How Firefox Preferences Prevent WebRTC VPN IP Leaks

This article provides an overview of how specific Firefox configuration preferences prevent WebRTC from leaking your local and real IP addresses while connected to a VPN. By modifying settings like media.peerconnection.ice.default_address_only and related parameters in Firefox's advanced configuration, users can restrict how the browser's Interactive Connectivity Establishment (ICE) framework discovers network interfaces, ensuring all real-time communication traffic strictly adheres to the VPN tunnel.

Why WebRTC Leaks IP Addresses

Web Real-Time Communication (WebRTC) allows browsers to establish direct peer-to-peer connections for voice, video, and data sharing. To establish these connections, WebRTC uses a framework called Interactive Connectivity Establishment (ICE), along with STUN/TURN servers, to discover the best network path between peers.

By default, the ICE agent enumerates all available network interfaces on your device. When you use a VPN, your system has at least two active interfaces: your physical network adapter (assigned your local LAN IP) and the virtual VPN adapter (assigned your VPN IP). Standard WebRTC behavior queries both, allowing websites to see your local LAN IP address and potentially your real public IP address if STUN requests bypass the VPN tunnel.

How media.peerconnection.ice.default_address_only Works

Setting media.peerconnection.ice.default_address_only to true in Firefox's about:config directly alters how the ICE agent gathers network candidates.

Instead of scanning every active network adapter on your system, this preference restricts WebRTC to using only the single network interface responsible for default routing. When a VPN is active and properly configured, it overrides your system's default gateway so that all internet traffic goes through the encrypted VPN tunnel.

Because the VPN interface is now the default route, default_address_only forces WebRTC to bind exclusively to the virtual VPN adapter. The browser completely ignores your physical Ethernet or Wi-Fi adapters, effectively hiding your local LAN IP address and preventing STUN requests from leaking out of your normal ISP connection.

While default_address_only is effective, combining it with other ICE-related preferences provides comprehensive protection against WebRTC leaks, even if a VPN drops or misconfigures the default route.

media.peerconnection.ice.no_host

When set to true, this preference prevents the ICE agent from gathering "host" candidates altogether. Host candidates are the local IP addresses (such as 192.168.x.x or 10.x.x.x) assigned directly to your device's network interfaces. By disabling host candidate gathering, Firefox will never expose any local LAN IP addresses to a website or peer, relying entirely on public-facing IP addresses (such as your VPN server's IP) discovered via STUN or TURN servers.

media.peerconnection.ice.proxy_only_if_behind_proxy

If you use a SOCKS5 or HTTP proxy in Firefox instead of a system-wide VPN, default_address_only will not protect you because a browser proxy does not change the operating system's default routing table. Setting media.peerconnection.ice.proxy_only_if_behind_proxy to true forces WebRTC traffic to route exclusively through the configured browser proxy, disabling direct UDP connections that would otherwise leak your IP.

media.peerconnection.ice.obfuscate_host_addresses

Enabled by default in modern versions of Firefox, this setting uses Multicast DNS (mDNS) to replace your local LAN IP address with a randomly generated .local UUID string. While this hides the actual numerical IP address from websites, advanced users often still configure default_address_only and no_host to stop the browser from querying the local network interfaces entirely.

media.peerconnection.enabled

This is the master switch for WebRTC. Setting this preference to false completely disables WebRTC functionality in Firefox. While this guarantees zero WebRTC IP leaks, it will break browser-based video conferencing, voice calls, and certain web applications. Using default_address_only and no_host is generally preferred, as these settings maintain WebRTC functionality while enforcing VPN privacy.