How to Fix an IPv6 Leak
A VPN that carries IPv4 only has to block IPv6 too. If it does not, and your connection has working IPv6, that half of your traffic may never enter the tunnel.
🔎 Run the IPv6 leak test⚠️ Confirm it before you change anything
Every step below alters how your machine handles connections, and undoing a change you did not need is harder than not making it. Run the test first so you are fixing something that is actually happening, and run it again after each step so you know which one worked.
What this actually is
A VPN can tunnel IPv4 only and deal with IPv6 by blocking it at the client rather than carrying it. A blocked protocol cannot leak, so that is a legitimate design - right up until the block fails to cover an interface, at which point your real IPv6 address is visible to every site that offers IPv6. A browser prefers IPv6 for any site that offers it, so each of those sites sees the address the tunnel was meant to hide.
Your connection has working IPv6 and it is not going through the VPN. A browser prefers IPv6 for any site that offers it, so those sites see this address rather than your exit node, and the tunnel is bypassed for all of that traffic.
How it shows up
- The leak test shows your IPv4 address on the VPN's network but your IPv6 address on your home or mobile provider's.
- Some sites see your real country while others see the VPN's.
- The IPv4 row passes cleanly, which makes the connection look healthy at a glance.
- It appears on some networks and not others, depending on which of them have IPv6.
Causes, in the order to check them
Work down the list in order. The first is the quickest to check and to undo, and the later ones only apply once it has been ruled out - which stops you disabling things you never needed to touch.
-
1 Your provider blocks IPv6 rather than tunnelling it, and the block is not covering this interface
A VPN that carries IPv4 only has to block IPv6 at the client. A blocked protocol cannot leak - but only where the block applies.
On Windows- Control Panel → Network and Sharing Center → Change adapter settings.
- Right-click your active adapter → Properties → clear "Internet Protocol Version 6 (TCP/IPv6)".
- Re-run this test. Disabling IPv6 at the adapter is the definitive fix when the client-side block is unreliable.
On macOS- System Settings → Network → your connection → Details → TCP/IP → Configure IPv6 → Off (or Link-local only).
- Re-run this test.
Any platform- Disable IPv6 on the network interface itself rather than relying on the VPN client to block it.
- Re-run this test afterwards.
-
2 IPv6 leak protection is switched off in the app
- Look for an IPv6 protection toggle in the VPN app's advanced settings and enable it.
- Reconnect, then re-run this test.
-
3 The router hands out IPv6 independently of the tunnel
- Disable IPv6 on the router if you do not need it, or disable it per-device as above.
- Re-run this test to confirm the address is gone.
🔁 Check whether it worked
Run it again after each change rather than at the end. Two steps applied together tell you nothing about which one mattered - and one of them may have been unnecessary.
🔎 Run the IPv6 leak testAn IPv6 address is visible outside the tunnel - FAQ
The questions that follow from it.
Should I just disable IPv6 completely?
On a machine using a VPN that does not tunnel IPv6, yes - it is the definitive fix, and it removes the possibility rather than relying on the client to catch it every time. The cost: a service reachable only over IPv6 stops working while IPv6 is off. Try it, and turn it back on if something you use breaks, or if you stop using that VPN.
My VPN says it has IPv6 leak protection. Why am I still leaking?
That feature blocks IPv6 traffic rather than routing it, and the block is applied to the interfaces the client knows about. A second adapter, a virtual interface from another application, or a network stack the client did not enumerate can leave a path it never covered. It is also occasionally switched off by an update. Testing is the only way to know it is doing what the toggle claims.
Does an IPv6 leak expose more than my IP address?
The address itself is the exposure, and it is a worse one than an IPv4 address in a particular way: an IPv6 block can be assigned to one subscriber rather than shared through carrier-grade NAT, so it can identify a household more precisely than the IPv4 address the same line presents. It is also stable for long periods, which makes it usable for linking sessions over time.
Why does the leak only happen at home?
Because IPv6 has to be available for it to leak. Some networks give you IPv4 only, in which case there is nothing to escape and the test passes without your configuration being any better. Move to a network with working IPv6 and the same setup starts leaking. A pass on one network is not a pass everywhere.
🧰 Test it yourself
The tests run in your browser. Where one needs to know whose network an address is on, our server looks it up and keeps no address. Nothing is stored unless you choose to share the result.
📚 Read next
The longer version: what this test is looking for, and what to do with the answer.