How to check VPN leaks on a dual-stack connection

Your VPN says it is connected, but that does not always mean every kind of traffic is going through it. On a dual-stack home connection, your internet provider may give you both IPv4 and IPv6 addresses. If the VPN handles one but not the other, some sites could see your home connection's address.

Use the VPN Leak Test with your VPN turned on to check for IPv4, IPv6, and WebRTC exposure. Then use the results to decide whether the issue is the VPN, its settings, or your browser.

Check for a VPN leak

1. Open the VPN Leak Test in the browser you normally use with the VPN.
2. Connect your VPN to the server or location you want to check. Wait until the VPN app says it is connected.
3. Run the check while the VPN stays connected. Do not switch networks or VPN servers during the test.
4. Review the IPv4, IPv6, and WebRTC information separately. Look for an address that appears to come from your home connection rather than the VPN.
5. If something looks wrong, reconnect the VPN and run the check again. A single result can be affected by a brief connection change.

For a useful comparison, keep the same browser and network in use. A VPN leak check is about what the browser can reach while the VPN is on, not how fast your internet connection is.

What the result means

IPv4 appears to use the VPN

The browser's IPv4 traffic appears to be going through the VPN. That is a good sign for IPv4, but it does not tell you whether IPv6 or WebRTC is also handled correctly. Check those results too.

Your home IPv6 address appears

This suggests that IPv6 traffic may be bypassing the VPN. It can happen when your home connection supports IPv6 but the VPN only tunnels IPv4, or when the VPN does not block IPv6 traffic outside its tunnel. Read why a VPN can hide IPv4 but expose IPv6 for more detail.

WebRTC shows an address you do not expect

WebRTC is a browser feature used by services such as voice and video calls. It can reveal network address information as part of setting up a direct connection. Compare the result with the VPN's expected exit connection, not just with the displayed city. VPN locations and IP databases can disagree about geography.

No leak is detected

The test did not find the checked IPv4, IPv6, or WebRTC leak at that moment. This does not prove complete anonymity or test every app on your device. A browser-only VPN extension may also cover only browser traffic, while a VPN app may route traffic from more of the device. See what a VPN test cannot prove about anonymity.

How to fix a leak

1. Confirm the VPN is connected. Open the VPN app and check its connection status. If it disconnected or is reconnecting, connect again and repeat the test.
2. Check the VPN's IPv6 protection. In the VPN app, look for an IPv6 protection, IPv6 leak protection, or traffic blocking setting. Names vary by provider. If there is an option to route IPv6 through the VPN, enable it, then test again.
3. Try another VPN protocol or server. Some VPN configurations handle IPv6 differently. Change one option at a time, reconnect, and rerun the test so you can tell which change helped.
4. Check whether your home connection has IPv6. On Windows 11, open Settings › Network & internet › Advanced network settings › More network adapter options, right-click the active connection, and choose Properties. Check whether Internet Protocol Version 6 (TCP/IPv6) is enabled. On macOS, open System Settings › Network, select Wi-Fi or Ethernet, choose Details, then open TCP/IP. These settings help identify whether IPv6 is available, but turning IPv6 off is not the preferred permanent fix. Ask your VPN provider how its app should handle IPv6.
5. Check browser extensions and privacy settings. Test in a second browser profile with extensions disabled. If the result changes, re-enable extensions one at a time. A WebRTC-blocking setting or extension may reduce exposure, but it can also interfere with calls and other real-time browser features.
6. Update or reinstall the VPN app. Install updates from the VPN provider, restart the device, reconnect, and test again. If the leak remains, send the provider the test details without posting your public address in a public forum.

Why IPv4 and IPv6 need separate checks

IPv4 and IPv6 are different addressing systems. Many home networks can use both at once, a setup often called dual-stack. A VPN may route IPv4 through its encrypted tunnel while IPv6 takes another route, unless the VPN also tunnels or blocks IPv6.

A test on one network cannot guarantee the same result on another. Your router, provider, VPN server, browser, and VPN settings can all affect what the browser sees. If you change your VPN app, network, or browser privacy settings, rerun the check in the setup you actually plan to use.