IPv4 vs IPv6 Leaks: Why Your VPN Might Not Cover Both

Most internet connections now have two kinds of address: IPv4 (like 203.0.113.7) and IPv6 (like 2001:db8::1). If your VPN only tunnels IPv4, anything your device sends over IPv6 can go around the VPN, exposing your real IPv6 address.

How the leak happens

1. Your internet provider gives your device both an IPv4 and an IPv6 address.
2. Your VPN connects and routes IPv4 traffic through its tunnel.
3. Sites that support IPv6 are reached over IPv6, outside the tunnel.
4. Those sites see your real IPv6 address, which identifies your connection, and your provider sees which sites you visit.

Test for it

1. Connect to your VPN.
2. Visit an IP leak test site, such as ipleak.net or browserleaks.com.
3. Check the IPv6 result. You should see the VPN's IPv6 address, or no IPv6 address at all. If you see one from your own internet provider, you have a leak.

See free VPN leak tests you can run for more.

Fixes

• Turn on IPv6 leak protection in your VPN app, if it has it. It blocks IPv6 traffic while the VPN is on.
• Use a VPN that fully supports IPv6, tunneling both kinds of traffic.
• Turn off IPv6 on your device as a last resort. On Windows, open your network adapter's properties and untick Internet Protocol Version 6. Most sites still work over IPv4, though some services may behave differently.

Other leaks to check at the same time

• DNS leaks: site lookups going to your provider instead of the VPN. See how to test for DNS leaks.
• WebRTC leaks: Chrome's video call technology can reveal your local and public IP addresses, including IPv6. WebRTC Privacy Shield stops this by changing how Chrome handles WebRTC connections.
• Drops: if the VPN disconnects, traffic may flow outside it. A kill switch prevents that. See kill switches explained.

Browser VPN extensions

VPN extensions protect only the browser, and many only handle web traffic, not WebRTC or IPv6 consistently. Test them the same way. See VPN extensions vs VPN apps.

Retest after updating your VPN app, changing networks or moving to a new internet provider, since IPv6 support can change.