IPv6

An IPv6 address looks like 2001:db8:85a3::8a2e:370:7334: eight groups of hexadecimal numbers, and some of the zeros can be omitted. The format was created because there are not enough IPv4 addresses for all devices.

An ISP usually gives a subscriber not one IPv6 address but a whole block. That is why websites often judge such addresses not one by one but in blocks, by subnet, for example /64.

Not all websites and programs work with IPv6. Some VPNs and system settings apply only to IPv4, and then requests over IPv6 can go out directly. This is worth checking.

You can check which address websites see on the My IP page.

Prefix and tail: how to read an IPv6 address

In a typical subscriber address, the first 64 bits, that is four groups, are the network prefix from the ISP. The last four groups are chosen by the device itself. The shorthand :: replaces several groups of zeros in a row and can appear in an address only once.

Modern systems regularly generate new temporary addresses for going online. So your IPv6 may change every day while the prefix stays the same. That is exactly why websites track the /64 prefix rather than the full address. The ISP may change the prefix too, but much less often, for example after a router restart.

Where IPv6 bypasses the proxy

Most networks now run both versions at once. If the proxy is set only for some programs or only at the system level, a browser or app may open a site directly over IPv6. Another source of leaks is WebRTC, which can show a website your real address.

Open the My IP page in the profile with the proxy and look at three lines: the IP, the IP version and the WebRTC block. None of them should show an address with your home prefix. How to close such a leak is described in the WebRTC leak article.

Typical mistakes and what to do

• Writing an IPv6 address with a port without square brackets. The correct form is [2001:db8::1]:8080, because the colon is already used inside the address.
• Testing the proxy only on an IPv4 site and missing that IPv6 traffic goes direct.
• Turning off IPv6 in the system at random without checking where the leak actually comes from.

The simplest fix is to set the proxy in the browser profile or in the program itself rather than relying on system settings.