WebRTC Leak: How Browsers Reveal Your Real IP

WebRTC uses STUN to discover local and public IPs for calls. That discovery can bypass your VPN. What is a WebRTC leak? WebRTC powers browser calls and peer connections. During setup, STUN/TURN can enumerate host, srflx, and relay candidates — including your real public IP — even while a VPN is connected. Who is affected? Chrome, Edge, Firefox, Brave, and Safari all implement WebRTC. Extensions, meet apps, and some ads trigger ICE gathering. A VPN that does not coordinate with the browser can still show your ISP IP in candidate lists. How to test Connect AstraGuard VPN, open a WebRTC leak test, and inspect candidate IPs. Only VPN or relay addresses should appear. Local LAN IPs are less critical than your ISP public IP. Mitigations Browser flags / preferences to limit non-proxied UDP Extensions that disable WebRTC (trade-offs for calls) Firefox media.peerconnection.enabled for hard disable Prefer browsers with stricter WebRTC IP handling Always retest after browser updates VPN + browser hygiene A VPN is necessary but not sufficient. Combine tunnel DNS, IPv6 control, and WebRTC hardening. Use AstraGuard tools after every major browser upgrade. WebRTC leak FAQ Does a VPN kill switch stop WebRTC leaks? Not by itself. Kill switch stops traffic when the VPN drops. WebRTC can still enumerate addresses while the VPN is up if the browser uses non-proxied UDP. Are local LAN IPs a critical leak? Less critical than your ISP public IP, but still useful for fingerprinting on hostile networks. Prefer relay-only modes when available. Protect yourself with AstraGuard VPN AstraGuard VPN helps keep DNS inside the tunnel with strong encryption, kill switch options, and simple setup on desktop and mobile. Create an account , pick a plan on packages , then verify on privacy tools .