I have an internet connection that is soon rolling out IPv6 native support but my VPN connection is far from rolling out IPv6 connection.

Can there can be any sort of leak if I still connect to my VPN while my ISP gives me an IPv6 address.

Moreover, how are the packets encapsulated in IPv6 packets in such cases?

  • Traffic sent over a VPN has two IP headers. That means there are four possible combinations of IPv4 and IPv6 for those headers. Which combinations are supported and which are not? – kasperd Jul 22 '17 at 11:58
  • You could also use a VPN that explicitly handles IPv6. OpenVPN can do this. Here is an example setup. feeding.cloud.geek.nz/posts/ipv6-and-openvpn-on-linode – user84215 Mar 3 '19 at 23:55

Your full setup is not known so I have to make some assumptions based on a typical setup:

  • Your local computer has both an IPv4 and IPv6 address in the local network.
  • Your router has both a public IPv4 and IPv6 address.
  • Routes on your local computer are setup so that both internet facing IPv4 and IPv6 traffic is going through the router.
  • Your local computer is the start point of the VPN connection.
  • The IPv4 only VPN software is not aware of the IPv6 capabilities of your computer, i.e. does not deal with them in a specific way. This is typical for OpenVPN installations.

In this setup the typically a new route (or multiple routes) for IPv4 traffic will be setup and will point to the VPN so that all IPv4 traffic will be send through the VPN. Since IPv6 traffic will not be specifically handled the existing IPv6 route will remain, i.e. IPv6 traffic will still flow outside the VPN. You can verify with sites like test-ipv6.com which IP addresses are visible from outside.

Of course, this is only true under the above assumption. It might well be that the VPN will simply disable all IPv6 on your host so that leakage using IPv6 is not possible. But, IPv6 leakage is a common problem with VPN setups.

  • Its the same setup I have been using. Is there any leak still possible if I disable IPv6 using Windows registry. – Skynet Jul 12 '17 at 7:27
  • 1
    @Skynet: If IPv6 is fully disabled on the system no leak with IPv6 should be possible. Still, there might be other leaks like using DNS. Check for example with dnsleaktest.com and ipv6leak.com to test your setup. – Steffen Ullrich Jul 12 '17 at 7:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.