Proxy leaks: how a browser can still show where you are

WebRTC carries video calls and other live data between browsers. To find a route, the browser asks a STUN server for its public address over UDP.

Browser proxies carry TCP page loads, not this UDP request. So the STUN server sees your real IP, and the page can read it. By default, both Chrome and Firefox let WebRTC go direct.

Check: open the BrowserLeaks WebRTC page. If the WebRTC public IP is your own, not the proxy’s, it leaks.

• Firefox: in about:config, set media.peerconnection.ice.proxy_only_if_behind_proxy to true. A Mozilla engineer names it as the way to stop direct UDP when a proxy is set. Setting media.peerconnection.enabled to false turns WebRTC off.
• Chrome: install WebRTC Network Limiter, Google’s own extension, and choose the option that disables non-proxied UDP. On managed computers, set the WebRtcIPHandling policy to disable_non_proxied_udp.
• AliasMode: with a proxy, WebRTC traffic stays on the proxy path, and the WebRTC public IP is the proxy’s exit IP.

Before it connects, the browser looks up the site’s name. If that lookup goes to your provider’s DNS server, the provider sees the names you visit. A checker then sees a server in your country.

With an HTTP proxy, the proxy does the lookup. For https pages, the browser sends the host name in a CONNECT request, and the proxy resolves it.

With SOCKS5, it depends on the browser. Chrome always resolves on the proxy. Firefox does so by default since version 128. SOCKS4 resolves names on your computer by default.

Check: open the BrowserLeaks DNS page. If the listed DNS servers belong to your provider, or sit in your city, lookups leak.

• Firefox: keep “Proxy DNS when using SOCKS v5” ticked in Connection Settings. In about:config it is network.proxy.socks5_remote_dns.
• Chrome: use a socks5:// or HTTP proxy, not socks4://. Chromium’s SOCKS guide warns that parts of Chrome, such as the DNS prefetcher, may still look up names locally. It suggests a catch-all flag, shown below.
• AliasMode: with a SOCKS5 proxy, names resolve on the proxy. With an HTTP proxy, the proxy also resolves names.

--proxy-server="socks5://myproxy:8080" --host-resolver-rules="MAP * ~NOTFOUND , EXCLUDE myproxy"

This leak is not about the network. Pages read the time zone from your system clock through JavaScript. The browser also sends an Accept-Language header with your language list.

Say the IP is in Germany, but the clock says New York. A site can compare the two and see the mismatch.

Check: the BrowserLeaks IP page shows your IP’s time zone and the Accept-Language header your browser sent. To see the browser’s own time zone, run this line in the developer console:

Intl.DateTimeFormat().resolvedOptions().timeZone

• Chrome: set the language order under Settings > Languages > Preferred languages. The time zone comes from the system, so change the system time zone to match.
• Firefox: search the settings for “language” and set the website languages. The time zone also comes from the system. Firefox’s resistFingerprinting mode, Tor Browser and Mullvad Browser report UTC for everyone instead.
• AliasMode: the app looks up the proxy’s exit location through the proxy. It then sets the profile’s time zone and language to match.

Many connections have both an IPv4 and an IPv6 address. A VPN or proxy setup that carries only IPv4 can let IPv6 traffic take the direct route. Mullvad’s VPN app once blocked IPv6 on the computer for this reason, before it could tunnel IPv6.

Check the IPv6 test on the BrowserLeaks IP page. If it shows an IPv6 address from your own provider, use a VPN that tunnels IPv6, or turn IPv6 off. Run this check with any proxy or VPN setup.

AliasMode is a free, open-source profile manager. Each profile can have its own HTTP or SOCKS5 proxy. The WebRTC, DNS and time zone handling above comes with it. Still run the checks, because a proxy can be set up wrong.