DNS and IPv6, handled rather than ignored
On Windows the app sets DNS for the tunnel specifically, so lookups do not leak out over your normal connection. IPv6 is blocked rather than carried — if we cannot protect it, it does not go, and the app tells you that instead of quietly leaking it.