What a WebRTC leak test actually tells you

WebRTC leak pages are excellent at creating panic: several addresses appear, a red “Leak” label follows, and disabling half the browser suddenly feels reasonable.

An ICE candidate is not automatically a real public-address leak. Judge its type, address scope and relationship to the normal connection before and after the proxy.

Why WebRTC gathers addresses

Voice, video and peer-to-peer features need a usable path between different networks. ICE gathers candidates and tests connectivity.

host comes from a local interface; modern browsers may replace the local address with an mDNS name.
srflx is the NAT mapping observed through STUN.
prflx is discovered during peer connectivity checks.
relay is allocated by a TURN relay.

Run a comparison, not a colour test

Without the proxy, record public IPv4 and IPv6.
Connect the proxy and confirm the ordinary web address changed.
Run the WebRTC test and note both candidate type and address.
Compare public candidates with the two recorded states.

A meaningful warning is an original public address appearing as a candidate while normal web traffic exits through the proxy.

Without a baseline, an unfamiliar address proves little. It may belong to the proxy, an ISP IPv6 path or a TURN relay.

The IPv6 trap

A proxy may carry IPv4 while leaving a working IPv6 route outside the tunnel. Web pages can show the proxy IPv4 while WebRTC discovers direct IPv6. That is a real coverage problem, but the root cause is the uncaptured IPv6 path. Use the IPv6 layer checklist to verify it.

Frequent false alarms

A private LAN address is not the same as a public Internet address.
An mDNS name is a privacy replacement for a local address.
A candidate matching the proxy exit may show that the tunnel is working.
A relay address belongs to TURN by design.
Some old test pages label any candidate as a leak.

Fix the correct layer

Check whether the VPN or proxy covers WebRTC, UDP and IPv6, whether split tunnelling excludes the browser, and whether a system “block connections without VPN” option is appropriate. A browser extension controls only browser behaviour; a strict no-direct-traffic requirement belongs at the system VPN or firewall boundary.

Should WebRTC be disabled?

It can make a test page quieter while breaking meetings, browser calls and peer-to-peer transfers. First correct the network path. Disable the feature only when its loss is acceptable and the remaining privacy benefit is understood.

Keep a reproducible record: browser version, proxy mode, IPv6 state, normal exit addresses and candidate types. If a mobile test itself seems broken, inspect it with the mobile debugging guide.

Reference: MDN on ICE candidate types