How WebRTC Can Reveal IP Addresses Behind a VPN or Proxy
How WebRTC Can Reveal IP Addresses Behind a VPN or Proxy VPNs and proxies route many of your internet connections through another network endpoint. But your browser can also use other networking mechanisms. One worth understanding is WebRTC . WebRTC powers real-time features such as video calls, voice calls, and peer-to-peer data exchange. As part of setting up a connection, the browser gathers…
WebRTC is a browser technology enabling real-time communication features like video and voice calls, without relying on plugins. During connection setup, the browser gathers network information known as ICE candidates. These candidates can reveal public IP addresses distinct from those seen via a VPN or proxy. This guide explains what these candidates signify, why they may differ from VPN/proxy IPs, and how to interpret the results of a WebRTC leak test.
ICE candidates are used by ICE (Interactive Connectivity Establishment) to determine potential network paths between peers during WebRTC connection setup. Each path is represented by an ICE candidate, with varying privacy implications. Private addresses like 192.168.1.10 are not public IPs, and mDNS hostnames ending in .local should not be considered evidence of a public IP leak. However, public candidates warrant closer examination as they may disclose public-facing network addresses.
STUN (Session Traversal Utilities for NAT) plays a role in discovering public addresses. When a browser uses a STUN server during ICE gathering, the server can observe the source address of the request. This information may lead to the receiving of a server-reflexive candidate, containing the public-facing address observed by the STUN server. This behavior is normal for WebRTC but raises privacy concerns since the STUN operator can observe the network address from which the request arrives.
A mismatch between the public WebRTC address and the expected HTTP exit IP from a VPN or proxy can occur due to various factors. These include the browser having multiple network interfaces, IPv4 and IPv6 using different routes, and HTTP and STUN requests taking different network paths. A VPN or proxy may handle some traffic differently from other traffic, and the HTTP lookup might reach a different endpoint than expected.
The crucial question is whether the observed address differs from the network endpoint you intended to use.
To test for a potential WebRTC IP leak, gather ICE candidates, classify their addresses, and compare public candidate addresses against the expected HTTP exit IP. This process involves obtaining the expected HTTP exit IP, creating an RTCPeerConnection, gathering ICE candidates, classifying candidate types and addresses, and comparing public candidate addresses with the expected HTTP exit IP.
If a mismatch is found, investigate whether the difference is expected or not. Note that the STUN server used in this example is Google's public STUN server, and a production deployment should choose appropriate ICE servers and clarify the resulting network activity.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
