WebRTC Control: How to Prevent IP Leaks in Your Browser

Key takeaways

• WebRTC can expose your real IP address even when normal browser traffic is using a proxy or a VPN.

• You do not always need to disable WebRTC to prevent an IP leak.

• Your browser determines how much WebRTC control you have.

• Use browser extensions to control the IPs and network paths WebRTC uses.

There are several ways to control WebRTC and prevent a WebRTC leak in your web browser. You can use lighter controls, such as restricting which network interfaces WebRTC can use, or disable WebRTC completely.

The best option depends on your browser and network setup. If you use a proxy, its type also matters, along with how much performance you are willing to trade for stronger online privacy.

This article will help you choose the right WebRTC control method for your setup. You will also see how to apply it and check whether your real IP address is still exposed.

Why WebRTC control is important

WebRTC control is important because WebRTC can expose your real IP address through a different network route, even when you use a proxy or VPN to hide the IP address websites see.

WebRTC stands for Web Real-Time Communication and includes APIs such as RTCPeerConnection for establishing peer connections and RTCDataChannel for sending data between endpoints. WebRTC can support activities such as:

• Making video calls

• Making voice calls in your browser

• Sharing your screen

• Transferring files or other data peer-to-peer

• Using live collaboration tools like Google Meet

• Playing some browser games or using remote-control tools

These activities rely on WebRTC connections to another device, and WebRTC looks for a suitable way to make that connection. Your computer could have several options:

• Your normal Wi-Fi connection

• A VPN interface

• A proxy route

• Your local/private IP

• Your public ISP IP

• A TURN relay address

WebRTC uses a system called Interactive Connectivity Establishment (ICE) to look at these possible routes, test them, and decide which one to use. In that process, it can contact a Session Traversal Utilities for NAT (STUN) server to find the public IP address your connection presents to the internet.

Sometimes it cannot make a direct connection because of Network Address Translation (NAT) or firewall rules, so it uses Traversal Using Relays around NAT (TURN) to relay the connection through another server.

The problem is that WebRTC can sometimes use a direct network route that does not follow your proxy or VPN, exposing your real IP address. Websites or peers can use this address to identify information about you, like your general physical location and your internet service provider.

You could disable WebRTC completely, but that can also break features that rely on it, such as video calls and screen sharing. That is why WebRTC control matters.

To see how WebRTC works in your own browser, visit chrome://webrtc-internals/, an internal tool that shows real-time logs of connection states and performance metrics.

What is WebRTC control?

Control over WebRTC connections in your browser comes down to a few things:

• The addresses WebRTC can discover and expose

These could include your private/local IP, your public ISP IP address, your VPN-facing public IP, or a TURN relay address. Depending on your setup, you can restrict which addresses WebRTC is allowed to use or expose.

• The network routes WebRTC can use

The route WebRTC takes can determine which IP address ends up representing your connection. WebRTC could connect directly from your browser through Wi-Fi and your ISP to another device, or it could route the connection through your residential proxy. This means you could hide your private IP address while WebRTC still takes a direct route and exposes your public ISP-facing IP address.

• Whether WebRTC peer connections are allowed to run at all

You can disable WebRTC peer connections, but doing so can break browser features that rely on them, such as video calls or requests to low-latency streaming platforms like Twitch and YouTube Live. Controlling WebRTC instead can help you preserve the browser functionality you need while limiting unwanted IP exposure.

Now that you know what controlling WebRTC means, let's look at how to do it in your web browser.

How to control WebRTC in your browser

The extent to which you can control WebRTC depends on the browser you are using.

WebRTC control in Chrome and Chromium browsers

Chrome does not provide a simple setting that you can use to change its WebRTC IP-handling policy. However, it supports four handling modes that browser extensions can control through its privacy API. They are:

• Default: WebRTC can use any available network interface to establish a connection.

• Default public and private interfaces: WebRTC sticks to your default internet connection but can still use private IP addresses associated with it.

• Default public interface only: WebRTC uses your public-facing internet connection and avoids private-IP connections.

• Disable non-proxied UDP: WebRTC cannot make a direct UDP connection outside your proxy. It must use UDP through a supported proxy or fall back to TCP.

The practical way to change these settings is to use a browser extension that uses Chrome's chrome.privacy.network.webRTCIPHandlingPolicy API.

WebRTC control in Firefox

Firefox lets you either disable WebRTC peer connections or control how WebRTC connections are routed. To disable WebRTC, follow these steps:

• Enter about:config in the address bar

• Accept Firefox's advanced settings warning

• Search for media.peerconnection.enabled

• Set it to false

If you want WebRTC control without disabling it, Firefox's WebExtension API supports these routing policies:

• default

• default_public_and_private_interfaces

• default_public_interface_only

• disable_non_proxied_udp

• proxy_only

You will need a compatible browser extension that uses the API to apply these controls.

WebRTC control in Microsoft Edge

Microsoft Edge is Chromium-based, so its underlying WebRTC controls are similar to Chrome. Unlike Firefox, Edge does not have a built-in setting to disable WebRTC completely. You need a browser extension to apply one of these routing policies:

• default

• default_public_and_private_interfaces

• default_public_interface_only

• disable_non_proxied_udp

Other Chromium-based browsers

Not all Chromium-based browsers work exactly like Chrome. They share the Chromium engine, but different browser makers expose different WebRTC controls.

Brave

Brave is one of the easiest browsers for controlling WebRTC handling. Here is how to do it:

• Open Brave

• Open the menu

• Go to 'Settings', then 'Privacy and Security'

• Find 'WebRTC IP handling policy'

• Choose the policy you want

Brave exposes options including default, default_public_and_private_interfaces, default_public_interface_only, and disable_non_proxied_udp.

Vivaldi

Vivaldi is not as customizable as Brave, but it does provide a native WebRTC privacy setting. To find it:

• Open Vivaldi, go to 'Settings', then 'Privacy and Security'

• Under 'WebRTC IP Handling', find 'Broadcast IP for Best WebRTC Performance'

When it is on, WebRTC can make fuller use of available network information to establish connections. When it is off, less IP information is exposed, which improves privacy but can leave fewer connection options for video calls and other WebRTC features.

Best WebRTC control extensions

It is clear that to control WebRTC in browsers like Chrome, you will need an extension. But which one should you choose?

WebRTC Control

WebRTC Control is an extension that works like a kill switch for WebRTC. It is available for Google Chrome, Mozilla Firefox, Microsoft Edge, and Opera through their respective extension stores.

Once you install it, the extension adds an icon to your browser toolbar. Clicking the icon toggles its WebRTC controls on or off, and the icon changes color to show its current status. There is no popup menu.

WebRTC Leak Shield

WebRTC Leak Shield gives you more control over how WebRTC is blocked, rather than just working as a simple on/off switch. It is available for Chrome, Firefox, and Microsoft Edge.

Once you install it on Chrome, it will request permission for:

• Privacy, so it can change the WebRTC settings

• Storage, to remember your settings

• Management, so the other extensions, such as VPNs, can interact with it

On Firefox, the customization goes a step further. It lets you block WebRTC while still allowing it on specific sites that need it. For instance, if you need to change your IP but still want WebRTC to work on Twitch, you can whitelist the Twitch URL.

WebRTC Network Limiter

WebRTC Network Limiter is the extension on our list most focused on keeping WebRTC working while limiting the routes and addresses it can use. It was developed by Google and is available through the Chrome Web Store for Chrome and compatible Chromium-based browsers.

Once you download it, it gives you an options page where you can choose how strictly you want WebRTC to use the network. It gives you these choices:

• Best media experience: This option allows WebRTC to explore the available network paths and choose the one that provides the best connection. It gives you the least privacy control.

• Use only my default IP address: This makes WebRTC use the same general network path as normal web traffic instead of considering interfaces the browser is not using. This is equivalent to default_public_interface_only.

• Use my proxy server: This forces WebRTC toward the proxy configured in Chrome. This is equivalent to disable_non_proxied_udp.

Security considerations when installing WebRTC extensions

You may install a WebRTC extension to improve your privacy, but you also need to understand what access you are giving the extension and who is behind it. Here are a few security considerations to keep in mind when installing WebRTC browser extensions:

• Look at the permissions an extension needs before installing

A privacy permission makes sense for an extension that needs to modify WebRTC privacy settings, and so does storage when the extension needs to remember the options you selected. Read and understand the permissions an extension requests before you download it.

• Check the publisher

It is better to download an extension from the official Chrome Web Store or Firefox Add-ons site than from a website you do not know.

• Read the data-use disclosure

Check the developer's data-use disclosure on the extension's download page and understand what the publisher says it does and does not do with your data.

• Don't stack several WebRTC control extensions unnecessarily

Doing so does not give you more protection. It can make it harder to know which extension actually has control over WebRTC.

Remember, the best way to check if WebRTC control is working is to test and confirm that your IP is hidden.

How to test if WebRTC is leaking your IP

You need to test your connection after enabling WebRTC control because turning the control on does not necessarily mean WebRTC will use the route you expect.

For example, a setting that hides private IP addresses may still allow WebRTC to use your ISP-facing public IP. Your normal browser traffic could also go through your proxy while WebRTC finds another network route that exposes your IP address. Another extension may even override the WebRTC setting you selected.

That is why you should test your connection after enabling WebRTC control and confirm which IP addresses WebRTC can still expose. Here is how to test whether WebRTC is leaking your IP address:

• Step 1: Configure your VPN or proxy: If you are using a VPN, connect to the server you want to use. For proxy users, configure the proxy server in your browser or device.

• Step 2: Confirm that normal browser traffic is using the new IP: Open BrowserLeaks, which checks what IP information the WebRTC API can expose, and confirm that the address displayed is the one from the proxy or VPN you just connected to.

• Step 3: Run a baseline WebRTC test before enabling WebRTC control: Go to the WebRTC test on BrowserLeaks, and note the public IP addresses WebRTC finds. This gives you a baseline to compare against after you enable WebRTC control.

• Step 4: Enable your WebRTC control: Turn on the extension and select the policy you want to use. If you are using a browser proxy and want to prevent WebRTC from taking a direct UDP route outside it, choose the disable_non_proxied_udp policy.

• Step 5: Run the same WebRTC test again: Refresh the WebRTC test and compare the new results with your baseline.

• Step 6: Interpret the results: If your normal browser IP is the proxy or VPN IP and WebRTC now shows that same public IP, your ISP-facing address is no longer being exposed in that test. If WebRTC shows no public IP because you disabled WebRTC completely, that can also be expected. If it still shows the ISP-facing public IP you were trying to hide, the WebRTC leak persists.

If the WebRTC leak still persists, check that your WebRTC extension or policy is actually active and try a stricter policy than the one you selected. Also, check whether you have another WebRTC control extension installed. If you do, disable it, restart your browser, and test again.

If you are using a proxy, make sure your WebRTC settings prevent direct, non-proxied UDP connections. If the leak still persists and you do not need WebRTC functionality, disable WebRTC completely.

Best practices for WebRTC control and VPN use

The right WebRTC leak prevention setup depends on whether your workflow needs WebRTC functionality.

When should you disable WebRTC completely?

If you don't need browser features that rely on WebRTC, there is little reason to keep it enabled. You can disable it completely, but keep in mind that doing so can break websites and browser features that depend on WebRTC connections.

When should you control WebRTC instead?

If you still need WebRTC for browser-based calls or screen sharing, it is better to control it instead of disabling it. You can use the approaches we discussed above, such as restricting the routes or addresses WebRTC can use. When working with a proxy, use the disable_non_proxied_udp policy to stop WebRTC from taking a direct UDP route outside your proxy.

Which VPN features help prevent WebRTC leaks?

Choose a VPN with features that help prevent your real IP address from being exposed. A kill switch can stop traffic from falling back to your ISP connection if the VPN disconnects.

Built-in WebRTC leak protection prevents WebRTC from using routes that could expose your IP. If you use split tunneling, make sure your browser is included in the VPN tunnel. Otherwise, WebRTC may use your normal ISP connection instead.

Recommended default setup for most users

For most users, this default setup will be more than enough to keep your IP private:

• Use a full-tunnel VPN or a properly configured proxy

• Keep WebRTC enabled if you need browser calls or screen sharing

• Enable the VPN kill switch if it has one

• Use disable_non_proxied_udp when using a browser proxy

• Run a WebRTC leak test after configuring your connection

Conclusion

The bottom line is that WebRTC control comes down to your workflow and whether you need WebRTC functionality. If you're just browsing normally and need to hide your IP using a proxy or VPN, disabling WebRTC is the simplest option.

If you're live streaming, video calling, or talking to live customer support, your browser needs WebRTC, and it is better to control it instead. Join our Discord community for more insights on network control and privacy.

Frequently Asked Questions