EasyGeoIP guide · Published July 24, 2026
WebRTC leaks explained without the myths
WebRTC creates direct real-time connections for calls, meetings, and peer-to-peer applications. Its connection negotiation can expose candidate addresses, but modern browser privacy controls have changed what pages can observe.
Run the browser-only WebRTC testWhat an ICE candidate is
Before two peers can communicate, the browser gathers possible routes known as ICE candidates. Candidates can describe local interfaces, translated public routes discovered through STUN, and relay routes supplied by TURN.
A page that creates a peer connection may receive those candidates without placing a call. EasyGeoIP performs the collection locally in the browser and does not send the discovered candidates back to the server.
Private addresses are not your public identity
Addresses such as 192.168.x.x, 10.x.x.x, and private IPv6 ranges describe interfaces inside a local network. They are not routable across the public internet and usually do not identify a household beyond information already available to the browser environment.
Modern browsers commonly replace private addresses with random mDNS hostnames. Seeing an mDNS name means the browser withheld the literal local address.
When the result is a real concern
A public candidate that belongs to the original ISP and differs from the VPN-facing address is the important warning. It can indicate that peer traffic has a route outside the tunnel or that the VPN does not control the interface used by WebRTC.
A candidate identical to the VPN exit is expected. No candidate can also be normal when the browser limits gathering, blocks UDP, or requires media permission.
How to reduce exposure
Keep the browser and VPN client current. Use a VPN with a complete firewall or kill switch rather than depending exclusively on an extension. Browser proxy extensions may cover HTTP requests without covering UDP peer traffic.
Some browsers expose enterprise policies or privacy preferences that restrict non-proxied UDP. Disabling WebRTC completely can break legitimate calls and is usually unnecessary when the tunnel handles all routes correctly.
Why tests disagree
Different tools use different STUN servers, timeouts, browser APIs, and definitions of a leak. Extensions can block one test while allowing another. Network conditions also change candidate gathering from one moment to the next.
Focus on the actual addresses and network owners instead of a red or green badge. A transparent tool should show what it observed and explain the limitations.