What a STUN server can reveal to a browser

You may have a VPN connected and still wonder whether a website can see your regular internet address. A STUN server can help a browser discover the public address it is using for WebRTC, which can sometimes reveal that a connection is bypassing the VPN.

Here is what that means, how to check your setup with the VPN Leak Test, and what to do if it reports your real IP address.

Check what your browser reveals

1. Connect to your VPN before testing. If you use a VPN browser extension, make sure it is enabled for the browser and the current website.
2. Open the VPN Leak Test in the same browser where you use the VPN.
3. Run the check and look at the WebRTC and IPv6 results separately. These check different possible ways your real address could appear.
4. If an address is reported, compare it with the address you expect from your VPN. A VPN provider may show its own address in its app or account details. Do not assume that every address shown is a leak.
5. Repeat the check after changing one setting at a time. Keep the VPN connected, and use the same browser and network so you can compare results.

You do not need to grant camera or microphone access just to check a network address. WebRTC can gather connection details without starting a camera or microphone stream.

What the result means

The test shows only an address belonging to the VPN

The browser's WebRTC traffic appears to be using the VPN connection. That is a good result for this check, but it is not proof that every app on the device is protected. A VPN browser extension, for example, may cover browser traffic but not other apps.

The test shows your regular public IP address through WebRTC

The browser may be sending WebRTC traffic outside the VPN tunnel, or your VPN may not be blocking that route. A website that gathers WebRTC connection candidates could learn an address that differs from the one it sees on your normal page request. Check split tunneling, VPN leak protection and browser-specific VPN settings below.

The test reports an IPv6 address you do not expect

IPv6 is a separate way to connect to the internet. Your VPN may tunnel IPv4 traffic while leaving IPv6 traffic outside the tunnel. This is an IPv6 leak, not necessarily a STUN issue. Ask your VPN provider whether its service supports IPv6, and follow its instructions rather than changing network settings at random.

No address appears, or the result is unclear

A browser can limit which network details a page can read, and a VPN may block some requests. A missing result does not prove that every connection is protected. Repeat the test in an updated browser, check the VPN's leak-protection information, and compare with the provider's own troubleshooting steps.

For a broader walkthrough of IP leak checks, see How to check whether your VPN leaks your IP address.

How to fix a WebRTC or IPv6 leak

1. Reconnect the VPN and retest. Disconnect, connect to a different VPN server, then run the check again. A temporary connection failure can leave a route outside the tunnel.
2. Check whether the VPN covers the browser. If you use a VPN extension, make sure it is enabled for this site and that browser traffic is included. If you use a VPN app, confirm that it is connected and not set to exclude your browser.
3. Turn off split tunneling for the browser. Split tunneling lets selected apps or sites avoid the VPN. Look in your VPN app's settings and remove the browser from any excluded-app list. The labels vary by provider.
4. Enable leak protection or a kill switch. These options aim to block internet traffic if the VPN disconnects or to prevent traffic from using an uncovered route. They are usually in the VPN app, not in the browser. Test again after enabling them.
5. Check the VPN connection in system settings. On Windows 11, open Settings › Network & internet › VPN if you use a Windows VPN profile. On macOS, open System Settings › Network › VPN & Filters for a system profile. If you connect through a separate VPN app, check its own connection and leak-protection settings.
6. Ask the VPN provider about IPv6. If the IPv6 result shows your regular address, check whether the provider supports IPv6 and what its recommended fix is. Do not disable IPv6 unless the provider or your network administrator advises it.
7. Update the browser and VPN software. Updates can include fixes to WebRTC handling and tunnel routing. Restart both after updating, reconnect the VPN and run the test again.

Some browsers or browser extensions offer ways to limit WebRTC address exposure, but disabling WebRTC can break voice and video calls. If you rely on those features, use a VPN that protects WebRTC traffic instead of turning the feature off without testing your apps.

What a STUN server actually sees

STUN stands for Session Traversal Utilities for NAT. NAT is the network function that lets multiple devices share one public internet address. WebRTC uses STUN as one way to discover the address and port that other devices may need to reach for a direct connection.

The browser sends a request to a STUN server, and the server replies with the address and port it observed. The browser can use that information as a WebRTC connection candidate. Depending on browser protections and network routing, a website using WebRTC may be able to read some candidates. Modern browsers often hide local network addresses behind temporary names, but that does not guarantee that a public address is hidden in every setup.

A STUN server does not automatically get access to your browsing history, files or account details. It can observe the network address used for its request and when the request arrived. If the request goes through your VPN, the server should see the VPN's public address. If it goes around the tunnel, it may see the address assigned by your internet provider.

The test runs in your browser and checks whether your real IP appears through WebRTC or IPv6 while the VPN is connected.