What is an IPv6 leak and why does it happen?
An IPv6 leak happens when a VPN tunnel carries only IPv4 traffic while your device also has a working IPv6 connection. Connections to sites that support IPv6 then leave directly from your network, with your real address. Nothing looks wrong to the user, because the sites still open normally.
Two addresses per device
Many networks today give a device two addresses at once. One is IPv4, 32 bits long, and the other is IPv6, 128 bits long, as specified in RFC 8200. This is called dual stack, and each family has its own routing table and default route in the operating system.
A home IPv4 address is usually a private address behind NAT, and on mobile networks it is often shared by many subscribers. An IPv6 address is normally public and reaches the device itself without translation.
Modern devices change the last part of their IPv6 address from time to time, using temporary addresses. Yet RFC 8981, which defines them, points out that the network prefix remains a constant identifier. That prefix is usually assigned by the provider to your line.
How a device gets its IPv6 address and route
IPv6 usually needs no server to hand out addresses. The router sends Router Advertisement messages at regular intervals, carrying the network prefix, and the device does the rest:
- It takes the advertised prefix and appends its interface identifier to form a complete public address. RFC 4862 describes this automatic process.
- It sets the router that sent the advertisement as the default route for IPv6 traffic.
- The advertisement may also carry resolver addresses, through the RDNSS option defined in RFC 8106.
These advertisements keep arriving while the network is up, refreshing the address and the route. So the normal IPv6 route can come back after the tunnel starts, even if the VPN client removed it at first.
Why programs prefer IPv6
Programs do not pick an address family at random. The default policy table in RFC 6724 ranks IPv6 above IPv4 when both are available for the same destination.
Browsers and many other programs also use the Happy Eyeballs algorithm described in RFC 8305. They send the AAAA query first, then the A query, and start connecting over IPv6. They only try IPv4 after a short delay, which the standard suggests should be 250 ms.
That preference is helpful in normal use, but it means any gap in IPv6 coverage is used first, not last.
How the leak happens
- The VPN client adds a route for all IPv4 addresses, such as
0.0.0.0/0, and nothing for IPv6. - The IPv6 default route stays as it was, pointing at the router on your network.
- You open a page on a site that has an AAAA record, and the system picks IPv6 because it ranks higher.
- The connection leaves through the IPv6 default route, outside the tunnel, with your real address.
The same applies to name lookups. If your router advertises a resolver with an IPv6 address, queries may go to it outside the tunnel, which is one form of DNS leak.
The result is a mix that is hard to notice. Some sites see the tunnel's address and others see your real one, depending on whether they support IPv6.
What a leaked address reveals
A leaked IPv6 address reveals what any public address does: the provider, the country and sometimes the city. On top of that, its prefix usually stays fixed for your line, which links your visits together over days.
A single site can see both addresses at once. The page loads two files: one from a name with only an A record, one from a name with only an AAAA record. Comparing the two addresses shows the same visitor with a tunnel address and a home address.
Tunnel setup and the result
| Tunnel setup | Local network | Result |
|---|---|---|
| IPv4 only | No IPv6 | No leak, since the device has no IPv6 route |
| IPv4 only | Has IPv6 | Leaks to every site that supports IPv6 |
| IPv4 in the tunnel, IPv6 routed into it and dropped | Any | No leak; programs fall back to IPv4 after the attempt fails |
| Both families in the tunnel | Any | No leak; sites see the tunnel's IPv6 address |
How to test your connection
Connect the tunnel, then ask a service to return your address over each family separately. In Windows PowerShell, type curl.exe instead of curl:
curl -4 https://api64.ipify.org
curl -6 https://api64.ipify.org- The first command should print the tunnel's address.
- The second should fail, or print an IPv6 address that belongs to the tunnel operator.
- If the second prints an address starting with your provider's prefix, IPv6 traffic is leaking.
On Linux, ip -6 route show default shows the IPv6 default route. Suppose it points at your normal network adapter while the tunnel is up, with no more specific tunnel route. That route is where the leak comes from.
How to prevent IPv6 leaks
- Route IPv6 into the tunnel. In WireGuard, list both families:
AllowedIPs = 0.0.0.0/0, ::/0. If the server has no IPv6, it drops those packets, so they never reach the internet from your network in the clear. What is WireGuard explains the protocol. - Or turn IPv6 off on the device. On Windows, untick Internet Protocol Version 6 (TCP/IPv6) in the network adapter's properties. On Linux,
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1disables it until the next reboot. - Make the kill switch cover both families. Firewall rules for IPv4 alone leave IPv6 open. See Kill switch for details.
- If the tunnel runs on the router, watch its advertisements. If the router keeps advertising an IPv6 prefix from the provider's line to devices at home, their traffic leaves over IPv6 directly, bypassing the tunnel. Turn IPv6 off on the LAN side, or route it into the tunnel.
- Test on every network you use. Your home network may lack IPv6 while mobile data or the office network has it, so the result changes with the network.
IPv6 and syriaproxy
Our network is IPv4 only, and IPv6 is blocked inside the tunnel. Sites therefore see a Syrian IPv4 address in our apps and over WireGuard. WireGuard setup covers the steps for iPhone, Mac and routers.
FAQ
Should I turn IPv6 off permanently?
Not necessarily: it is enough for the tunnel to carry it or block it while the tunnel is up. Turning it off on the device is an acceptable fix. It can, however, break local services that rely on it, such as some home network devices.
Does an IPv6 leak affect a proxy?
A proxy applies to the program it is set in. That program's traffic goes to the proxy whatever the site's address family, and the proxy makes the connection. Other programs stay on your normal connection, over both families.
Does this leak happen on Android?
Less often, because Android by default blocks an address family when the VPN app sets no address, route or DNS server for it. The VpnService.Builder documentation describes this default. The app can allow that family explicitly, though, and it then goes outside the tunnel.
How do I know if my network supports IPv6?
Turn the tunnel off and run the second test command. If it prints an address, your network supports IPv6. Most routers also have an IPv6 section in their settings showing its status.
See the address websites see with the free What is my IP tool, while the tunnel is up.