A WebRTC leak test can show whether a browser is gathering a public IP address different from the one ordinary HTTPS requests use while your VPN is connected. If HTTPS shows the VPN exit but WebRTC repeatedly reports your ISP’s public address, investigate the routing. That mismatch does not prove that every app or connection bypasses your VPN, and a local network address is not the same thing as an exposed ISP address.
Why a VPN check and a WebRTC check can show different addresses
A normal web request reveals the public address used for that request. WebRTC is designed to connect browsers and other endpoints directly for real-time audio, video, and data. To find a workable connection, it gathers ICE candidates—possible network addresses and routes—and can expose address information that a typical HTTP transaction does not show. The IETF describes this as a trade-off between privacy and media connectivity, not evidence that WebRTC is malicious. RFC 8828 explains the address-handling requirements.
As an Amazon Associate I earn from qualifying purchases.
The difference can matter with a VPN. A browser might send HTTPS through the VPN while WebRTC discovers an address on another interface. RFC 8828 says that, in a split-tunnel VPN configuration where the client and operating system support routing over multiple interfaces, “WebRTC can discover not only the public address for the VPN, but also the ISP public address over which the VPN is running.” That is a conditional case, not a claim that all VPNs leak.
STUN, a protocol used to discover how a device appears across a NAT, can also reach the internet directly if a classical application proxy permits direct access. RFC 8828 describes this as a possible routing configuration, not an inherent flaw in every VPN. RFC 8826 likewise notes that a site can cause a browser to provide address information even when a VPN masks the address seen through ordinary web traffic. What a particular site or application gathers and shares depends on its implementation.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
How to read the addresses in a test
ICE candidate types help distinguish a harmless local address from a public address that deserves attention. MDN documents the candidate types and address property in its RTCIceCandidate.address reference.
| Candidate | What it represents | What to look for |
|---|---|---|
host |
An address assigned to a device interface, often a private/local network address. | A private address such as one used inside a home network is not, by itself, the same as exposing the ISP’s public address. |
srflx (server-reflexive) |
A public NAT mapping discovered through STUN. | Check whether it matches the VPN exit or instead appears to be your ISP’s public address. |
prflx (peer-reflexive) |
An address learned during ICE connectivity checks with a peer. | A test may not display this type in the same way as a host or server-reflexive candidate. |
relay |
An address allocated through a TURN relay. | A relay candidate reflects a relayed route; a STUN-only test does not establish how TURN behaves. |
Do not treat every candidate as an ISP leak. The important comparison is whether a public candidate identifies an unexpected path while the VPN is active. Candidate labels explain how an address was learned; they do not alone prove which organization controls an address or how every connection is routed.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
Run the comparison with your VPN off and on
- Use one browser and one network. Keep the browser and network unchanged for both runs so the comparison is meaningful.
- Disconnect the VPN and run the test. Record the HTTPS-visible public address and every WebRTC candidate the page reports. Note which candidates are local/private and which are public.
- Close or refresh the test page, connect the VPN, and run it again. Record the HTTPS address and candidates again. Repeating the page load helps avoid comparing results from a previous session.
- Compare the connected results. The HTTPS lookup should show the address used for web requests through the VPN. Identify whether public WebRTC candidates match that VPN exit or show a different public address that appears to be the ISP connection.
- Classify missing results as incomplete. If STUN times out, no candidate appears, or the page cannot provide the HTTPS comparison, the test has not established that no address is exposed.
A recurring ISP public address among WebRTC candidates while HTTPS shows the VPN exit is a strong reason to investigate. It is evidence about that browser, network, VPN state, and test path—not proof about every app, route, or software version. ExpressVPN’s guidance also recommends comparing results before and after connecting, but that is vendor guidance rather than independent validation of any provider: ExpressVPN’s WebRTC leak test guidance.
What a browser test can and cannot establish
A browser test commonly compares an HTTPS lookup with addresses gathered through ICE and STUN. One inspected NumLM page says its HTTPS lookups contact ipify and Cloudflare, while its STUN requests contact Google and Cloudflare. Those services therefore see the user’s public IP during the test. The page says its candidate report stays in the browser tab, it does not request camera or microphone access, and it does not test TURN relays. These details describe that page’s implementation as inspected on October 4, 2026; other tests may behave differently. NumLM WebRTC leak test.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
Before running any test or sharing a report, read its data disclosure. A test can contact third-party HTTPS and STUN services even when it does not ask for camera or microphone permissions. A result that shows no STUN response is inconclusive: a firewall, extension, browser policy, or network condition may have blocked the request. And a page that tests STUN does not characterize TURN relay behavior or every route used by another WebRTC application.
Browser privacy controls are not interchangeable. MDN documents Firefox’s privacy.network settings, but availability and effects depend on browser and extension; do not apply a Firefox preference to another browser or assume one universal setting covers every application. See MDN’s privacy.network reference.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
What to do if you see an unexpected public address
- Repeat the off/on comparison after refreshing the test page. Confirm that the unexpected address recurs and is public rather than a private local-network candidate.
- Check the VPN app’s routing or split-tunneling configuration. If some traffic is intentionally excluded from the VPN, the WebRTC path may differ from the HTTPS path.
- Review browser extensions and network policies that can block or alter WebRTC requests. A blocked test is not the same as a clean result.
- Consult documentation for the specific VPN and browser about WebRTC and routing behavior. Do not infer a product-wide failure from one browser test.
- If you control the WebRTC application, configure an ICE transport policy of
relaywhen hiding direct candidate addresses from the remote peer is more important than the broader candidate pool. MDN documents this option for applications that create their ownRTCPeerConnection; it is not a universal browser-wide switch.
Historical experiments have found that observed address disclosure can depend on the browser, VPN, and client-side configuration, but a 2017 preprint cannot establish current market-wide leak rates. Al-Fannah, “One Leak Will Sink A Ship: WebRTC IP Address Leaks”.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteQuick Recap
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
