IPv6 VPN Leak: Why Only Your IPv4 Address Changed

How a same-country IPv6 bypass can look

Imagine that your home connection and your selected VPN server are both in Thailand. Before connecting, your browser exposes one IPv4 address and one IPv6 address. After connecting, only IPv4 changes. Both country labels still say Thailand, but the saved IPv6 address is still visible.

IPNixa highlights this address pattern as “IPv4 changed · IPv6 unchanged” when both families can be compared with a recent saved connection. The warning asks you to review routing; it cannot establish from the address alone which interface or application setting caused the result.

Save a useful baseline and compare

A comparison is most useful when only the VPN setting changes. Switching Wi-Fi, reconnecting a router or changing mobile networks at the same time makes the cause harder to interpret.

1. Open VPN Check with the VPN disconnected, if appropriate for your situation. Wait for the separate IPv4 and IPv6 checks to settle.
2. Select Save current connection. Note which address families were actually confirmed; a missing address is not a usable baseline for that family.
3. Connect the VPN and wait for its connected status. Use Check again & compare in the same browser tab.
4. Read the IPv4 and IPv6 rows separately, then review the IPv6 exposure explanation. IPNixa keeps the saved connection in this tab for up to 30 minutes.

What each address pattern means

Use the saved address comparison together with your VPN app’s settings. The comparison does not identify a hidden original address; it uses the connection you chose to save.

When the saved result cannot answer the question

Suppose the original connection confirmed only IPv4. After connecting your VPN, IPv6 appears for the first time. You now have an IPv6 observation, but no saved IPv6 address against which to compare it. Do not interpret the empty baseline as evidence that the VPN introduced or protected IPv6. Repeat from a connection where the original family can be confirmed, or ask your VPN provider how it handles IPv6 on that network.

Likewise, saving a baseline while the VPN is already connected answers whether a later exit changed; it does not supply a known direct connection. IPNixa cannot establish your baseline’s routing intent automatically. If the saved result expires or you delete it, the result returns to observations until you save and compare again. For support, record which settings changed, whether both probes completed and when each check ran. This context is usually more useful than a country label by itself.

Check the VPN configuration before changing the device

Dual-stack devices can send traffic over either address family. A VPN needs to apply the intended routing policy to both. Split tunneling and application exclusions can also explain why a browser uses a different path; a bypass is not automatically a software defect.

Start with the provider’s instructions for IPv6 routing or leak protection. If the result is unexpected, collect the test time and before-and-after pattern for support. Share full addresses only when useful to a support request. A browser test does not examine other apps, DNS resolver leaks or the VPN’s kill switch.