How Do I Check for and Fix an IPv6 Leak?

Updated

An IPv6 leak happens when your real IPv6 address reaches websites even though you are connected to a VPN. To check for one, open a leak-test page such as ipleak.net while the VPN is on and look at the IP addresses it reports: if you see your ISP's address instead of your VPN's, your system is leaking. To fix it, either block IPv6 in the browser or operating system, or use a VPN client that filters IPv6 traffic itself. The steps below cover detection, the differences between leak types, and the fixes.

Check for an IPv6 leak

  1. Connect to your VPN and confirm the client shows an active connection.
  2. Open ipleak.net in a browser. The page lists the IP addresses it can see, and it separates browser-default addresses from WebRTC-detected ones.
  3. Compare what you see with your expectations:
    • Only the VPN's IP address appears → no leak.
    • Your ISP's IP address appears, especially an IPv6 address → you have a leak.
    • The page shows "JavaScript required" for a section → enable JavaScript, since the IP, WebRTC, DNS, and torrent checks all depend on it.

The site's own guidance states the test plainly: if you are connected to a VPN and you see your ISP IP, your system is leaking. The same logic applies to the DNS section — if your ISP's DNS servers show up among the detected resolvers, DNS requests are leaking.

Read the results correctly

  • IP address section — shows the addresses the site can see directly. An IPv6 address belonging to your ISP here is the core IPv6 leak signal.
  • WebRTC detection — WebRTC implements STUN (Session Traversal Utilities for NAT), a protocol that discovers the public IP address. If you are on a VPN and this section still shows your ISP IP, WebRTC requests are leaking.
  • DNS detection — lists the DNS resolvers your queries reach. ISP DNS servers appearing here means DNS leaks, which is a separate problem from an IPv6 leak even though both expose your real network.
  • Torrent address detection — a separate check for whether your torrent client exposes your real address.

IPv6 leak vs. DNS leak vs. WebRTC leak

These three are often confused because they all reveal information you wanted hidden, but they fail differently and need different fixes.

Leak type What it exposes Where you see it Typical fix
IPv6 leak Your real IPv6 address IP address section of a leak test Disable/block IPv6 in OS or browser, or use a VPN that filters IPv6
DNS leak The DNS servers handling your queries DNS detection section Force VPN DNS, disable IPv6 DNS, or use a VPN with DNS leak protection
WebRTC leak Your public IP via STUN WebRTC detection section Disable WebRTC in the browser

Because IPv6 and DNS leaks can share a root cause — a system that prefers IPv6 and bypasses the VPN tunnel — fixing IPv6 handling often resolves both, but you should re-test each section separately.

Fix an IPv6 leak

Browser-level fixes

The ipleak.net page documents the WebRTC fix for two browsers, which is useful because WebRTC is a common leak channel:

  • Mozilla Firefox: type about:config in the address bar, scroll to media.peerconnection.enabled, and double-click it to set it to false.
  • Google Chrome: the page begins describing a Chrome option but the excerpt cuts off, so treat the Firefox method as the documented example and check Chrome's current privacy settings for the equivalent control.

Disabling WebRTC stops the STUN-based IP discovery, but it does not by itself stop an IPv6 address from being used for normal connections. For that, block IPv6 at the browser or system level.

Operating-system level

Turning off IPv6 on the network adapter prevents the OS from using IPv6 at all, which removes the address a leak test could detect. The exact menu path differs by OS and version, so verify the current location for your system rather than following a fixed path. The trade-off: some services and local networks rely on IPv6, so disabling it can break connectivity in those environments.

VPN-client level

Many VPN clients include an IPv6 leak-protection or "block IPv6" setting that drops IPv6 traffic outside the tunnel instead of disabling it system-wide. This is usually the cleaner option because it keeps IPv6 available for non-VPN use while preventing leaks. Check your client's settings for a leak-protection or IPv6-blocking toggle.

Verify the fix

  1. Reconnect the VPN.
  2. Reload ipleak.net with JavaScript enabled.
  3. Confirm the IP address section shows only the VPN's address and no ISP IPv6 address.
  4. Check the WebRTC and DNS sections again — they should also show VPN-side values, not your ISP's.
  5. If any section still shows your ISP, repeat the corresponding fix and re-test.

Common snags

  • JavaScript disabled — every detection section on ipleak.net needs it; without it you only see partial results.
  • Testing without the VPN connected — the test will show your real address by design, which is not a leak.
  • Fixing one leak and assuming the others are gone — IPv6, DNS, and WebRTC are independent; verify each.
  • Disabling IPv6 system-wide — effective, but it can break IPv6-only services, so prefer a VPN-level block where available.