main benefit of the VPN. Test by comparing your addresses with the VPN off and on, on more than one network. Fix in order: update, use an IPv6 setting in the app, reconnect, disable IPv6 on the adapter, then at the router, and ask support if none of that works. Retest after any change that could alter your routes.

If you are choosing a VPN pass, you can compare the options on the pricing page.