IPv4 and IPv6 in plain terms
The internet runs on two addressing systems. IPv4 addresses look like 203.0.113.42. IPv6 addresses are longer and contain colons, like 2001:db8::1. Many home and mobile connections now support both, and your device can use either depending on the site. A VPN needs to handle both, either by tunnelling IPv6 or by blocking it, or IPv6 traffic can bypass the tunnel.
What this check does
The check asks your browser to contact a service that is reachable only over IPv6. If the request succeeds, the service reports the IPv6 address it saw. Reaching IPv6 is not a leak in itself: what matters is whether that address belongs to your VPN or to your own ISP.
| Result | VPN off | VPN on |
|---|---|---|
| IPv6 reached, address from your ISP | Normal | Likely an IPv6 leak. Investigate. |
| IPv6 reached, address from the VPN | Not applicable | The VPN tunnels IPv6. Expected for providers that support it. |
| IPv6 not reached | Your connection may not have IPv6 | The VPN may be blocking IPv6 as designed, or the check timed out. |
How to test properly
- Run the check with the VPN disconnected and note whether IPv6 is reached and which address appears.
- Connect the VPN and run the check again.
- If the same IPv6 address appears as before, it is your own connection's address, so IPv6 traffic is bypassing the VPN. Check whether split tunnelling excludes your browser, then follow the steps below.
If IPv6 is bypassing your VPN
Look for IPv6 leak protection in your VPN app and turn it on, then update the app. Check the provider's documentation to see whether it tunnels or blocks IPv6. As a last resort, IPv6 can be turned off in your network adapter settings, but write down how to turn it back on, since some networks and services rely on it. Then re-run this check and the DNS leak test.