WebRTC leak test
Are Your IPs Leaking Through WebRTC?
RTCPeerConnection can expose your LAN and post-NAT public IPs, bypassing most VPN configurations.
WebRTC leak check
Gathering ICE candidates (up to 2 s)...
How the test works
We create a data-only RTCPeerConnection, add a dummy data channel, call createOffer(), and listen for onicecandidate events. Each event exposes an SDP candidate line like candidate:1 1 udp 41885439 192.168.1.42 60513 typ host. We split on spaces, extract the IP, and classify it as private / public / mDNS.
What each candidate type means
host, direct IP on one of your interfaces.srflx, your public IP after NAT, as observed by the STUN server.prflx, peer-reflexive, seen only during active negotiation.relay, TURN relay, used when direct connectivity fails.
Scraper checklist
- Disable WebRTC entirely if you don't need it (both Playwright and Puppeteer expose flags).
- Otherwise, force a STUN server on your proxy's network so the srflx matches the exit IP.
- Run inside a VM/container whose LAN subnet looks residential (192.168.0.0/16), not the Docker 172.17.x.x default.
Frequently asked questions
→What is a WebRTC leak?
Any script on a page can create an RTCPeerConnection, kick off ICE candidate gathering, and inspect the resulting SDP or the icecandidate events. Those events expose your local network interface IPs (typically 192.168.x.x, 10.x.x.x, or IPv6 link-local) and, via a STUN server, your post-NAT public IP. The catch: ICE gathering bypasses application-level proxies, so a VPN configured for HTTP traffic often doesn't cover WebRTC.
→Does mDNS make me safe?
Mostly. Since Chrome 76, Chromium replaces host candidates with random *.local mDNS hostnames by default. Sites see a hash instead of your real 192.168 IP. Firefox added a similar protection. Older browsers, or specialized configurations, still leak the raw IP.
→Can I turn WebRTC off?
In Firefox: media.peerconnection.enabled = false. In Chrome: needs an extension like WebRTC Network Limiter or WebRTC Leak Prevent. Turning it off entirely breaks video calls, screen sharing, and many collaborative apps, so users usually don't.
→Why do scrapers care?
Two reasons. First, if your headless browser leaks a datacenter LAN IP (like 172.17.0.x, common Docker default) instead of a residential 192.168.x.x, that's a bot tell. Second, if your VPN says you're in France but your WebRTC public IP says AWS Frankfurt, sites flag the inconsistency.
→What should a real user's WebRTC output look like?
One or two IPv4 mDNS hashes, one IPv6 host address, and a srflx candidate matching the public IP the page's server sees. Empty output on a Chrome UA is itself suspicious, real Chrome always yields at least a mDNS hostname.