Your IP: checking…What websites can see
Get DarkMatter

Leak protection

IPv6 leak protection

Many networks now run two versions of the internet protocol side by side. IPv6 leak protection is designed to stop the newer one, IPv6, taking a route around your VPN tunnel.

  • Designed to stop IPv6 traffic bypassing the VPN tunnel
  • Helps keep your IPv6 address out of view on dual-stack networks
  • Included on every plan, with DNS leak protection
Get DarkMatterHow it works
  • 30-day money-back guarantee on your first purchase (14 days on monthly plans)
  • Up to 5 devices at once
  • Windows, macOS, iOS, Android and Fire TV

What it is

What is an IPv6 leak?

In short

IPv6 is the newer version of the internet’s addressing system, and many networks offer it alongside the older IPv4. If a VPN tunnel only handles IPv4, IPv6 traffic can travel outside it. IPv6 leak protection is designed to close that gap, either by carrying IPv6 through the tunnel or by blocking it while you’re connected.

How it works

How IPv6 leak protection works

On a dual-stack network your device has two addresses, one IPv4 and one IPv6, and it can use either to reach a website. A leak happens when only one of those routes is covered by the VPN.

IPv6 on a dual-stack network: the gap, and two ways to close it (general mechanics)
  • Encrypted VPN tunnel
  • Normal connection
  • IPv6 outside the tunnel
  • Traffic stopped
IPv6 without leak protectionCan bypass the tunnelIPv6 takes its own routeYour deviceIPv4 goes through thetunnelProvider’s IPv6 routeNot encrypted by the VPNWebsitesCan see your IPv6 addressProtected, outcome 1: tunnelledIPv6 encryptedIPv6 in the tunnelYour deviceVPN serverWebsitesSee the server’s addressProtected, outcome 2: blockedNo IPv6 sentIPv6 requestStoppedYour deviceIPv6 blockedWhile the VPN is connectedWebsitesNothing arrives over IPv6IPv6 without leak protectionCan bypass the tunnelYour deviceIPv4 goes through the tunnelIPv6 takes its own routeProvider’s IPv6 routeNot encrypted by the VPNWebsitesCan see your IPv6 addressProtected, outcome 1:tunnelledIPv6 encryptedYour deviceIPv6 in the tunnelVPN serverWebsitesSee the server’s addressProtected, outcome 2:blockedNo IPv6 sentYour deviceIPv6 requestIPv6 blockedWhile the VPN is connectedStoppedWebsitesNothing arrives over IPv6
Read this diagram as text

Three rows. Row one, IPv6 without leak protection: your device sends IPv4 through the tunnel, but IPv6 takes its own route over your provider’s network, which the VPN does not encrypt, and websites can see your IPv6 address. Row two, protected, outcome 1: IPv6 is carried inside the encrypted tunnel to the VPN server, and websites see the server’s address. Row three, protected, outcome 2: IPv6 is blocked while the VPN is connected, so nothing is sent over IPv6. Either approach closes the gap; which one applies depends on your device.

  1. Your network offers both

    Many home, mobile and public networks give your device an IPv6 address as well as an IPv4 one.

  2. Your device picks a route

    When a site supports IPv6, devices often prefer it. If the tunnel only carries IPv4, that traffic can go around it.

  3. Leak protection closes the gap

    While you’re connected, IPv6 is designed to be either carried through the tunnel or blocked, so it doesn’t take an unprotected route.

Both approaches share one aim: no IPv6 traffic leaving your device outside the tunnel. Blocking means sites reach you over IPv4, through the tunnel; tunnelling means IPv6 is encrypted along with everything else.

Which approach applies depends on your device. We show both, because we’d rather be accurate than tidy.

Why it matters

Where it makes a difference

You often can’t tell whether a network uses IPv6, which is what makes this gap so easy to miss.

  • Travelling

    Mobile networks and newer hotel and airport networks often offer IPv6. Moving between networks is when an uncovered route is most likely to appear.

    Using a VPN while travelling

  • Public Wi-Fi

    On a shared network, IPv6 traffic outside the tunnel is as visible to the network as any other unprotected traffic.

    Using a VPN on public Wi-Fi

  • New to VPNs

    Our plain-English guide explains what a VPN changes about your connection, and what it doesn’t.

    What is a VPN?

Side by side

How it compares

What happens to IPv6 traffic while a VPN is connected
IPv4-only networkDual-stack, no IPv6 protectionDual-stack with IPv6 leak protection
IPv4 trafficThrough the tunnelThrough the tunnelThrough the tunnel
IPv6 trafficNone on the networkCan travel outside the tunnelTunnelled or blocked
Sites can see your IPv6 addressNo IPv6 address in usePossiblyDesigned not to

General mechanics, assuming a VPN is connected in every column.

The honest bit: what it can’t do

  • Whether IPv6 is carried through the tunnel or blocked depends on your device. Both are designed to stop IPv6 leaving outside the tunnel.
  • If IPv6 is blocked, a service that only works over IPv6 may not load while you’re connected.
  • It covers traffic while the VPN is connected. If the tunnel drops, it’s the kill switch in our Windows app that’s designed to hold traffic back; our other apps don’t have one.
  • WebRTC is a separate browser feature with its own leak risks. Our WebRTC test checks it.

Check it yourself

See the difference for yourself

Compare the address websites see with the VPN off and on, and check the separate WebRTC browser leak.

IPv6 Leak Protection

Common questions

What is an IPv6 leak?

It’s when your device sends traffic over IPv6 outside the VPN tunnel, usually because the tunnel only covers IPv4. Websites can then see your IPv6 address.

What is a dual-stack network?

One that gives your device both an IPv4 and an IPv6 address. Many home broadband, mobile and public networks work this way.

Does DarkMatter tunnel IPv6 or block it?

IPv6 leak protection is designed to do one or the other while you’re connected, and which one applies depends on your device. Either way, the aim is that IPv6 doesn’t travel outside the tunnel.

Why would my device use IPv6 instead of IPv4?

Many operating systems try IPv6 first when a website supports it, because it’s the newer protocol. That preference is exactly why a tunnel that only carries IPv4 can leave a gap.

Will I notice any difference while I’m connected?

Usually not. If IPv6 is blocked, sites that offer both versions are reached over IPv4 through the tunnel instead. A service that only works over IPv6 may not load until you disconnect.

Should I switch off IPv6 on my device myself?

IPv6 leak protection is designed so you don’t have to. Changing network settings can affect other apps, so only do it if you know you need to.

Is IPv6 leak protection on every plan?

Yes. Every plan includes every feature, including IPv6 and DNS leak protection. See plans.

Included on every plan

Every plan includes every feature, for up to 5 devices at once. Renewal prices are shown before you pay.

Get DarkMatter
  • 30-day money-back guarantee on your first purchase (14 days on monthly plans)
  • Up to 5 devices at once
  • Windows, macOS, iOS, Android and Fire TV

Related features

Last reviewed