WebRTC Leak Test

WebRTC is a browser capability for real-time audio, video, and peer-to-peer data. Before a connection can be made, the browser has to discover network addresses that both sides can reach. A STUN service observes the connection externally and returns a server-reflexive address, which is the public IP shown in the result.

A normal web request and a WebRTC connection can use different network paths. If a VPN or proxy handles web traffic while WebRTC leaves through another interface, a site may see a public address outside the expected exit. The test finds that additional address.

A dual-stack network can normally use one public IPv4 and one public IPv6 at the same time. When each WebRTC address matches the current public address for its own family, both are normal exits for the current network.

When a WebRTC public IP does not match a current address in the same family, the page lists it as an additional exit and reports a leak.

Turn on WebRTC protection in your proxy or VPN client, or switch to a mode that carries all traffic (such as TUN or global mode) so WebRTC uses the same exit; a browser setting or extension can also limit WebRTC to the proxy. Run the test again afterwards; the additional address should be gone.

The most common cause is a proxy app in TUN or fake-ip mode: the names of the STUN servers resolve to placeholder addresses in 198.18.0.0/15 and the browser reports a failed address lookup; or the proxy or firewall does not pass UDP, so STUN requests get no answer. The page then shows No public address obtained and the details give the reason for each source. A site that wants your public IP through WebRTC has to use STUN in the same way; when STUN does not get through, the site cannot get it either, so this is not a leak. To find out whether WebRTC would expose another address, test again on a network or mode that passes UDP.

While the 6 independent sources are checked, the page opens one more connection in which a single local port asks the first three sources (Google, Cloudflare, Twilio) together. One mapped port for a public address, with at least two of those three answering their own check, suggests a cone NAT; several mapped ports suggest a symmetric NAT; otherwise the result is Cannot tell. When the device is on several networks at once, several ports need not mean a symmetric NAT, so that case also shows Cannot tell.