i want to understand more about WebRTC security when using vpn. id like to know if it is more secure with VPN than without... or even if its recommended to use WebRTC with VPN.
i created a webrtc demo: https://chat.positive-intentions.com/#/webrtc (the corresponding code its created with: https://github.com/positive-intentions/chat/blob/staging/src/components/pages/webrtc/WebRTC.jsx)
if i generate a "WebRTC offer" then i see a bunch of information including my IP address.
if i do the same with VPN, i see that my ip address isnt in that payload.
following the information here: https://thehackernews.com/2015/02/webrtc-leaks-vpn-ip-address.html?m=1
and using the demo here: https://ipleak.net/
it seems even with vpn, the local ISP ip seems detected.
a recurring concern ive had on reddit about the security of my app is that webrtc exposes ip addresses. im investigating using the app with vpn. it seems to work like normal.
in the example details given above, i see while the local ISP IP is exposed, the personal ip address is still hidden. im sure what is exposed there is not worthless, but it could help users with privacy and security.
on the back of this investigation id like to see if i can add something like a toggle in my app called "enforce VPN" which will first check to see if you are on a vpn, and if you are, open the rest of the app.
my app is using peerjs-server as the connection broker. this is a third party i have no contractual agreement to provide me with a service. it could help to hide your IP from this service.
So this comes down to how the browser, OS and VPN handle this.
My understanding has been that Windows handles openvpn poorly and is prone to leaking.
However, Linux when using wireguard works fairly well but may leak lan IPs.
People who configure their router to use a VPN service are safe because it's transparent to the OS.
Then there's the rare few that are using socks and their IP information gets leaked by webRTC fairly easily.
Now my understanding of these may be outdated, so I would suggest building test units to evaluate these conditions and confirm it for yourself in your app.
Generally speaking the kind of person that's concerned with this problem also runs their browser with JavaScript disabled and by extension webrtc disabled.
Thanks for the clear info! I'll investigate this further within the demo.
Glad to help, just keep in mind not everyone is connected to a NAT, so if you see a leaked LAN IP that condition will leak their WAN IP.