IPv6 Leak

An IPv6 leak occurs when your connection has both IPv4 and IPv6, but your VPN or proxy only handles IPv4. IPv6 traffic then slips past the tunnel and reaches the destination directly, carrying your real IPv6 address and undoing the anonymity your IPv4 traffic enjoys. It is a close cousin of the DNS leak: the tunnel is working, but a whole class of traffic is quietly routed around it because the configuration did not account for both address families.

The usual defences are to route IPv6 through the tunnel as well, or to disable IPv6 for the duration of the connection so nothing can escape over it. A well-built VPN client handles this automatically, capturing or blocking IPv6 rather than leaving it exposed. As with other leaks, verify rather than assume: run an IP-check tool that reports both your IPv4 and IPv6 addresses while connected, and confirm that neither reveals your origin. Checking both address families is the only way to be sure a dual-stack connection is not leaking around the tunnel.

The fixes are to route IPv6 through the tunnel or to disable IPv6 for the session so nothing can escape over it; a well-built VPN client does one or the other automatically. As with every leak, verify rather than assume: run an IP check that reports both IPv4 and IPv6 while connected and confirm neither reveals your origin. Checking both address families is the only way to be sure a dual-stack connection is not quietly routing around the tunnel.