How to Fix IP Leak: Complete Step-by-Step Guide for All Platforms (2025)

Step 1: Diagnose Your IP Leak Type

Before fixing, identify which type of leak you have. Visit dovpn.com/ip-leak-test with VPN connected and check:

Identify Leak Type(s)

Step 2: Fix Kill Switch Issues

A working kill switch is the foundation of leak protection. It blocks ALL internet traffic when VPN disconnects.

Enable Built-in Kill Switch

Platform-Specific Kill Switch Setup

Windows 10/11

If your VPN lacks kill switch, use Windows Firewall:

# PowerShell (Run as Administrator)
# Block all outbound except VPN interface
New-NetFirewallRule -DisplayName "Block All Outbound" -Direction Outbound -Action Block
New-NetFirewallRule -DisplayName "Allow VPN" -Direction Outbound -InterfaceAlias "VPN_INTERFACE_NAME" -Action Allow

macOS

Install and configure LuLu firewall (free, open-source):

1. Download LuLu from objective-see.com/products/lulu.html
2. Install and grant permissions
3. Set to "Block Mode" → only allow traffic through VPN app

Android

Use system-level kill switch:

1. Settings → Network & Internet → VPN
2. Tap ⚙️ next to your VPN
3. Enable "Always-on VPN"
4. Enable "Block connections without VPN"

Linux

Create iptables kill switch (see Linux leak guide for full script):

sudo iptables -P OUTPUT DROP
sudo iptables -A OUTPUT -o tun0 -j ACCEPT
sudo iptables -A OUTPUT -o lo -j ACCEPT

Step 3: Fix IPv6 Leaks

Most VPNs only tunnel IPv4. If IPv6 is enabled, it bypasses the VPN entirely. Solution: disable IPv6 or use VPN with IPv6 support.

Quick IPv6 Disable (All Platforms)

Windows 10/11

1. Press Win + R → type ncpa.cpl → Enter
2. Right-click network adapter → Properties
3. Uncheck "Internet Protocol Version 6 (TCP/IPv6)"
4. Click OK → Restart adapter

macOS

# Disable IPv6 on Wi-Fi
networksetup -setv6off Wi-Fi

# Disable on Ethernet
networksetup -setv6off Ethernet

# Verify
networksetup -getinfo Wi-Fi | grep IPv6

Android

1. Settings → About Phone → Tap Build Number 7 times (enables Developer Options)
2. Settings → System → Developer Options
3. Find "Disable IPv6" → Enable
4. If not available, use VPN app with IPv6 blocking (NordVPN, Surfshark)

iOS/iPhone

iOS doesn't allow IPv6 disabling. Solution: Use VPN with built-in IPv6 blocking (NordVPN, Surfshark, Mullvad).

Linux (Ubuntu/Debian)

# Temporary
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1

# Permanent
echo "net.ipv6.conf.all.disable_ipv6 = 1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Detailed guide: IPv6 Leak Test Guide

Step 4: Fix DNS Leaks

DNS leaks expose which websites you visit to your ISP. Fix by forcing DNS through VPN tunnel.

VPN App DNS Settings

Enable DNS Leak Protection (All VPNs)

• NordVPN: Settings → DNS → Use NordVPN DNS
• Surfshark: Settings → VPN Settings → DNS → Auto (uses Surfshark DNS)
• ExpressVPN: DNS automatically routed through VPN
• Mullvad: Settings → DNS → Use Mullvad DNS (blocks ads/trackers optional)

System-Level DNS Configuration

Windows DNS Leak Fix

1. Win + R → regedit
2. Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters
3. Create DWORD: DisableSmartNameResolution = 1
4. Restart PC

macOS DNS Configuration

macOS handles DNS via VPN automatically. If leaking, flush DNS cache:

sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder

Android DNS Override

1. Settings → Network & Internet → Private DNS
2. Select "Private DNS provider hostname"
3. Enter: dns.quad9.net (or your VPN's DNS)

Complete DNS leak guide: DNS Leak Prevention Guide

Step 5: Fix WebRTC Leaks

WebRTC (Web Real-Time Communication) can expose your local and real IP through browsers. Fix by disabling or blocking WebRTC.

Browser-Specific Fixes

Chrome / Brave / Edge

1. Install extension: WebRTC Leak Prevent or uBlock Origin
2. uBlock Origin: Dashboard → Settings → Privacy → Check "Disable WebRTC"
3. Test at dovpn.com/ip-leak-test

Firefox

1. Type about:config in address bar
2. Search: media.peerconnection.enabled
3. Set to false
4. Restart Firefox

Safari (macOS/iOS)

Safari doesn't leak via WebRTC by default. No action needed.

Detailed WebRTC guide: WebRTC Leak Prevention Guide

Complete Platform-Specific Fix Procedures

Verify Your Fixes Work

After applying fixes, test thoroughly to confirm leaks are resolved:

Comprehensive Testing Checklist

1. Basic Leak Test
   • Connect to VPN
   • Visit dovpn.com/ip-leak-test
   • Verify only VPN IP shown (no real IP anywhere)
2. Kill Switch Test
   • Keep leak test page open
   • Disconnect VPN or force close VPN app
   • Refresh page → Should show "No internet" or timeout
   • If real IP appears, kill switch failed
3. Network Switch Test (Mobile)
   • Connect VPN over Wi-Fi
   • Disable Wi-Fi (switches to cellular)
   • Check leak test → Should still show VPN IP only
4. DNS Leak Verification
   • Check DNS section on leak test page
   • Should show VPN provider's DNS servers only
   • No ISP DNS servers should appear
5. IPv6 Leak Check
   • IPv6 section should show "Not detected" or VPN IPv6
   • Your real IPv6 should NEVER appear
6. WebRTC Leak Check
   • WebRTC section should show no public IPs
   • Local IPs (192.168.x.x) are OK
   • Real public IP = leak

When to Replace Your VPN (Unfixable Leaks)

Some VPNs have fundamental flaws that can't be fixed with settings. Replace your VPN if:

• No kill switch feature - Can't prevent leaks during disconnects
• Kill switch doesn't work - Tested and still leaks
• No IPv6 support or blocking - Can't tunnel or block IPv6
• DNS leaks persist despite settings - Poor DNS routing implementation
• Leaks on specific platforms - Works on desktop but leaks on mobile
• Free VPN - 99% lack proper leak protection
• VPN logs data despite claims - Privacy risk

Recommended Replacement VPNs (Zero-Leak Tested)

Frequently Asked Questions