Blocked packets can leave readable addresses
An ISP-assigned public IPv6 address can remain configured on a physical adapter even when IPv6 packets are blocked. A native application may enumerate adapters, read that address and send it over an allowed connection. That is local information exposure rather than an IPv6 packet bypass. It does not mean an ordinary web page can freely inspect network adapters.
Five mechanisms in the default IPv6-off setup
The default uses ipv4_only DNS results, IPv4-only fake-ip mapping and rules that reject IPv6 destinations. TUN still captures IPv6 traffic so the engine can discard it. Together, these controls cover name resolution, address mapping and packet handling under the same IPv6 setting.
On supported Windows, Linux and macOS adapters, a fifth mechanism disables adapter IPv6, reducing public addresses available to native apps. Disconnection attempts to restore the previous state. Android lacks that permission and uses the first four mechanisms. Unmanageable interfaces and bridged virtual machines remain outside some controls.
Encrypted DNS still has different routes
DNS-over-HTTPS, or DoH, carries DNS exchanges over HTTPS. godusevpn sends remote DNS through the proxy by default. Local DNS and node hostname lookups follow their purpose, configuration and protection state; a system resolver setting also has special treatment under strict Global protection.
DoH therefore does not mean every lookup enters the tunnel. Transport encryption also does not hide a query from the resolver that answers it. Encryption, resolver choice and routing are distinct decisions.
A system guard for tunnel gaps
When enabled in Global mode while you still want to be connected, the guard restricts direct traffic outside the tunnel. Necessary exceptions include node connections, subscription-refresh fallback, loopback and permitted LAN traffic.
Windows uses persistent WFP rules, with boot filters checked separately. Linux uses nftables and startup rules on systemd and OpenWrt; older kernels may degrade DNS routing. macOS uses pf, permits root processes and cannot guarantee its startup job runs before networking. Android protection after process termination or reboot depends on system Always-on VPN and lockdown settings.
Read the protection status
The current implementation keeps a working tunnel in place when some protection checks fail, reports a Degraded state and attempts repair without tearing it down. Adapter IPv6 failures can still prevent startup under strict Global protection. Failure handling is conditional rather than a universal promise to stop every connection.
Use warnings, logs and diagnostics to understand the result. Distinguish NAT guests from bridged virtual machines: bridged traffic may bypass the host network stack. A connected host alone does not establish that every attached environment is protected.