How does BEX prevent DNS, WebRTC, and IPv6 leaks?

1. Scenario / User Need #

Preventing personal location or ISP identity exposure caused by operating system leakage outside the encrypted VPN tunnel.

2. Technical Mechanism #

• Encrypted DNS Proxy: All DNS queries are intercepted at the OS kernel layer and routed through an encrypted in-tunnel DNS resolver hosted directly on the active Anycast node.
• IPv6 Blackholing / Dual-Stack Routing: IPv6 traffic is either routed seamlessly inside an encrypted dual-stack tunnel or safely blocked at the TUN interface to prevent unencrypted bypasses.
• WebRTC Blocking Hooks: BEX client apps configure local network adapters to prevent browser-based WebRTC interfaces from binding to real local IP addresses.

3. Recommended Action #

• Keep the Leak Protection feature toggled ON in your BEX Client settings.
• Test your connection status using independent leak detection utilities (e.g., dnsleaktest.com) while connected to verify zero address exposure.