VPN IP Leak: Fix It Yourself in 5 Minutes

1. Your Router or ISP Is Giving Away Your IPv6 Address

This is the biggest culprit, especially on Windows 10 and 11. Most VPNs only protect your IPv4 traffic. IPv6 traffic just bypasses the VPN tunnel and goes straight to your ISP. So when you run a leak test, you see your real IPv6 address.

Real-world example: You're on a Starbucks Wi-Fi (or home network with IPv6 enabled), you connect to your VPN, go to whatismyip.com, and it shows your real location. Annoying, right?

The fix is simple: disable IPv6 on your network adapter.

1. Press the Windows key + R on your keyboard. A run box pops up.
2. Type ncpa.cpl and press Enter. This opens the Network Connections window.
3. You'll see your network adapters — Ethernet or Wi-Fi. Right-click the one you're using (the one with a green bar or connected status).
4. Click Properties.
5. In the list, scroll down until you see Internet Protocol Version 6 (TCP/IPv6). Uncheck the box next to it.
6. Click OK at the bottom. A window might flicker — that's normal.
7. Close the Network Connections window.
8. Now, disconnect from your VPN and reconnect. Run the leak test again at ipleak.net.

After doing this, you should see only your VPN's IP address, no sign of your real IP. If you still see your real IP, move to the next fix.

2. Your VPN Is Using a DNS Server That Leaks

Your VPN should force all DNS requests through its own secure servers. But sometimes — especially with free VPNs or ones with bad configurations — your computer still talks to your ISP's DNS server. That's a DNS leak. It won't show your real IP directly, but it shows your ISP's DNS server, which can be traced back to you.

How to check: Go to dnsleaktest.com and run the standard test. If you see any server names from your ISP (like Comcast, Spectrum, or Telstra) instead of your VPN provider, you have a leak.

Fix: Change your DNS servers to Cloudflare's or Google's. Then force your VPN to use them.

1. Open the Network Connections window again (Windows key + R, type ncpa.cpl, press Enter).
2. Right-click your active adapter, click Properties.
3. Find Internet Protocol Version 4 (TCP/IPv4) in the list. Select it and click Properties.
4. At the bottom, select Use the following DNS server addresses.
5. For Cloudflare (fast and private):
   Preferred DNS server: 1.1.1.1
   Alternate DNS server: 1.0.0.1
6. Click OK, then OK again to close both windows.
7. Now open your VPN software. Look in its settings for something like "DNS Leak Protection" or "Override DNS". Turn that on.
8. Disconnect and reconnect your VPN.
9. Run the DNS leak test again. It should show only your VPN provider's servers now.

What you should see: Only server names like "mullvad.net" or "nordvpn.com" or "cloudflare.com" — no ISP names.

3. Your VPN's Kill Switch Isn't Working (Or Isn't Turned On)

A kill switch is supposed to cut your internet if the VPN drops. But if it's not set up right, your real IP can leak out during reconnection. This happens a lot on laptops that switch between Wi-Fi and Ethernet, or after a sleep/wake cycle.

Real-world trigger: You close your laptop lid, open it an hour later, and the VPN takes a few seconds to reconnect. During those seconds, your real IP is exposed.

Fix: Enable the kill switch in your VPN settings. If that's not enough, use the Windows Firewall to block all non-VPN traffic.

Step A: Turn on the kill switch in your VPN

1. Open your VPN app.
2. Go to Settings or Preferences.
3. Look for Kill Switch, Internet Kill Switch, or Network Lock. Turn it on.
4. If there's an option for "Always on" or "Persistent", pick that. It keeps the kill switch active even if the VPN crashes.
5. Disconnect and reconnect your VPN. Then test at ipleak.net.

Step B: Block all internet without the VPN (for advanced users)

If your VPN's kill switch is flaky (some are), you can create a firewall rule. This is a bit technical, so take it slow.

1. Press the Windows key, type Windows Defender Firewall with Advanced Security, and open it.
2. On the left, click Outbound Rules.
3. On the right, click New Rule...
4. Select Custom, then click Next.
5. Leave All programs selected. Click Next.
6. Under Protocol type, leave it as Any. Click Next.
7. Under Scope, in the Remote IP address section, select These IP addresses. Then click Add.
8. Type 0.0.0.0/0 (this blocks everything). Actually, that's too broad. Instead, add the IP range of your VPN server. But that's complicated. The simpler way: skip to the next step.
9. Under Action, select Block the connection. Click Next.
10. Uncheck all profiles except Public and Private (if you're on a home network). Click Next.
11. Name it "Block internet without VPN". Click Finish.

But wait — this blocks everything, including your VPN. You need to add an exception for your VPN client. Go back to the rule, right-click it, go to Properties > Scope, and add your VPN server's IP or range there. This is why I recommend you just fix the kill switch in your VPN app first.

After you enable the kill switch, run the leak test while connected to VPN. If you disconnect the VPN, the test should show "no internet connection" — that means the kill switch works.

Quick-Reference Summary Table

Bottom line: 90% of VPN leaks are caused by IPv6 or DNS. Fix those first. If you're still leaking after all three steps, your VPN provider might be the problem. Try a different one — Mullvad, ProtonVPN, or Windscribe are solid choices.