Lvcha VPN showing Connected on IPv4 is not a promise that IPv6 went into the tunnel. If the LAN hands out a global v6 prefix, apps can prefer it and skip the tunnel. Order: client “disable IPv6 / IPv4 only” if present → disable IPv6 on the NIC you are using → reconnect and read both v4 and v6 egress. Do not start by killing IPv6 for the whole apartment.
IPv4 failure modes stay in no traffic. DNS over v6 often shows up as a DNS leak. Dual-stack background: RFC 4213. Builds: download page.
Bypass versus “the node is in my country”
After connect, did the IPv4 public address change? Does the OS still show a 2001: / ISP-looking global v6? A v6-only test page that still names your ISP is bypass. If both families show the same foreign country, the tunnel is dual-stack or both paths share a pop—leave IPv6 alone and pick nodes in latency.
Windows: NIC status → Details. macOS: Network → Details. Android: Wi-Fi details (some OEMs bury v6 under Advanced). iOS: Wi-Fi → the ⓘ page. Screenshot before you toggle anything.
| Pair | Read as | Action |
|---|---|---|
| v4 moved, v6 still ISP | Tunnel is v4-only | Block v6 or use a dual-stack mode |
| Both moved to the same country | Fine or shared pop | Do not disable v6 |
| v4 moved, no v6 address | This LAN has no v6 | Nothing to do |
| v4 unchanged | No tunnel yet | Do not start at IPv6 |
Touch this session, not the whole stack
If 2026.07 exposes “block IPv6,” use it—it dies with the tunnel. Otherwise, on Windows, uncheck Internet Protocol Version 6 on the active NIC only. Leave v6 on virtual adapters that WSL or a hypervisor needs. Reconnect once; do not reboot twice to “make sure.”
macOS can set IPv6 to Link-local only (admin password). MDM that forces v6 means you stop and read office network. Android: client block switch, then a note on the lock screen so you remember to restore it in a hotel where v4 is CGNAT sludge.
iOS will not let you kill the stack. Drop extra “IPv6-only” configuration profiles; compare airplane → cellular (many carriers still v4-only). Clean on cellular, leak on home Wi-Fi → the CPE prefix, not a failed Lvcha install.
PD on the home router, privacy extensions, when to stop
The router delegates a prefix to every client. Blocking v6 on the PC does nothing for the phone on the same SSID. Fix per device, or disable LAN IPv6 knowing the bulbs might complain. Privacy extensions rotate the interface id; they do not hide an ISP prefix. Do not treat a temporary address as “already anonymous.”
If disabling v6 kills the whole machine, put it back immediately. Some ISPs give you rotten IPv4 and a healthy v6 default; you just removed the path that worked. Swap nodes or protocol instead of living on a broken v4. Kill Switch may also panic while you flip NIC properties—disable it for the change, then re-arm. See Kill Switch.
Three v6 toggles later and the ISP prefix is still there: look for a second NIC (phone USB tethering plus Wi-Fi) or a browser v6 proxy. Guides: hub. Device math: device cap, FAQ. Skip registry “disable IPv6” packs from forums.