## TL;DR
Your WireGuard config only routes IPv4. IPv6 traffic ignores the tunnel because `AllowedIPs` has no IPv6 range. Either add `::/0` to `AllowedIPs` (with an IPv6 address on the tunnel interface) so IPv6 goes through the tunnel too, or disable IPv6 on the device. Verify with an IPv6 leak test: the reported address should be the tunnel egress, not your ISP.

## The error
There is no error message; the tunnel looks healthy. The leak test is the tell:

```text
$ curl -6 ifconfig.co
2001:db8:1234:5678::9   (your real ISP IPv6 address, not the tunnel)
```

Expected after the fix: the IPv6 address shown belongs to the tunnel server.

## Steps
1. Confirm the config: open the WireGuard profile and look at `AllowedIPs`. Expected: if it lists only the IPv4 default route, IPv6 was never routed. This is the cause.
2. Choose your fix. If the tunnel server supports IPv6: add `::/0` to `AllowedIPs` (so it claims the IPv4 default route plus `::/0`) and make sure the interface `Address` includes an IPv6 address. Expected: the config now claims all IPv6 traffic.
3. Reconnect the tunnel and run the leak test again with `curl -6 ifconfig.co`. Expected: it returns the tunnel server's IPv6 address. If the server has no IPv6, traffic just fails; that also stops the leak.
4. If the tunnel is IPv4-only by design: disable IPv6 on the client instead. On Windows, uncheck Internet Protocol Version 6 on the network adapter; on macOS, set IPv6 to link-local only. Expected: `curl -6 ifconfig.co` errors out because there is no IPv6 path at all.

## Use this when
- The tunnel is up and IPv4 goes through it, but an IPv6 leak test shows the real ISP address
- A security review flags IPv6 as bypassing the corporate tunnel
- Mobile users on IPv6-capable carriers report seeing non-tunneled traffic

## Not for this skill when
- The tunnel will not connect at all (handshake failures are a different skill)
- IPv4 is also leaking or not routed (check the whole `AllowedIPs` block)
- You need IPv6 to stay usable but split off the tunnel (that needs policy routing)

## Compatibility
- WireGuard on Windows, macOS, Linux, iOS, Android
- Works with any WireGuard server; IPv6 routing needs the server to have IPv6 egress

## Variants
### Kill-switch configs that still leak IPv6
Some "block everything outside the tunnel" firewall rules only cover IPv4. Audit the ruleset for IPv6 separately, or the kill switch has a hole.

### IPv6 leak only on phones
Mobile carriers hand out IPv6 aggressively. Either route `::/0` through the tunnel or disable IPv6 in the mobile config; desktop fixes do not transfer.

## Why it happens
WireGuard routes exactly what `AllowedIPs` says. Most shipped configs include only the IPv4 default route, so the OS sends IPv6 out the normal interface. The tunnel is working as configured; the config was incomplete.

## Edge cases
- Adding `::/0` when the server has no IPv6 egress breaks IPv6-dependent apps. Either give the server IPv6 or disable IPv6 on the client.
- Some captive portals and enterprise networks need IPv6 for the sign-in page. Expect breakage on hotel wifi if you disable IPv6 device-wide.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_VULn7Vt8OQ3oY79KuT7lSA