How Do I Check for and Fix a WebRTC Leak (rtcleak)?

Updated

Connect to your VPN, open a WebRTC detection page such as ipleak.net, and look at the "WebRTC detection" result. If it shows your ISP's IP address instead of your VPN's IP, your browser is leaking your real address through WebRTC and you should turn WebRTC off or restrict it. If the result matches your VPN IP, there is nothing to fix.

What a WebRTC leak actually is

WebRTC (Web Real-Time Communication) is the browser feature behind in-page video calls and peer-to-peer data transfer. To connect two devices directly, it uses a protocol called STUN (Session Traversal Utilities for NAT), which discovers the public IP address your device is reachable at.

That discovery happens independently of your normal browsing traffic. So even when your web traffic is routed through a VPN, WebRTC can still ask a STUN server for your public address and hand back the one your ISP assigned you. The detection page then displays that address, which is why a leak looks like "my VPN is on but the site sees my real IP."

Check for a WebRTC leak

  1. Connect to your VPN and confirm it is actually active.
  2. Open a leak-test page such as ipleak.net in the browser you normally use.
  3. Find the WebRTC detection section. The page notes that if you are connected to a VPN and you see your ISP IP there, your system is leaking WebRTC requests.
  4. Compare the WebRTC address with the IP shown in the page's IP address details. If they differ and the WebRTC one belongs to your ISP, you have a leak.

Some pages require JavaScript to run the detection, so allow scripts on the test page or the result will stay blank.

Fix it in Firefox

Firefox exposes WebRTC through a preference you can flip:

  1. Type about:config in the address bar and accept the warning.
  2. Search for media.peerconnection.enabled.
  3. Double-click it to set the value to false.
  4. Reload the leak-test page and check the WebRTC section again.

With the preference off, WebRTC is disabled entirely, so sites that rely on it for calls or peer-to-peer features will stop working. That is the trade-off: you close the leak, but you also lose WebRTC functionality in that browser.

Fix it in Chrome and Chromium-based browsers

Chrome does not offer the same simple on/off preference. The practical options are:

  • Install an extension that blocks or spoofs WebRTC requests, then re-test.
  • Use enterprise policy settings to restrict WebRTC behavior if you manage the machine.
  • Use a separate browser profile or browser for WebRTC-dependent services, keeping your main browsing profile protected.

After any change, reload the detection page and confirm the WebRTC result no longer shows your ISP address.

Don't confuse WebRTC leaks with DNS or IPv6 leaks

These are three separate mechanisms and each has its own check on the same page:

Leak type What it exposes Where to look
WebRTC Your real public IP via STUN WebRTC detection section
DNS The DNS resolver answering your queries, possibly your ISP's DNS detection section
IPv6 An IPv6 address that bypasses an IPv4-only VPN tunnel IP address details

The page's own guidance is parallel for each: if you are on a VPN and the detected value is your ISP's, that channel is leaking. Fixing WebRTC will not fix a DNS leak, and vice versa, so test each one after making changes.

Verify and know the limits

Re-run the WebRTC check after every change and confirm the detected address matches your VPN. Keep in mind that disabling WebRTC in one browser does not affect other browsers or apps on the same machine, and that a leak test only reflects the browser and network state at the moment you run it. If you switch VPN servers or reconnect, test again.