IPv6, DNS and MTU problems

This page covers three network details that can make a connected tunnel behave oddly: IPv6, DNS and packet size (MTU). It says what ForestVPN publishes and where it makes no claim.

Symptoms

• You want to know whether IPv6 traffic can leave outside the tunnel.
• Pages will not load after connecting, and you use custom DNS on a router or a filtering DNS.
• Small pages load but large ones, or large downloads, stall.
• The app says "Small packets pass, large ones don't."

Likely causes

• An IPv6 route outside the tunnel. An IPv6 leak is IPv6 traffic that leaves your device by the ordinary network instead of the tunnel. It needs two things: an IPv6 route outside the tunnel, and a tunnel that carries IPv4 and nothing else. ForestVPN's one published phone run put the IPv6 default route on the tunnel interface, did not reach the Working state, and so makes no claim about IPv6 traffic through the tunnel.
• Custom or filtering DNS. The app's diagnosis shows a warning when the device's DNS is set to a filtering or custom one. ForestVPN publishes no guidance on custom DNS setups beyond that warning. If name lookup itself is blocked, the app says "Name lookup is being blocked."
• Packet size. Packets above some size are dropped silently while small ones pass. The app names this net.mtu_blackhole, and switching to another location does not fix it.

Fix each cause

Test for an IPv6 leak. List the device's IPv6 addresses, then ask the system which interface it would use to reach a public IPv6 address, once with the tunnel down and again once the tunnel is up and data flows both ways. If the lookup names Wi-Fi or Ethernet while the tunnel is up, IPv6 is leaving outside the tunnel. An IPv6 test page is a second, single observation, and a page that shows only an IPv4 address does not prove the device has no IPv6.

Keep a leak from happening. A device with no IPv6 address sends nothing over IPv6, but it loses IPv6 on every network, and sites reachable only over IPv6 stop loading. Carrying IPv6 through the tunnel, or refusing it while protection is on, are the alternatives.

Custom DNS. If pages stop loading right after you connect, write to support with a support code and say what DNS the device or router uses.

Packet size. Try a different network. On computers the app may lower the packet size itself where that is allowed, and it never raises it. On phones and TV the app shows the diagnosis only and gives the same advice: try a different network. You can also ask the assistant to check the packet size.

Still stuck

Write to support with a support code from Account → Get help. Never send your account number. Say which of the three details above you think applies.