Browser privacy
How to Test a WebRTC Leak: Steps and Interpretation
Compare a baseline and VPN connection to understand STUN candidates, dual-stack paths, mDNS, and tests that cannot complete.
Record a baseline first
Where your network setup permits, record your public address and IP version before enabling the VPN, then open the WebRTC test. Several STUN servers may return different candidates. Save the addresses and observation time rather than only a pass or fail label; those details make the comparison reproducible.
Repeat after connecting the VPN
Connect the VPN and refresh the public-IP and WebRTC tests in the same browser environment. Confirm that the HTTP exit changed as expected, then check whether public candidates still include the baseline exit. An additional IPv6 address needs to be interpreted with your dual-stack settings and network-operator information.
Distinguish candidate types
Private addresses apply inside local networks, mDNS can replace a local address with a name, and STUN can observe a public mapping. The candidate list describes paths offered by the browser during this test. Decide whether an extra public path needs correction by comparing it with your intended tunnel coverage.
What to do when no result appears
Browser policies, firewalls, and unreachable STUN services can prevent candidates from appearing. Review each node’s status, then check the VPN’s WebRTC and UDP settings. If a path cannot be observed, retain an unknown conclusion. Use the DNS test to inspect a separate part of the connection.