VPN Leak.

A failure of a VPN tunnel that lets identifying traffic — IP, DNS, IPv6, or WebRTC — escape outside the encrypted channel. It belongs to the Privacy & Data Protection category of cybersecurity.

A failure of a VPN tunnel that lets identifying traffic — IP, DNS, IPv6, or WebRTC — escape outside the encrypted channel.

A VPN leak is any condition where traffic supposed to be carried by the VPN escapes to the open internet, revealing the user's real IP, DNS queries, or both. Common categories are IP leaks during tunnel reconnect or kill-switch failure, DNS leaks when the system resolver is queried directly, IPv6 leaks when the VPN only routes IPv4, and WebRTC leaks via STUN-discovered candidates. Each type defeats the privacy goal of the VPN. Defences include a reliable kill switch that blocks all traffic when the tunnel drops, forced DNS through the tunnel, disabling or routing IPv6, applying mDNS-anonymized WebRTC candidates, and regular leak testing against services like ipleak.net.

Defences for VPN Leak typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: VPN tunnel leak, Tunnel bypass.