IPv6 Native

doxx.net is the FIRST VPN to provide true IPv6 leak protection. While you can disable IPv6 in your tunnel configuration, we maintain a dual-stack tunnel that captures ALL IPv6 traffic—including potential leaks—and blocks them server-side. No more IPv6 bypass attacks. No more dual-stack vulnerabilities.

Unlike other VPNs that simply "disable IPv6" on your device (leaving you vulnerable to leak attacks), doxx.net's approach is revolutionary: we accept your IPv6 traffic through the tunnel and block it at the network level, ensuring zero possibility of IPv6 leaking around the VPN.

And when you enable IPv6? You get a real, routed IPv6 address from our globally-allocated 2602:F5C1::/36 range. Not a shared NAT66 address. Not a local ULA. A genuine, globally-routable IPv6 prefix that's yours alone.

But here's what really sets us apart: All our WireGuard endpoints are IPv6-native. If you have native IPv6 connectivity, you can connect to doxx.net using IPv6 itself—no IPv4 dependency. Full dual-stack from the moment you establish the connection.

Full Dual-Stack From Connection to Egress

doxx.net is fully dual-stack at every layer:

Connection Layer:
  • WireGuard endpoints accessible via IPv4 OR IPv6
  • Connect to us using your native IPv6 connection
  • No IPv4 dependency for establishing tunnel

Tunnel Layer:
  • Dual-stack tunnel (IPv4 + IPv6 simultaneously)
  • Your traffic uses YOUR routed IPv6 address
  • Zero IPv6 leaks (captured and blocked if disabled)

Egress Layer:
  • Exit to internet via IPv4 or IPv6
  • Native IPv6 to CDNs (Google, Cloudflare, etc.)
  • No NAT66 bottlenecks

Dual-Stack Services

10.10.10.10:53        → dn-dns (IPv4)
fd10:10:10::10:53     → dn-dns (IPv6)

10.10.10.10:8080      → Transparent HTTP Proxy (IPv4)
fd10:10:10::10:9091   → Transparent Proxy (IPv6)

BGP Route Advertisement

When you connect to doxx.net:

1. You're allocated a unique IPv6 address that's static until you change it
2. Your /127 is immediately injected into BGP
3. All backbone servers learn your route via BGP mesh
4. Traffic to your IPv6 address routes to your connected server
5. No NAT, no translation—pure routing

A True Meshed Encrypted Backbone

IPv6 isn't just about more addresses—it's about a faster, more private, and more modern internet:

For Network Engineers: This is how VPNs should have been built from day one. No hacks, no workarounds—just proper IPv6 routing infrastructure.

For Enterprises: Production-grade IPv6 support means your infrastructure is ready for the IPv6-native internet, today. Get native IPv6 for all devices on your LAN without SOCKS5 proxies or NAT66 hacks.

For IPv6 Advocates: Finally, a VPN that respects IPv6's design principles. No more NAT66 compromises. Real routed prefixes, real end-to-end connectivity.

For Privacy Users: Zero IPv6 leaks, better performance, and access to the modern internet without compromise. Plus, IPv6 is inherently more private than shared IPv4 NAT pools.

Server Infrastructure: ✅ Fully operational. Native IPv6 routing, BGP mesh, packet filtering, and dual-stack services are live.

When IPv6 privacy concerns are fully resolved at the client level, flipping the switch to enable full dual-stack operation will be trivial—the hard work is already done.