How an IPv6 Leak Exposes Your Real Address Behind a VPN

An IPv6 leak means the VPN shields the IPv4 path while the same connection also carries IPv6, and that second path skips the tunnel entirely. Websites reached over IPv6 see the address your internet provider handed out rather than the server you picked. Meanwhile the app keeps reporting "connected", and a lookup that checks only IPv4 happily shows the VPN server's address, so a test covering both protocols is the only way to expose the gap.

What the real IPv6 address gives away

An IPv6 address has two halves: the prefix in front, assigned by your provider to your line, and a per-device suffix behind it, which privacy extensions shuffle regularly. Shuffling the suffix changes nothing about the prefix. It still points to your provider, its rough region and your particular subscription, which lets a site link your visits together.

How IPv6 traffic ends up outside the tunnel

The IETF documented both the accidental bypass and the Wi-Fi attack in RFC 7359 (August 2014).

Testing for an IPv6 leak

1. Connect the VPN and wait for the app to confirm it.
2. Open a test page that reports IPv4 and IPv6 addresses separately.
3. Check who owns the IPv6 result, then reconnect and repeat on every network you use: home Wi-Fi, mobile data, hotel networks. Run it again after app or system updates.

Three outcomes are possible. An IPv6 address belonging to your provider means you are leaking. An IPv6 address belonging to the VPN company means the tunnel carries both protocols. No IPv6 shown at all is also fine: it is blocked or switched off. On Linux, ip -6 route tells you whether the default v6 route goes through the tunnel interface.

Closing the leak, and what each fix costs

The clean fix is a VPN that tunnels IPv6: both protocols travel through one connection and sites see the server's address. The app and the server you pick must both support it.

Second option: an app with IPv6 leak protection that drops all v6 traffic while connected. The system falls back to IPv4, and most sites still load because they publish IPv4 records too.

Third option: disable IPv6 on the device. On Windows, untick TCP/IPv6 in the adapter properties. On macOS, set Configure IPv6 to Link-local only. On Linux, use sysctl net.ipv6.conf.all.disable_ipv6=1. Doing it in the router covers every device at once but also affects ones that never touch the VPN, and on networks built around IPv6 some apps may stall; RFC 7359 calls this a temporary workaround. For manual configs, add ::/0 to the WireGuard AllowedIPs line next to 0.0.0.0/0; in OpenVPN use redirect-gateway ipv6 to pull v6 in, or block-ipv6 to refuse it. A kill switch closes the leak only when its rules cover IPv6 as well as IPv4.

What VPNRadarLab's data says

Among the 377 services in the main ranking, 23 publish IPv6 support or leak handling, 4 say partial, 5 say no, and 345 state nothing. Across the full catalogue of 543 consumer VPNs, 26 say they offer it, 9 state they do not offer it, and 508 are silent. Silence means the provider publishes nothing, not that the app leaks. The IPv6 field appears on each service card but scores no points. The kill switch is one of the scored security criteria. The IPv6 ranking lists the services that disclose handling of it.

FAQ

Is turning IPv6 off safe?

For most people yes, nothing visible breaks. Watch for apps that need v6 on mobile or corporate networks.

Does an IPv6 leak expose my exact home address?

No. It reveals your provider, a rough region and your line, enough to correlate visits.

My VPN lacks IPv6 support. Do I have a leak?

Only if your network hands out IPv6 and the app leaves it unblocked. Run the test to find out.

IPv6 leaks in short

The tunnel protects IPv4, IPv6 slips out, and sites see your provider-issued prefix. Test both protocols on every network you use, then fix it by tunnelling IPv6, blocking it in the app or disabling it, and checking that any kill switch rules include IPv6.