Most people who know about DNS leaks have never heard of IPv6 leaks — even though they expose the exact same thing: your real identity and location, slipping past a VPN that looks like it's working perfectly. If a VPN only protects IPv4 traffic and ignores IPv6, your device's IPv6 address can leak straight through to every website you visit, completely bypassing the encrypted tunnel.
Table of Contents
IPv4 vs IPv6: The Quick Version
IPv4 is the older addressing system the internet has used for decades, written as four numbers separated by dots (like 192.0.2.1). It has a finite number of possible addresses, and the world has largely run out of new ones. IPv6 is the newer system designed to replace it, with a vastly larger address space, written in a longer hexadecimal format (like 2001:0db8:85a3::8a2e:0370:7334).
Most home networks, mobile carriers, and operating systems now support both IPv4 and IPv6 simultaneously — a setup called dual-stack. Your device will often use whichever one a given connection prefers, sometimes IPv4, sometimes IPv6, without you noticing the difference day to day.
What is an IPv6 Leak?
An IPv6 leak happens when a VPN successfully routes and encrypts your IPv4 traffic through its tunnel, but doesn't account for IPv6 traffic at all. Since your device still has a real, identifying IPv6 address assigned by your ISP, any app, website, or service that connects over IPv6 instead of IPv4 bypasses the VPN entirely — revealing your actual IP address and location exactly as if the VPN weren't running.
This is functionally identical to a DNS leak in terms of risk: your VPN's connection indicator says "Connected" and everything looks secure, while a parallel, unprotected channel quietly leaks your real identity in the background.
Why IPv6 Leaks Happen
- The VPN was built IPv4-only — some older or poorly maintained VPN apps were designed before IPv6 was widespread and were never updated to handle it
- The VPN tunnels IPv4 but doesn't block IPv6 — the app secures one protocol but simply ignores the other instead of blocking it
- Network-level IPv6 preference — many operating systems and networks prefer IPv6 over IPv4 when both are available, increasing the chance that unprotected IPv6 traffic is used instead of the protected IPv4 path
- Mobile carrier networks — many mobile networks have rolled out IPv6 aggressively, making this particularly relevant for VPN apps used primarily on phones
How to Test for an IPv6 Leak
- Connect to your VPN
- Search for an "IPv6 leak test" or "what is my IPv6" tool in your browser
- Check whether an IPv6 address is shown at all, and if so, whether it matches your VPN server or your real ISP-assigned address
✅ No Leak — Good Result
No IPv6 address is detected, or the IPv6 address shown belongs to the VPN provider's network rather than your ISP.
❌ IPv6 Leak Detected
An IPv6 address tied to your real ISP or home network is visible while the VPN shows as connected. Your real identity is exposed over this channel.
Two Ways VPNs Handle IPv6
| Approach | How It Works | Leak Risk |
|---|---|---|
| Tunnel IPv6 traffic | VPN routes both IPv4 and IPv6 through the encrypted tunnel | None, if implemented correctly |
| Block IPv6 entirely | VPN disables IPv6 on the device while connected, forcing all traffic over the protected IPv4 tunnel | None, but loses access to IPv6-only services |
| Ignore IPv6 (no protection) | VPN does nothing with IPv6 — it passes through unencrypted and unmasked | High — this is the leak scenario |
Either of the first two approaches is acceptable from a privacy standpoint. The danger is specifically the third case, where a VPN simply never considered IPv6 in its design.
How CarrotVPN Handles IPv6
- IPv6 traffic is blocked while connected — CarrotVPN disables IPv6 routing on your device for the duration of the session, forcing all traffic over the protected WireGuard® tunnel
- Combined with DNS leak protection — both the DNS and IPv6 leak vectors are closed at the same time, rather than handled separately
- No partial protection — there's no scenario where some of your traffic is protected and some isn't, depending on which protocol a given app happens to use
This approach trades the rare case of needing to reach an IPv6-only destination for the much more common and important guarantee that nothing slips past the tunnel unprotected. For the vast majority of everyday browsing, apps, and services, this makes no noticeable difference — the overwhelming majority of the internet remains fully reachable over IPv4.
No IPv4 Leaks. No IPv6 Leaks. No DNS Leaks.
CarrotVPN closes every common leak vector by default — no settings to configure, nothing to forget.
Download CarrotVPN — Free