DNS Leak Checker
Running live test…

IPv6 Leak Test – Is Your VPN Exposing Your IPv6 Address?

Many VPNs only tunnel IPv4 traffic, leaving your IPv6 address completely exposed to websites, trackers, and your ISP. This test checks whether your VPN is leaking IPv6 traffic — a common vulnerability that most basic IP leak tests miss entirely.

What Is an IPv6 Leak?

IPv6 (Internet Protocol version 6) is the newer version of the internet protocol designed to replace IPv4. IPv4 addresses are 32-bit numbers that provide roughly 4.3 billion unique addresses — a pool that has been effectively exhausted due to the explosive growth of internet-connected devices. IPv6 uses 128-bit addresses, providing a virtually unlimited address space (340 undecillion addresses). ISPs around the world are progressively rolling out IPv6 alongside IPv4, and many connections now operate in a "dual-stack" mode where both protocols are active simultaneously.

An IPv6 leak occurs when your VPN correctly tunnels all IPv4 traffic through its encrypted servers but fails to handle IPv6 traffic, leaving IPv6 requests to travel directly to your ISP without any VPN protection. This is a widespread vulnerability because many VPN providers were built during the IPv4 era and their tunnelling implementations simply do not account for IPv6. When your device sends a request to an IPv6-enabled website, that request bypasses the VPN entirely — your real IPv6 address is exposed to the website, and your ISP can see the destination.

The privacy implications of an IPv6 leak are significant and often worse than an IPv4 leak. IPv6 addresses are frequently static — your ISP assigns the same IPv6 address to your connection permanently, unlike IPv4 addresses which may change periodically or be shared among multiple users via NAT. A static IPv6 address is a highly reliable identifier that can be used to track your browsing activity across sessions, correlate your behaviour across different websites, and build a persistent profile of your online activity. Your IPv6 address also reveals your ISP and approximate geographic location.

The users most at risk of IPv6 leaks are those on ISPs that have deployed IPv6 connectivity — which is increasingly common in Europe, Asia-Pacific, and the United States. Major ISPs including Comcast, AT&T, Deutsche Telekom, and many Asian providers now assign IPv6 addresses to residential connections by default. Users of budget or free VPNs that do not explicitly document IPv6 support are also at high risk, as are users who have manually configured VPN connections (e.g., through operating system settings rather than official VPN client apps) where IPv6 routing is not configured in the tunnel.

This leak type is particularly dangerous because it is almost always invisible to the user. Most standard IP leak tests and "what is my IP" websites only check for IPv4 addresses. A user can run a basic IP check, see that their VPN's IP address is displayed, and conclude that their VPN is working perfectly — while their IPv6 traffic is simultaneously being sent directly to their ISP completely unprotected. The only way to detect an IPv6 leak is to run a test that specifically checks for IPv6 connectivity, which is exactly what the tool above does.

Does Your VPN Support IPv6 Leak Protection?

IPv6 leak protection is not universal across VPN providers, and the approach each provider takes varies significantly. The safest approach is for a VPN to block all IPv6 traffic entirely when connected — your device communicates exclusively over IPv4 through the VPN tunnel, and any IPv6 requests are silently dropped. The ideal approach is for the VPN to route IPv6 traffic through the tunnel alongside IPv4, providing full protection for both protocols. The most dangerous approach — and unfortunately the most common among budget VPNs — is to simply ignore IPv6 traffic entirely, leaving it to travel directly to your ISP without any interception.

Even within a single VPN provider, IPv6 protection can vary depending on which protocol you're using. WireGuard, the modern VPN protocol adopted by most major providers, has native support for dual-stack IPv4/IPv6 tunnelling and generally handles IPv6 more reliably than older protocols. OpenVPN can support IPv6 but requires explicit configuration that not all providers implement correctly. Legacy protocols like L2TP/IPsec and IKEv2 have inconsistent IPv6 support across platforms. Always check your VPN provider's documentation specifically for IPv6 leak protection rather than assuming it is included.

NordVPN is an example of a provider that takes the safest approach — it blocks all IPv6 traffic by default across every server on every platform. When connected to NordVPN, your device communicates exclusively over IPv4 through the encrypted tunnel, and any IPv6 requests are silently prevented from leaving your device. This means IPv6 leaks are impossible while NordVPN is active, without requiring any manual configuration from the user.

If your VPN provider has no clear IPv6 policy, no mention of IPv6 in their documentation, or their support team cannot give you a definitive answer about how IPv6 traffic is handled, the safest fallback is to disable IPv6 at the operating system level. This ensures that your device cannot send any IPv6 traffic regardless of your VPN's capabilities. The fix steps below include instructions for disabling IPv6 on Windows, macOS, and at the router level.

How to Fix an IPv6 Leak – Step by Step

  1. 1

    Confirm the Leak with the Test Above

    Run the IPv6 leak test at the top of this page while connected to your VPN. If an IPv6 address is detected, your VPN is not protecting IPv6 traffic. Run the test on multiple VPN servers and different networks to confirm the leak is consistent and not a temporary result of a specific server configuration.

  2. 2

    Check Your VPN Settings for an IPv6 Toggle

    Many VPN clients include an IPv6 leak protection setting that may be disabled by default. Open your VPN app's settings and look for options labelled 'IPv6 leak protection', 'Block IPv6', or 'IPv6 traffic'. Enable this setting and reconnect to the VPN. Re-run the test above to confirm the fix.

  3. 3

    Disable IPv6 on Windows

    Open Control Panel → Network and Sharing Center → Change adapter settings. Right-click your active network adapter (Wi-Fi or Ethernet) and select Properties. In the list of networking items, uncheck 'Internet Protocol Version 6 (TCP/IPv6)' and click OK. This disables IPv6 on that specific adapter. Repeat for any other active adapters.

  4. 4

    Disable IPv6 on Mac

    Open System Settings → Network → select your active connection (Wi-Fi or Ethernet) → Details → TCP/IP. Set 'Configure IPv6' to 'Link-Local Only' or 'Off' if available. On older macOS versions: System Preferences → Network → Advanced → TCP/IP → Configure IPv6: Off. You can also disable IPv6 via Terminal with: sudo networksetup -setv6off Wi-Fi

  5. 5

    Switch VPN Protocol to WireGuard

    WireGuard has native dual-stack support and handles IPv6 routing more reliably than older protocols. If your VPN offers WireGuard, switch to it in your VPN settings and re-run the test. VPNs that use WireGuard-based protocols (like NordVPN's NordLynx or ExpressVPN's Lightway) generally have better IPv6 leak prevention than those relying on OpenVPN or IKEv2.

  6. 6

    Try a Different VPN Server and Retest

    Some VPN servers may have different IPv6 configurations than others. Disconnect, select a server in a different country or region, reconnect, and re-run the IPv6 leak test. If the leak only occurs on certain servers, the issue is server-side and should be reported to your VPN provider's support team.

  7. 7

    Disable IPv6 at the Router Level

    If device-level IPv6 disabling doesn't resolve the leak — or if you have many devices to protect — disable IPv6 in your router's settings. Log in to your router's admin panel (usually 192.168.1.1 or 192.168.0.1), navigate to the IPv6 settings section, and disable IPv6 connectivity. This prevents any device on your network from sending IPv6 traffic, providing network-wide protection.

  8. 8

    Switch to a VPN with Explicit IPv6 Leak Protection

    If your current VPN cannot reliably prevent IPv6 leaks after all the above steps, it likely does not have proper IPv6 handling in its implementation. Switch to a VPN provider that explicitly documents IPv6 leak protection and has been independently tested for it. NordVPN, ExpressVPN, and Surfshark all include IPv6 leak prevention by default.

NordVPN blocks all IPv6 traffic by default when connected. This is the safest approach to IPv6 leak prevention — rather than attempting to tunnel IPv6 traffic (which can fail in edge cases), NordVPN ensures no IPv6 traffic leaves your device while the VPN is active. All your traffic is routed exclusively over IPv4 through NordVPN's encrypted tunnel. This means you cannot access IPv6-only resources while connected to NordVPN, but in practice, virtually no websites require IPv6. This default IPv6 blocking works on all platforms without any manual configuration.

Not sure if your DNS is leaking? Find out in seconds.

Run a Free DNS Leak Test Now

Related Guides

VPN Leak TestComplete DNS, IP & WebRTC leak checkDNS Leak CheckerTest your DNS, IP & WebRTC privacyIP Leak TestCheck if your VPN is hiding your real IPIPv6 DNS Leak FixFix IPv6-specific DNS leaksDisable IPv6 WindowsTurn off IPv6 on Windows to stop leaksTorrent Leak TestCheck your VPN for torrent-specific leaksWebRTC Leak TestCheck for browser-level IP exposure

Frequently asked questions

Is leaking IPv6 more dangerous than leaking IPv4?

In many cases, yes. IPv6 addresses are often static and permanently assigned to your connection, unlike IPv4 addresses which frequently change or are shared via NAT. A static IPv6 address can be used as a persistent identifier to track your browsing activity across sessions, websites, and even devices on the same network. Additionally, because IPv6 leaks are rarely tested for, they can persist for months without detection — silently undermining your VPN protection while you believe you're fully covered.

How do I know if my ISP has given me an IPv6 address?

The test above will detect your IPv6 address if one is present. You can also check manually by visiting test-ipv6.com or by opening your device's network settings and looking at your connection details. On Windows, open Command Prompt and type 'ipconfig' — look for an 'IPv6 Address' entry. On macOS, go to System Settings → Network → your connection → Details → TCP/IP. Most major ISPs in Europe, Asia, and the US now assign IPv6 addresses alongside IPv4, often without notifying customers.

Will disabling IPv6 break my internet connection?

No. Disabling IPv6 will not break your internet connection in the vast majority of cases. Almost all websites, services, and applications still support IPv4 and will continue to work normally. Your device will simply use IPv4 exclusively, which is the protocol your VPN is designed to tunnel. In extremely rare cases, some ISP configurations may rely on IPv6 for certain services — but this is uncommon. If you experience connectivity issues after disabling IPv6, you can simply re-enable it.

Do all VPNs protect against IPv6 leaks?

No. Many VPN providers, particularly budget and free VPNs, do not handle IPv6 traffic at all. They tunnel your IPv4 traffic through their servers but leave IPv6 traffic to travel directly to your ISP, completely unprotected. Some VPNs block IPv6 entirely when connected (preventing leaks by disabling IPv6 at the adapter level), while others route IPv6 through the tunnel alongside IPv4. The safest VPNs explicitly document their IPv6 handling policy. If your VPN provider has no mention of IPv6 in their documentation, assume it is not protected.

What is the difference between an IPv6 leak and a DNS leak?

An IPv6 leak exposes your real IPv6 address to websites and services, revealing your identity, ISP, and approximate location through the IP address itself. A DNS leak exposes the websites you visit to your ISP by sending DNS queries outside the VPN tunnel — but your IP address may still be masked. Both are distinct privacy failures that can occur independently. You can have a DNS leak without an IPv6 leak and vice versa. For complete VPN protection, you need to test for and prevent both types of leak.

How do I disable IPv6 on Windows?

Open Control Panel → Network and Sharing Center → Change adapter settings. Right-click your active network adapter (Wi-Fi or Ethernet) and select Properties. In the list of items, uncheck 'Internet Protocol Version 6 (TCP/IPv6)' and click OK. This disables IPv6 on that specific adapter. You may need to repeat this for other adapters if you use both Wi-Fi and Ethernet. Alternatively, you can disable IPv6 system-wide via the Registry Editor by setting the DisabledComponents DWORD to 0xFF under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters.

Does NordVPN support IPv6?

NordVPN blocks all IPv6 traffic by default when connected. This is the safest approach to IPv6 leak prevention — rather than attempting to tunnel IPv6 traffic (which can fail in edge cases), NordVPN ensures no IPv6 traffic leaves your device while the VPN is active. All your traffic is routed exclusively over IPv4 through NordVPN's encrypted tunnel. This means you cannot access IPv6-only resources while connected to NordVPN, but in practice, virtually no websites require IPv6. This default IPv6 blocking works on all platforms without any manual configuration.

Stop leaks for good

A VPN with private DNS on every server, a kill switch and WebRTC protection closes every leak this site tests for.

Get NordVPN →

30-day money-back guarantee · We may earn a commission