i want to understand more about WebRTC security when using vpn. id like to know if it is more secure with VPN than without... or even if its recommended to use WebRTC with VPN.
i created a webrtc demo: https://chat.positive-intentions.com/#/webrtc (the corresponding code its created with: https://github.com/positive-intentions/chat/blob/staging/src/components/pages/webrtc/WebRTC.jsx)
if i generate a "WebRTC offer" then i see a bunch of information including my IP address.
if i do the same with VPN, i see that my ip address isnt in that payload.
following the information here: https://thehackernews.com/2015/02/webrtc-leaks-vpn-ip-address.html?m=1
and using the demo here: https://ipleak.net/
it seems even with vpn, the local ISP ip seems detected.
a recurring concern ive had on reddit about the security of my app is that webrtc exposes ip addresses. im investigating using the app with vpn. it seems to work like normal.
in the example details given above, i see while the local ISP IP is exposed, the personal ip address is still hidden. im sure what is exposed there is not worthless, but it could help users with privacy and security.
on the back of this investigation id like to see if i can add something like a toggle in my app called "enforce VPN" which will first check to see if you are on a vpn, and if you are, open the rest of the app.
my app is using peerjs-server as the connection broker. this is a third party i have no contractual agreement to provide me with a service. it could help to hide your IP from this service.
If anyone is intrigued by the comment:
OpenWRT, the router software, has built-in support for VPNs, including OpenVPN and Wireguard. Some router companies base their router software on OpenWRT, so you don't even have to be technologically oriented enough to feel confident with flashing your router yourself. I don't know if this is included in base OpenWRT, but some companies include support for some VPN vendors, so you don't even have to do much more than configure your account, and it'll download exit node lists and so on.
My favorite router company, GL.iNet, is one of these. Inexpensive routers, OpenWRT-based, with built in support for my VPN provider (Mullvad). I pick the countries I want, and it downloads lists of Mullvad exit nodes, and I just pick the one I want to use. I'm sure there are other router companies that do something similar.
The point is: if you can afford $100 (for a whole-house router), or $33 (if you only need coverage for an apartment), and you're non-technical, you can get yourself whole-home VPN coverage by switching your router.
Alternately, OPNsense (free) on a cheap computer with two or more ethernet ports can do this. Unlike OpenWRT, it is much easier to update.
Good to know, options are great. Easiest, I'd say, are still the products like GL.iNet, which can be configured to auto-update. This may be something GL.iNet has added to their version of OpenWRT, but it works just fine.