IP Leak Tests & Connection Privacy Audits
Verify that your encrypted VPN, proxy, or leased line is completely hermetic. Test against silent WebRTC STUN leaks, transparent DNS proxies, and HTTP header leakage.
Quick Answer
An encrypted tunnel can appear completely functional while still exposing your true identity through side-channels. The three most common vulnerabilities are WebRTC STUN leaks, Windows multi-homed DNS leaks, and IPv6 dual-stack bypasses where IPv6 traffic routes outside an IPv4-only tunnel.
- WebRTC STUN requests bypass standard SOCKS5 and HTTP browser proxy settings.
- DNS leaks occur when queries default to local ISP nameservers instead of tunnel resolvers.
- IPv6 traffic must either be natively tunneled or disabled at the OS adapter level to prevent leaks.
Live WebRTC STUN Candidate Analyzer
Probing local RTCPeerConnection candidate addresses directly from your browser:
- Probing STUN stun.l.google.com:19302...
Privacy Leak Vectors & Technical Remediations
Understanding how network telemetry escapes encrypted tunnels and how to harden your endpoints.
| Leak Vector | Protocol / Layer | Root Cause | Guaranteed Fix |
|---|---|---|---|
| WebRTC Leak | Layer 7 (Browser API / UDP) | ICE candidate gathering queries STUN directly | Disable WebRTC in browser or use anti-detect browser |
| DNS Leak | Layer 4 (UDP Port 53) | OS queries fastest adapter (local ISP) | Set tunnel DNS explicitly or enforce TUN virtual adapter |
| IPv6 Bypass | Layer 3 (IPv6 Stack) | VPN client only routes IPv4 0.0.0.0/0 | Enable dual-stack VPN routing or disable IPv6 adapter |
| HTTP Header Leak | Layer 7 (HTTP Headers) | Proxy attaches X-Forwarded-For or Via | Use Elite/High-Anonymity proxies or Shadowsocks/VLESS |
| TCP Socket Bleed | Layer 4 (OS Socket Pool) | Stale keep-alive sockets remain on old IP | Flush browser sockets in chrome://net-internals |
Connection Leak Hardening Playbook
[ Run Leak Diagnostic Suite ]
|
+----------------+----------------+
| |
[ WebRTC Leak Detected ] [ DNS Leak Detected ]
| |
STUN Exposes Real IP ISP Nameserver Observed
| |
Disable WebRTC in Browser Enforce OS Adapter DNS Binding
(about:config in Firefox) (or enable strict TUN mode)
| |
Retest via /ip-tests Retest via /ip-tests
MyIP Wiki is independently supported by our audience. Some links on this page are affiliate referral links (containing tracking codes and marked as sponsored/nofollow). When you register or purchase through these links, we may earn a referral commission at no additional cost to you. This support funds our independent network testing infrastructure. Editorial ratings and rankings remain strictly based on objective performance benchmarks.
Frequently Asked Questions
What is a WebRTC leak, and how does it compromise VPN tunnels?
WebRTC (Web Real-Time Communication) is an HTML5 browser standard for voice and video communication. To establish direct peer-to-peer media streams, the browser queries STUN (Session Traversal Utilities for NAT) servers. During this ICE candidate gathering, WebRTC can bypass system proxy settings and expose both local private LAN IPs and real public WAN IPs directly to web pages via JavaScript.
How does a DNS leak test work?
A DNS leak test generates a set of randomized, unique subdomains (e.g. "probe-38a9b.myipwiki.cc"). When your browser tries to load assets from those subdomains, it forces your system to resolve them. Our authoritative nameserver inspects the incoming IP address of the recursive resolver handling the query. If that resolver belongs to your local ISP instead of your VPN provider, a DNS leak is confirmed.
What is an HTTP header leak?
When connecting through intermediate proxies or misconfigured reverse proxies, headers such as X-Forwarded-For, Client-IP, or Via may transmit the original client IP to the destination web server, defeating the purpose of an anonymous proxy.
Data & Technical Sources
- IETF RFC 5389 — Session Traversal Utilities for NAT (STUN)
- IETF RFC 8445 — Interactive Connectivity Establishment (ICE)
- W3C WebRTC 1.0 Specification — Real-Time Communication Between Browsers