Definition
An IPv6 leak occurs when a device has both IPv4 and IPv6 internet connectivity, and the VPN tunnel only carries IPv4. Traffic destined for IPv6-reachable hosts (which now includes most major websites) bypasses the tunnel and travels directly over the user's normal ISP connection, revealing the real IPv6 address. The user appears connected to the VPN — IPv4 leak tests pass — but a substantial fraction of their actual traffic is unprotected.
How It Happens
The most common cause is older VPN clients that simply did not support IPv6 routing. Even some current clients leak in edge cases: when the VPN connection drops momentarily, when the operating system prefers IPv6 because of network preference rules, or when applications use IPv6-only DNS records. Windows, macOS, Linux, iOS, and Android all behave slightly differently in these scenarios, which makes universal IPv6 leak prevention tricky.
Mitigation
Three approaches: tunnel IPv6 inside the VPN alongside IPv4 (the cleanest, requires server-side IPv6 support); block all IPv6 traffic at the firewall while the VPN is connected (effective but coarse); or use a kill switch that drops all traffic on tunnel failure regardless of protocol. Reputable modern VPN clients offer at least the second approach by default, and increasingly the first.