What a WebRTC leak is
WebRTC is a browser feature for voice calls, video meetings and peer-to-peer file sharing. To connect two browsers directly, it gathers “candidate” network addresses and shares them with the website. If the VPN or proxy does not cover that process, a candidate may contain your real public IP.
Modern browsers hide local network addresses behind random “.local” mDNS names, so seeing those is normal. The leak that matters is a public IP from your own provider appearing while your VPN is connected.
Always run a WebRTC leak test first. Many people do not have a leak at all, and changing settings unnecessarily can break video calls.
Firefox
Firefox is the only major browser with a built-in switch. Type about:config into the address bar, accept the warning, search for media.peerconnection.enabled and set it to false. This disables WebRTC completely, which stops leaks but also breaks browser-based calls such as Google Meet.
For a softer setting that keeps calls working, set media.peerconnection.ice.default_address_only to true. Firefox then only shares the default route address, which is the VPN’s when the VPN is active.
media.peerconnection.ice.default_address_only true # keeps calls, limits candidates
media.peerconnection.enabled false # disables WebRTC entirelyChrome, Edge and Brave
Chrome and Edge have no simple WebRTC toggle. The reliable options are the browser extension from your VPN provider, which usually includes WebRTC protection, or a well-reviewed extension that sets the WebRTC IP handling policy to “disable non-proxied UDP” or “default public interface only”.
Brave includes this setting: open Settings, Privacy and security, WebRTC IP handling policy, and choose “Disable non-proxied UDP” for the strongest protection or “Default public interface only” to keep calls working.
Install extensions only from the official store and check reviews and permissions. A malicious extension is a bigger risk than a WebRTC leak.
Safari and mobile browsers
Safari limits WebRTC by default and only shares candidates after a site gets camera or microphone permission, so leaks are uncommon. On iPhone and Android, a full-device VPN app usually routes WebRTC traffic too.
If you still see a leak on mobile, check that the VPN is set to always on, that split tunnelling does not exclude the browser, and that IPv6 is tunnelled or blocked.
- Run a WebRTC leak test with the VPN on.
- Apply the setting or extension for your browser.
- Restart the browser.
- Test again and confirm only the VPN IP or .local names appear.
Fixes on the VPN side
Many leaks come from the VPN rather than the browser. Update the VPN app, enable its leak protection and kill switch, and make sure it tunnels IPv6. A VPN that only handles IPv4 can let WebRTC discover your real IPv6 address.
Router-level VPNs avoid browser leaks entirely because every device’s traffic leaves through the tunnel, but they are harder to set up.
After any change, run the WebRTC, IPv6 and IP lookup tests together. They cover different paths and one clean result does not prove the others.