IPv6 and VPNs: the leak many apps forget

An IPv6 leak is what happens when a VPN tunnel carries only IPv4 while the phone still has a working IPv6 connection from its carrier or Wi-Fi. Any site that supports IPv6, which now includes most large ones, is reached over the phone's own IPv6 address, outside the tunnel, unencrypted, and showing your real address. The fix is one of two things: the tunnel carries IPv6 as well, or the app blocks IPv6 entirely while the tunnel is up. A VPN that does neither is leaking on any network that has IPv6, and most mobile networks do.

Why it happens

A phone with both address families decides, for every connection, whether to use IPv4 or IPv6. When a site publishes both kinds of address, Android generally prefers IPv6. A VPN app takes over the phone's traffic by adding routes to its tunnel interface: a route for all of IPv4 sends every IPv4 packet in. If it adds no IPv6 route, the phone's existing IPv6 route through the carrier is untouched, and every IPv6 connection uses it as if the VPN were not there.

Nothing looks wrong. The app says connected, IPv4 sites show the VPN's exit IP, and the VPN icon is in the status bar. Meanwhile any site with an IPv6 address sees you directly.

Why it matters more on a phone

Mobile carriers were early adopters of IPv6, because they have far more subscribers than IPv4 addresses. A phone on mobile data is therefore more likely to have a native IPv6 address than a laptop at home, and more likely to leak with a VPN that ignores it. Home and office Wi-Fi are catching up. The practical assumption is that a phone has IPv6 unless proven otherwise.

There is a second phone-specific wrinkle. Some mobile networks are IPv6-only and reach IPv4 sites through a carrier translation layer. A VPN on such a network has to connect to its server over IPv6 in the first place, and a server with no IPv6 address is reachable only through that translation, which most protocols tolerate but which adds another place for things to go wrong.

The two correct answers

Carry IPv6 in the tunnel. The VPN assigns the phone an IPv6 address inside the tunnel, adds a route for all of IPv6 to the tunnel interface, and the server forwards IPv6 traffic to the internet from its own IPv6 exit address. This is the complete solution and the one to prefer where the server has IPv6. Your IPv6 traffic is then as protected as your IPv4 traffic, and sites see the server's IPv6 address.

Block IPv6 while the tunnel is up. If the tunnel has no IPv6 address, the app should still claim the IPv6 route, so packets go to the tunnel interface, and then drop them. Android makes this straightforward: a VPN app declares the routes it handles when it builds the interface, and a route it claims but does not forward is a black hole. The phone notices IPv6 connections fail, falls back to IPv4 for every site that has one, and nothing goes around the tunnel. This costs you nothing in practice, because no service is reachable only over IPv6.

The wrong answer is the common one: add an IPv4 route, ignore IPv6, and hope.

How to check

With the VPN off, visit any site that shows your address and note whether it has an IPv6 one. If it does, turn the VPN on and check again. The IPv6 address should either change to one belonging to the VPN server or disappear. If it is unchanged, your VPN is leaking. The IP leak test post goes through this and the IPv4 cases in order, and the DNS leak post covers the related failure where your queries, rather than your packets, go around the tunnel.

Be careful with what a third-party check site can tell you. It reports the address that reached it, which is what you want, but every check you run tells that site your address. An app that verifies its own exit IP by asking its own server through the tunnel gives the same answer without the side effect, which the how to check a VPN is working post explains.

What this looks like from the app's side

An honest app should be able to state which of the two answers it took on the current connection. If the tunnel has an IPv6 address, IPv6 is carried. If not, IPv6 is blocked, and the app's own exit-IP check will report an IPv4 address only. Either state is safe. A connect screen that shows an IPv4 exit address while IPv6 quietly flows around the tunnel is the state to avoid, and it is invisible unless the app went looking.

Culvert VPN claims the IPv6 route on every connection and blocks IPv6 outside the tunnel whenever the tunnel has no IPv6 address of its own, so the phone falls back to IPv4 through the tunnel rather than around it; it is on Google Play.