A VPN is working exactly as advertised: your IPv4 address shows a server in a different country, and you feel confident that your real location is hidden. Meanwhile, every website you visit is quietly receiving your real IPv6 address — the one assigned directly by your ISP, tied to your account — because your VPN isn't handling IPv6 at all. This is an IPv6 leak, and it's more common than most VPN users realise.
Understanding IPv4 and IPv6
IPv4 is the original internet addressing system. It uses 32-bit addresses written as four numbers separated by dots, like 203.0.113.47. The total pool of roughly 4.3 billion IPv4 addresses was exhausted years ago, which is why a newer system was needed.
IPv6 uses 128-bit addresses written in hexadecimal notation, providing enough unique addresses for every device on earth to have trillions of its own. Most modern devices, operating systems, and ISPs support both IPv4 and IPv6 simultaneously — a configuration called dual-stack. Your device likely has an IPv4 address and an IPv6 address active at the same time, and either can be used to communicate with compatible sites.
What is an IPv6 leak?
When a VPN connects, it typically creates a virtual network interface that handles all your outgoing traffic. The problem is that many VPN implementations were designed primarily for IPv4, and they handle the IPv6 traffic from your device in one of a few problematic ways.
Some VPNs simply ignore IPv6 entirely. Your IPv4 traffic goes through the encrypted VPN tunnel, but IPv6 traffic is sent directly to its destination through your regular internet connection — bypassing the VPN completely. A website that supports IPv6 (and most major sites do) will receive a connection from your real IPv6 address rather than the VPN server's address.
Other VPNs attempt to disable IPv6, but do so incompletely. On some operating systems, particularly Windows, IPv6 can persist through multiple network interfaces and system settings, making it difficult to fully suppress without careful implementation.
Why this matters more than you might think: Your IPv6 address is often more directly tied to your identity than your IPv4 address. IPv6 addresses are globally unique and assigned to specific ISP accounts. Your IPv4 address is typically shared among thousands of users on your ISP's network, which provides a degree of anonymity. Your IPv6 address often is not.
How to check if you have an IPv6 leak
Testing for an IPv6 leak is straightforward. While connected to your VPN, use our My IP tool to check both your IPv4 and IPv6 addresses. You're looking for two things:
First, confirm that your IPv4 address shows the VPN server's IP — not your ISP's IP. If this is correct, your basic VPN connection is working. Second, check your IPv6 address. If an IPv6 address is shown, and it belongs to your ISP rather than your VPN provider, you have an IPv6 leak.
If no IPv6 address is shown at all, it could mean one of two things: either your ISP doesn't provide IPv6 (still common in some regions), or your VPN is successfully suppressing or tunneling IPv6. You can verify which by disconnecting your VPN and checking again — if an IPv6 address appears without the VPN but not with it, your VPN is handling it correctly.
How to fix an IPv6 leak
Option 1: Switch to a VPN with full IPv6 support. The cleanest solution is using a VPN provider that explicitly tunnels IPv6 traffic through the same encrypted channel as IPv4. ProtonVPN and Mullvad both handle IPv6 correctly by default and are frequently recommended for this reason. When evaluating a VPN, look for explicit mention of "IPv6 leak protection" or "IPv6 tunneling" in the provider's documentation.
Option 2: Disable IPv6 at the system level. If your VPN doesn't support IPv6 tunneling, disabling IPv6 entirely on your device prevents leaks by ensuring there's no IPv6 traffic to leak. This is a widely used workaround, though it means you won't use IPv6 connections even when beneficial.
On Windows:
- Open Network & Internet Settings → Change adapter options
- Right-click your active network adapter → Properties
- Uncheck "Internet Protocol Version 6 (TCP/IPv6)"
- Click OK and repeat for any other active adapters
On macOS:
- Open System Settings → Network
- Select your active connection → Details
- Go to TCP/IP tab → Set "Configure IPv6" to "Off"
- Repeat for each network interface (Wi-Fi, Ethernet)
On Linux (using NetworkManager):
- Edit your network connection settings
- Under IPv6 Settings, set Method to "Disabled"
- Alternatively, add
net.ipv6.conf.all.disable_ipv6=1to/etc/sysctl.conf
Option 3: Enable your VPN's built-in leak protection. Many VPN clients include an IPv6 leak protection toggle in their settings, even if they don't fully tunnel IPv6. This setting typically disables IPv6 on your system automatically when the VPN connects and re-enables it when it disconnects. Check your VPN client's advanced settings or privacy settings panel for this option.
Putting it together
IPv6 leaks are one of the most common ways a VPN provides a false sense of security. The VPN appears to be working — your IPv4 is masked — while your IPv6 address is freely exposing your identity to every dual-stack website you visit. A quick test with any IP check tool can confirm whether you're affected. If you are, the fix is usually straightforward: either enable your VPN's built-in IPv6 handling, disable IPv6 at the system level, or switch to a provider that handles it properly. The test takes a minute; the fix takes five.