Blog

How to test for IPv6 leaks while using a VPN

Check whether your VPN exposes your real IPv6 address, learn what the test result means, and fix leaks caused by VPN or browser settings.

Michael ReedHardware tests Tests 5 min read

Your VPN says it is connected, but that does not always mean every kind of internet traffic is going through it. If your internet provider gives you an IPv6 address and the VPN does not handle IPv6 correctly, a website may still see your real network address.

Use the VPN Leak Test while connected to your VPN. It checks for exposure through IPv6 and WebRTC, a browser feature used by some calls and live communication tools. The steps below explain how to read the results and what to change if your address is exposed.

Test for an IPv6 leak

  1. Connect to your VPN and wait for its app or your device settings to show that the connection is active.
  2. Open the VPN Leak Test in the browser you normally use. Wait for the report to finish loading.
  3. Look for any IPv6 address and the WebRTC result. If the report shows an address, note whether it matches your internet provider's address or a baseline you recorded earlier.
  4. If you want a baseline, run the test once with the VPN disconnected, note the addresses, then reconnect and test again. Only do this on a page you trust, and do not post your IP address publicly.
  5. If you use a VPN browser extension rather than a full-device VPN app, check the same browser with the extension on. The extension may protect browser traffic without protecting other apps.

A single result is a useful check, not a guarantee of anonymity. Network changes, VPN server changes, and browser settings can affect what appears, so repeat the test after changing a setting.

What the result means

Your usual IPv6 address appears while the VPN is connected

This points to an IPv6 leak if the address belongs to your normal internet connection rather than the VPN. A VPN can route IPv4 traffic through its tunnel while allowing IPv6 traffic to use your regular connection. The VPN may also lack IPv6 support or fail to block IPv6 when it cannot route it. Check the fixes below, then test again.

An IPv6 address appears, but it is different from your baseline

This does not automatically mean there is a leak. Some VPNs provide their own IPv6 address, which can be a normal part of their service. Check the VPN provider's documentation to see whether it supports IPv6 and what address type to expect. If you cannot tell whether the address belongs to the VPN or your provider, ask the VPN provider before treating the connection as protected.

No IPv6 address appears

The browser did not expose an IPv6 address in that test. This may mean the VPN blocks IPv6, but it may also mean your current internet connection does not provide IPv6 in the first place. If no IPv6 appeared with the VPN disconnected either, the test cannot show whether the VPN would handle IPv6 on a network that supports it.

WebRTC reveals your regular public address

WebRTC can give a website connection details that differ from the address you expect to see through your VPN. A private local address, such as one starting with 192.168, is not your public internet address. If the report identifies your regular public address while the VPN is on, check for a WebRTC exposure and review the VPN or browser settings. For a broader walkthrough of IP exposure, see how to check whether your VPN leaks your IP address.

How to fix an IPv6 leak

  1. Reconnect the VPN. Disconnect, wait a few seconds, and connect again. Check that the app still shows an active connection before you repeat the test.
  2. Turn on IPv6 leak protection. Look in the VPN app for an IPv6 leak protection, IPv6 blocking, or network protection option. The name and location vary by provider. If the app has no IPv6 control, check its support information to confirm whether it routes or blocks IPv6.
  3. Check split tunneling. Split tunneling sends selected apps outside the VPN. Make sure your browser is included in the VPN tunnel, or temporarily turn split tunneling off and test again.
  4. Confirm the VPN is active at the system level. In Windows 11, open Settings › Network & internet › VPN. On macOS, open System Settings › VPN. On iPhone, check Settings › General › VPN & Device Management. On Android, look under Settings › Network & internet › VPN, though wording can vary by device. These screens help confirm the connection state, but the VPN app may have additional controls.
  5. Review browser privacy settings. If only the WebRTC result exposes your public address, check the browser's privacy or site-permission options and the VPN provider's guidance for that browser. Settings differ, so avoid changing unrelated security options based on a guess.
  6. Update or contact the VPN provider. Install available updates and ask whether the service blocks IPv6 when its tunnel cannot carry it. If it cannot protect IPv6, use a VPN service that clearly supports IPv6 or safely blocks it.

Disabling IPv6 across your whole device can cause connection problems and may hide the symptom without fixing the VPN. Prefer a VPN setting designed to route or block IPv6, and test again after changing it.

Why IPv6 needs its own check

IPv4 and IPv6 are two different ways devices address one another on the internet. A website can try to connect using either one. A VPN that protects IPv4 does not necessarily protect IPv6, so seeing a VPN address in one part of a report is not enough to confirm that IPv6 is covered. For more detail, read why a VPN can hide IPv4 but expose IPv6.

The VPN Leak Test checks what addresses the browser can expose while the VPN is on. It cannot prove that every app on your device uses the VPN, or that your VPN provider keeps no activity records.

More articles