Blog

Why your VPN hides IPv4 but exposes IPv6

Learn why a VPN can hide your IPv4 address but expose IPv6, how to test for a leak, and which settings can stop traffic bypassing the tunnel.

Daniel HayesHardware tests Tests 4 min read

Your VPN appears connected, but a website or privacy test still sees an IPv6 address that belongs to your internet connection. This can happen even when your IPv4 address is hidden. It does not automatically mean the VPN is broken, but it may mean some traffic is taking a route outside the VPN tunnel.

Use the VPN Leak Test while the VPN is connected to check whether your real IP address is exposed through IPv6 or WebRTC. Then use the result to decide whether to change a VPN setting, update the app, or check your device's network configuration.

Check for an IPv6 leak

  1. Connect to your VPN and wait until its app confirms that the connection is active.
  2. Open the VPN Leak Test in the browser you want to check. Keep the VPN connected while the test runs.
  3. Review the addresses the test detects. Look for an IPv6 address that appears to come from your regular internet connection rather than the VPN.
  4. If you use more than one browser or VPN protocol, repeat the check in the affected browser and after switching protocols. Change one thing at a time so you can tell what affected the result.

A website can see the public IP address used for a connection. If you are unsure whether a detected IPv6 address belongs to your VPN, check the VPN app's connection details or support information. Do not post your address publicly.

What the result means

The test detects an IPv6 address outside the VPN

Your device or browser may be sending IPv6 traffic over your ordinary internet connection while IPv4 goes through the VPN. That is an IPv6 leak. It can reveal the public IPv6 address assigned by your internet provider, which may help identify your connection or general location. It does not by itself reveal your name or prove that someone accessed your device.

The test detects only the VPN connection

The test did not find an IPv6 or WebRTC leak in that browser during the check. This is a useful result, but it is not a guarantee that every app, browser, VPN protocol, or network will behave the same way. Repeat the check after changing VPN settings or switching networks.

The test shows a WebRTC address

WebRTC is browser technology used for things like voice and video calls. It can reveal network addresses to a website as part of connection setup. A WebRTC result does not always mean your public IPv6 traffic bypassed the VPN, so consider it separately from a detected public IPv6 address.

How to stop IPv6 traffic bypassing the VPN

  1. Check the VPN's leak protection. In the VPN app, look for a setting that blocks IPv6 leaks or routes IPv6 through the VPN. The name and location vary by provider. If the app offers an IPv6-capable protocol, try it, reconnect, and run the test again.
  2. Update and reconnect the VPN. Install the latest version from your VPN provider, disconnect, then reconnect. An outdated app or a connection that did not finish setting up can leave network traffic outside the tunnel.
  3. Check for split tunneling. Split tunneling sends selected apps or traffic outside the VPN. Review the VPN app's split-tunneling settings and remove the browser from any bypass list, or turn the feature off for a test. Reconnect before checking again.
  4. Check whether IPv6 is enabled on the network adapter. On Windows 11, open Settings › Network & internet › Advanced network settings › More network adapter options. Right-click the active adapter, choose Properties, and check whether Internet Protocol Version 6 (TCP/IPv6) is enabled. On macOS, open System Settings › Network, choose your active connection, select Details › TCP/IP, and review Configure IPv6. Do not change these settings unless you understand the effect on your network or your VPN provider recommends it.
  5. Use system IPv6 changes only as a temporary test. If your VPN provider recommends disabling IPv6, follow its instructions, reconnect, and test again. On Windows, clearing the IPv6 checkbox for the active adapter can be a temporary diagnostic. On macOS, the IPv6 options are under System Settings › Network › Details › TCP/IP. Restore the original setting afterward unless your network administrator or provider advises otherwise.
  6. Contact your VPN provider if the leak remains. Share the VPN protocol, operating system, browser, and test result, but avoid sending a public screenshot that exposes your IP address. Ask whether the service supports IPv6 traffic on your chosen connection.

Why IPv4 can be hidden while IPv6 is exposed

IPv4 and IPv6 are two different systems for addressing devices on a network. Many internet connections can use both. Some VPNs route IPv4 traffic through the encrypted tunnel but do not route IPv6, especially if the VPN service or selected protocol does not support IPv6. The computer may then send IPv6 traffic directly to the internet while IPv4 continues through the VPN.

This is a routing issue, not a sign that encryption has been removed from every connection. A VPN can protect traffic that travels through its tunnel, while traffic that takes another route does not receive that VPN protection. Blocking IPv6 may prevent that route on some setups, but using a VPN that properly handles IPv6 is usually a better long-term fix.

Run the check again after any change, with the VPN connected, and confirm the result in each browser you rely on.

More articles