Skip to main content

IP & WebRTC Leak Test

Detailed detection of every VPN leak vector: public IPv4, IPv6 exposure, WebRTC ICE candidates by type, and DNS resolver probes. Runs automatically.

Testing…

One or more leaks detected. Your real IP or DNS may be exposed.

Public IPv4

Not detected

IPv6 Exposure

Not tested

WebRTC ICE Candidates

srflx = server-reflexive (real public IP) · host = local network IP · relay = TURN

No WebRTC candidates detected — good (or WebRTC is disabled)

DNS Resolver Check

All DNS queries should resolve from your VPN server IP

DNS resolvers not reachable
Connection Check DNS Leak Test 🔬 Fingerprint Test

Quick Answer

A VPN has four major leak vectors: your public IPv4 address, your IPv6 address (often not tunnelled), WebRTC ICE candidates that expose your real IP via STUN, and DNS queries that bypass the VPN to your ISP. This tool checks all four simultaneously.

  • • IPv6 leaks are the most common — most VPNs only tunnel IPv4
  • • WebRTC srflx ICE candidates expose real IP even with VPN active
  • • DNS leaks show your ISP every domain you visit despite VPN
  • • LimeVPN blocks IPv6, kills WebRTC leaks, and routes DNS privately

Understanding VPN Leak Vectors

A VPN tunnel is only as strong as its weakest leak point. There are four main vectors where your real identity can bypass the VPN tunnel:

🌐

Public IPv4 Address

The baseline check. Your IPv4 address should reflect your VPN server, not your home or office. The ISP/org field reveals whether it belongs to a VPN provider or your real ISP.

6️⃣

IPv6 Leak

Most home connections have an active IPv6 address assigned by the ISP. If the VPN only creates an IPv4 tunnel, IPv6 DNS queries bypass it entirely — directly traceable to you. The safest solution: block all IPv6 at the VPN level.

📡

WebRTC ICE Candidates

WebRTC uses ICE to find the most direct path between peers via STUN servers. The srflx (server-reflexive) candidate type is the dangerous one: it shows exactly what a STUN server sees, which may be your real ISP IP instead of the VPN IP.

🔍

DNS Resolvers

Every domain you visit requires a DNS lookup. When connected to a VPN, all DNS requests should route through the VPN's own DNS servers. This tool queries three public resolvers to see which IP they receive your query from — all should show your VPN server's IP.

Seal Every Leak with LimeVPN

LimeVPN blocks IPv6, prevents WebRTC leaks, runs private DNS, and includes a kill switch on all plans. From $5.99/month.

Get LimeVPN — From $5.99/mo

AES-256 Encryption · No-Logs Policy · 30+ Locations · Kill Switch

Frequently Asked Questions

What is a WebRTC leak? ▼
WebRTC (Web Real-Time Communication) is a browser API for video calls and peer-to-peer connections. To establish connections, it uses ICE (Interactive Connectivity Establishment) which discovers your real IP address via STUN servers — often bypassing VPN tunnels. A WebRTC leak means your real IP is visible to websites even when you're connected to a VPN.
What are ICE candidates? ▼
ICE candidates are connection endpoints discovered by WebRTC. "host" candidates are your local network IPs (like 192.168.x.x). "srflx" (server-reflexive) candidates are your real public IP as seen by a STUN server — this is the dangerous one that can leak. "relay" candidates go through a TURN server.
Why does IPv6 matter for privacy? ▼
IPv6 addresses are globally unique and often tied to your ISP account. If your VPN tunnels only IPv4 traffic and your device has an active IPv6 address, every site you visit can see your real IPv6. This completely undermines IPv4 anonymity from the VPN.
What is a DNS leak? ▼
When you visit a website, a DNS server translates the domain name into an IP address. If your DNS queries go to your ISP's servers instead of your VPN's servers, your ISP can see every domain you visit — even if your actual traffic is encrypted. This tool probes three public resolvers to see which IP they receive your query from.
How is this different from the Connection Check tool? ▼
The Connection Check (/tools/connection-check) gives a quick pass/fail overview. This tool provides more technical detail: it shows every individual ICE candidate by type, distinguishes between private and public WebRTC addresses, and shows DNS resolver results individually so you can see exactly which resolvers are routing through your VPN.
My VPN is connected but I still see a leak — why? ▼
Some VPN clients don't disable WebRTC at the OS level, especially browser-based clients. If you see a srflx (server-reflexive) ICE candidate that doesn't match your VPN server IP, your VPN is not blocking WebRTC. LimeVPN includes WebRTC leak protection in all apps. You can also disable WebRTC in Firefox (media.peerconnection.enabled = false in about:config) or use a browser extension.

More Privacy Tools

What Is My IP

See your public IP address, location, and ISP in real time.

DNS Leak Test

Check if your VPN is leaking DNS queries to your ISP.

VPN Speed Test

Measure download speed, upload speed, ping, and jitter.

LimeVPN Security Features

Kill switch, WebRTC protection, AES-256 encryption explained.