WebRTC lets a web page open a direct connection to another browser, for calls and file transfer. To set one up, your browser gathers every address it could be reached on and hands the list to the page. Those addresses are called ICE candidates. A page does not need your permission to collect them, and it can read them without opening a call at all.
That is the leak. A proxy configured in your browser carries HTTP and HTTPS. WebRTC gathers its candidates over UDP, which an HTTP proxy does not carry, so the browser can discover and report an address the proxy was meant to hide.
Reading the table
| Candidate type | Where the address comes from | Is it a leak? |
|---|---|---|
local interface (host) |
A network interface on your machine | Only if it is a public address. A private one like 192.168.1.20 reveals little. |
hidden (.local name) |
Your browser replaced the local address with a random mDNS name | No. This is the browser protecting you. |
public, as a STUN server saw it (srflx) |
Your browser asked a STUN server which address its packet came from | Yes, if it differs from the address our server saw |
relay server (relay) |
A TURN relay. This test configures none, so you should not see one. | No |
The comparison that matters is the STUN answer against the address our server saw over HTTPS. If you are behind a proxy and those two differ, the STUN answer is your real network, and any page can read it.
If you are not using a proxy or VPN and still see a second public address, it is usually your other IP version. Our server may have seen you over IPv6 while STUN answered over IPv4, or the reverse. That is two addresses for one connection, not a leak.
How to stop it
- Use a tunnel that carries UDP. A full VPN routes all traffic, UDP included, so the STUN answer comes back with the VPN’s address. An HTTP proxy cannot do this.
- Firefox: set
media.peerconnection.enabledtofalseinabout:config. WebRTC is then off entirely, and video calls in the browser stop working. - Chromium browsers have no switch for it in their settings. Extensions that restrict WebRTC exist; test again after installing one, because the result is what counts.
- Automation: a headless browser driven through a proxy leaks the same way. Disable WebRTC in the browser profile, or route the whole machine through the tunnel.
Run the test again after any change. A clean result here is one sample from this browser, on this network, at this moment.