wireguard tunnel up but ipv6 traffic leaking around it

TL;DR

Your WireGuard config only routes IPv4. IPv6 traffic ignores the tunnel because AllowedIPs has no IPv6 range. Either add ::/0 to AllowedIPs (with an IPv6 address on the tunnel interface) so IPv6 goes through the tunnel too, or disable IPv6 on the device. Verify with an IPv6 leak test: the reported address should be the tunnel egress, not your ISP.

The error

There is no error message; the tunnel looks healthy. The leak test is the tell:

$ curl -6 ifconfig.co
2001:db8:1234:5678::9   (your real ISP IPv6 address, not the tunnel)

Expected after the fix: the IPv6 address shown belongs to the tunnel server.

Steps

1. Confirm the config: open the WireGuard profile and look at AllowedIPs. Expected: if it lists only the IPv4 default route, IPv6 was never routed. This is the cause.
2. Choose your fix. If the tunnel server supports IPv6: add ::/0 to AllowedIPs (so it claims the IPv4 default route plus ::/0) and make sure the interface Address includes an IPv6 address. Expected: the config now claims all IPv6 traffic.
3. Reconnect the tunnel and run the leak test again with curl -6 ifconfig.co. Expected: it returns the tunnel server's IPv6 address. If the server has no IPv6, traffic just fails; that also stops the leak.
4. If the tunnel is IPv4-only by design: disable IPv6 on the client instead. On Windows, uncheck Internet Protocol Version 6 on the network adapter; on macOS, set IPv6 to link-local only. Expected: curl -6 ifconfig.co errors out because there is no IPv6 path at all.

Use this when

• The tunnel is up and IPv4 goes through it, but an IPv6 leak test shows the real ISP address
• A security review flags IPv6 as bypassing the corporate tunnel
• Mobile users on IPv6-capable carriers report seeing non-tunneled traffic

Not for this skill when

• The tunnel will not connect at all (handshake failures are a different skill)
• IPv4 is also leaking or not routed (check the whole AllowedIPs block)
• You need IPv6 to stay usable but split off the tunnel (that needs policy routing)

Compatibility

• WireGuard on Windows, macOS, Linux, iOS, Android
• Works with any WireGuard server; IPv6 routing needs the server to have IPv6 egress

Variants

Kill-switch configs that still leak IPv6

Some "block everything outside the tunnel" firewall rules only cover IPv4. Audit the ruleset for IPv6 separately, or the kill switch has a hole.

IPv6 leak only on phones

Mobile carriers hand out IPv6 aggressively. Either route ::/0 through the tunnel or disable IPv6 in the mobile config; desktop fixes do not transfer.

Why it happens

WireGuard routes exactly what AllowedIPs says. Most shipped configs include only the IPv4 default route, so the OS sends IPv6 out the normal interface. The tunnel is working as configured; the config was incomplete.

Edge cases

• Adding ::/0 when the server has no IPv6 egress breaks IPv6-dependent apps. Either give the server IPv6 or disable IPv6 on the client.
• Some captive portals and enterprise networks need IPv6 for the sign-in page. Expect breakage on hotel wifi if you disable IPv6 device-wide.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_VULn7Vt8OQ3oY79KuT7lSA