While reading about WebRTC I was wondering how exactly the default route through an established VPN tunnel is being bypassed. If I'm not mistaken the VPN tunnel is normally represented in the system by a virtual network adapter to which the default route can be set to route all internet traffic through it (corrections and amendments welcome). So, does WebRTC have to choose the physical NIC used to connect to the internet instead of the virtual tunnel adapter to do it and if so, how is this being done?
WebRTC uses ICE to generate a list of IP address that can be used to reach your computer. This is important when trying to establish a direct connection. However, this list can sometimes include IP addresses that the user would rather not disclose. As explained here, this behavior is counterintuitive when using a VPN as their actual IP address can be discovered with WebRTC:
Many such users assume that using a VPN will obscure all their browsing and their real external IP address, which could be used to locate them.
However many VPN configurations don’t properly disable local interfaces, and so users of those VPNs might be surprised to learn that their real external IP addresses are exposed by ICE.
So, if your browser is giving out your real IP address, it becomes possible to create direct connections to that interface, bypassing the VPN.