IPv6 leak
Traffic that goes out over IPv6 outside a tunnel or proxy that only carries IPv4, so sites see your real IPv6 address. Nothing fails, so nothing warns you.
Updated 19 September 2026 · 7 primary sources
An IPv6 leak happens when a device has working IPv6 but the tunnel it relies on carries only IPv4. Traffic that goes out over IPv6 skips the tunnel, and the site at the other end sees the device's real IPv6 address. The page still loads, so nothing warns you.
It follows from two defaults. Devices prefer IPv6 when they have it, and many tunnels change only the IPv4 routes. In a 2015 study of 14 popular VPN services, 11 of their desktop apps leaked all IPv6 traffic. The IETF described the problem in August 2014. Traffic meant for the tunnel may "leak out of such a tunnel" and travel in the clear.
How an IPv6 leak happens
Picture a laptop on a home network that offers both IPv4 and IPv6, running a VPN app that handles only IPv4. The laptop asks DNS for both records of a dual-stack site, prefers the IPv6 address and sends the connection out of its normal interface. The VPN never sees it.
The 2015 study named the cause plainly: the system's preference for IPv6, and a VPN app that left the IPv6 routing table unchanged. A network without IPv6 is no guarantee either. A hostile router can switch IPv6 on by announcing it, and the same leak follows.
How the leak was documented
The IETF documented tunnel leaks in dual-stack networks in August 2014, in RFC 7359 by Fernando Gont. Its advice was to send IPv6 through the tunnel too. Disabling IPv6 on the device was only "a temporary workaround" for tunnel software that cannot.
The 2015 study, from Sapienza University of Rome and Queen Mary University of London, measured it across 14 services. It found iOS safe at the time, because iOS switched IPv6 off while a VPN was running, and every Android app it tested leaking. Of the 14 services, it knew of one that even mentioned IPv6 leak protection.
IPv4-only sites leak too
A site without IPv6 can still trigger the leak, because its pages load scripts, fonts and images from other hosts. The 2015 study checked the IPv4-only sites among the 1,000 most popular. Of those, 92 percent embedded objects from at least one such third party. Each of those requests also names the page you are on, in its Referer header.
We checked the same thing on 19 September 2026 for the 122 IPv4-only sites our proxy guides cover. Of the 75 homepages we could read, 56 (74.7 percent) loaded at least one resource from a host that answers over IPv6. That includes the homepages of Walmart, Nike, GitHub and Target. We read the HTML only, without running scripts, so the real share is at least this high.
| Third-party domain | Homepages |
|---|---|
| googletagmanager.com | 25 |
| googleapis.com | 10 |
| google.com | 10 |
| cloudfront.net | 9 |
| cookielaw.org | 8 |
| cloudinary.com | 7 |
| doubleclick.net | 6 |
| gstatic.com | 6 |
IPv6 leaks and proxies
A proxy set in the browser does not leak by address family. Chrome defers name resolution to an HTTP proxy, and with a SOCKS5 proxy it will "always use proxy side resolution". It connects only to the proxy, so a site's IPv6 address never enters the picture.
What goes around a browser proxy is traffic it does not carry. WebRTC calls use UDP, which Chrome's SOCKS5 support "cannot be used to relay". Other apps on the device use their own settings. Tools that work by changing routes, as VPN apps do, can leak IPv6 whenever they carry IPv4 only.
An IPv6 leak also says more than an IPv4 one. IPv6 addresses are almost never shared, because IPv6 networks rarely use NAT. A leaked address therefore tends to point to one home network rather than to a crowd behind carrier-grade NAT.
How HProxy handles it
Our proxy leak test checks for this. It flags an IPv6 exposure when a site sees you over one address family while your browser also has a working address in the other.
Frequently asked questions
What is an IPv6 leak?
Traffic that leaves your device over IPv6 outside a VPN or tunnel that only carries IPv4. The site you visit sees your real IPv6 address instead of the tunnel's, and nothing on screen shows it.
How do I test for an IPv6 leak?
Connect the tunnel or proxy, then open a test page that answers over both IPv4 and IPv6 and compare the addresses it reports. If the IPv6 address belongs to your own provider, IPv6 is leaking. Our proxy leak test runs this check.
Should I disable IPv6 to stop leaks?
It works, and the IETF accepts it as a temporary workaround. The proper fix is a tunnel that carries IPv6 too, or one that blocks IPv6 while connected. None of the 202 sites our proxy guides cover is IPv6 only, so disabling it costs little reach.
Does a proxy leak my IPv6 address?
A proxy set in your browser does not: Chrome lets an HTTP or SOCKS5 proxy resolve every name and connects only to the proxy. WebRTC traffic and apps that do not use the proxy can still go out directly, over IPv4 or IPv6.
Can an IPv4-only website cause an IPv6 leak?
Yes. Its pages load resources from other hosts, and many of those answer over IPv6. Of 75 IPv4-only homepages we read, 56 loaded at least one such resource, most often Google Tag Manager.
Is an IPv6 leak worse than an IPv4 leak?
In one way. IPv4 addresses are often shared by many customers behind carrier-grade NAT, while an IPv6 address almost never is. A leaked IPv6 address therefore tends to point to one home network.
What is the difference between a DNS leak and an IPv6 leak?
A DNS leak exposes the names you look up to a resolver outside the tunnel. An IPv6 leak sends the traffic itself outside it. An IPv6 path outside the tunnel can carry DNS queries too, so one can bring the other.
Sources
- RFC 7359: Layer 3 Virtual Private Network (VPN) Tunnel Traffic Leakages in Dual-Stack Hosts/Networks, IETF, 2014-08.
- A Glance through the VPN Looking Glass: IPv6 Leakage and DNS Hijacking in Commercial VPN clients (PoPETs 2015), Perta, Barbera, Tyson, Haddadi, Mei, 2015.
- RFC 6724: Default Address Selection for Internet Protocol Version 6 (IPv6), IETF, 2012-09.
- Proxy support in Chrome (net/docs/proxy.md), Chromium, 2026-09-19.
- Wikipedia:Blocking IP addresses, English Wikipedia, 2026-09-13.
- IPv6 support of the 202 sites covered by our proxy guides, HProxy measurement, 2026-09-19.
- Third-party hosts with IPv6 on 75 IPv4-only homepages, HProxy measurement, 2026-09-19.
Back to the full glossary.