What is the easiest setup to hide your public IP from installed applications and prevent things like WebRTC leaks on a common Linux distro?

  • 1
    You can do it with firejail and a virtual bridge, for example. See: linux.com/news/… – mricon Oct 3 '20 at 19:18

Your IP can be leaked from a number of sources.

  1. Use a browser plugin like noscript and be careful whom you let run scripts on your computer
  2. Use a distro like Tails which has all the necessary firewall rules already baked in

A basic level concept of security vs "ease of use"; you CAN NOT have both at the same time. You can either increase security, like go above and beyond and forget accessibility, or the other way around. For Example, you can definitely prevent WebRTC leaks by doing a pre-30min preparation before "Checking your Email".

WebRTC is an accessibility service allowing ease of access to media resources. WebRTC uses IP addresses to establish direct p2p connection evading general xml-http-request formats and using APIs allowing less miscellaneous data in "data frame" and more "useful" data relating to your media. What is a "leak"? It sometimes leaks that public IP.

You have to understand that, WebRTC model is "deffected" at its core. You can not prevent it from doing something that makes it function properly. You can only decide how much exposure you are willing to trade in for ease of access.

How do you get around the leaks?

  • Disable WebRTC altogether
  • Use Tor
  • Use a VPN
  • Use dual layer security i.e. a proxy (can be Tor, but I prefer SOCKS) on top of a VPN
  • Bind your browser to a specific interface

Disable WebRTC altogether

It mostly varies with the browser but generally you go to developer options and turn WebRTC off. On the upside no IP leak. On the downside media will load slowly, and there will be frame drops.

Use Tor

Install Tor system-wide or use Tor bundled browser. On the upside, if a leak happens, the end node IP will be exposed. On the downside, it is slow and it undermines the benefit of WebRTC.

Dual Layer Security

Install VPN system-wide and use a proxy in the browser itself. On the upside, leak exposes the VPN's IP and it's 95% of your actual ISP's allocated bandwidth. Not that many downsides that matter except being expensive and prone to outages. Also depends largely on the Privacy Policy of VPN and Proxy providers. More on that at the end.

A general layout of dual stack is;

Say you are connected to the internet via wlan0. Now you use a VPN that creates a new iface, tap0. What happens if a webRTC decides to take a leak? It will evade your VPN and proxy and it will try to use/route its traffic through wlan0. How do you prevent it?

First, bind your browser to tap0, VPN's interface then use a proxy on top of it. Now if a leak happens, the worst will be the exposure of tap0's IP, which is your VPN's IP. If someone is stalking you, through fingerprinting and they are powerful, then you are doomed again as they can leverage the VPN provider. Now it is on VPN provider that either they fight for you or for their own business.

There is also a more advanced method of achieving binding. It involves using containers with namespace separation. I believe it only works in UNIX-like operating systems but it is more robust and allows for fine-grained resource management and also automation is easy. Wireguard has a guide on namespace-separation, I believe.

  • 1
    "you CAN NOT have both at the same time" -- this is a gross overstatement and not universally true. It is often true, but you can't make a blanket statement like that. – schroeder Jun 7 at 7:14

Qubes OS comes to mind: https://www.qubes-os.org/

You can create a Whonix Gateway, or create a ProxyVM with any VPN that you like to use, and then route your AppVM through it. Here's the instructions: https://github.com/Qubes-Community/Contents/blob/master/docs/configuration/vpn.md


How to prevent WebRTC leaks? Disabling WebRTC is the only bulletproof way. There are browser extensions that can help toggle it, for convenience.

Otherwise, to hide your IP address from installed applications, you'd need to route your traffic somewhere else so it does not appear to come from your public IP address, using something like Tor or a VPN. You'd also need firewall rules that ensure 100% of your traffic goes through that so there are no leaks.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.