Smoothing Rough Edges of IPv6 in VPNs
Yejin Cho and John Heidemann
USC/Information Sciences Institute
Citation
Yejin Cho and John Heidemann. Smoothing Rough Edges of IPv6 in VPNs. Technical Report arXiv:2512.19698v1 [cs.NI]. USC/Information Sciences Institute. [PDF] [alt PDF]
Abstract
How do commercial VPNs interact with IPv6? We show two “rough edges” in how commercial VPNs handle IPv6. First, we show that many IPv4-only VPNs leak IPv6 traffic to the ISP. Individual use VPNs in part to conceal their local IP addresses, so such leaks reduce user privacy. While prior work has studied VPNs in testbeds, we use a new dataset of 129k VPN-using daily visitors to \WIMIA that quantifies these leaks and show 12 VPNs previously considered safe still leak for at least 5% of their users. We show native IPv6 addresses leak most commonly in VPNs claim only IPv4 support, with 5% to 57% of visitors of v4-only VPNs having their native IPv6 address exposed. Second, we show that most dual-stack VPNs users actually select IPv4 instead of IPv6. We observe this problem in our visitor data, and we identify the root cause arises because when user’s computer follows standard address-selection rules, VPN-assigned addresses are often de-preferenced. Testing six VPNs on Android, we show that five consistently de-prioritize IPv6. Finally, we suggest a solution to IPv6 de-preferencing: we define a new IPv6 address range for VPNs that is not de-preferenced by address selection. We prototype this solution on Linux. Our findings help identify and address rough edges in the addition of IPv6 support to VPNs.Bibtex Citation
@techreport{Cho25a,
author = {Cho, Yejin and Heidemann, John},
title = {Smoothing Rough Edges of {IPv6} in {VPNs}},
institution = {USC/Information Sciences Institute},
year = {2025},
sortdate = {2025-11-27},
project = {ant, internetmap, bripod},
jsubject = {topology_modeling},
number = {arXiv:2512.19698v1 [cs.NI]},
month = nov,
jlocation = {johnh: pafile},
keywords = {ipv6, vpn, leaking private addresess, depreferencing},
url = {https://ant.isi.edu/%7ejohnh/PAPERS/Cho25a.html},
pdfurl = {https://ant.isi.edu/%7ejohnh/PAPERS/Cho25a.pdf},
otherurl = {https://arxiv.org/abs/2512.19698},
myorganization = {USC/Information Sciences Institute},
copyrightholder = {authors}
}