Compare browser WebRTC STUN/ICE candidates with your web egress address to check whether a proxy or VPN exposes public or local IPs.
WebRTC uses ICE/STUN to discover addresses for peer-to-peer connections. STUN usually uses UDP. If a proxy handles only TCP, candidates may expose another public egress. This page creates only a data channel and does not request camera or microphone permission.
UDP is a connectionless transport protocol. A STUN server returns the public mapped address it observes to the client. This tool uses Google and Cloudflare STUN, collects ICE candidates and compares them with HTTP egress. Local addresses hidden by mDNS are not reported as public IPs.
Modern browsers replace real local IPs with random .local names (mDNS) by default; this page counts those candidates without revealing the address. If you still see addresses such as 192.168.x.x, the browser is exposing local network details, which is common after granting camera or microphone access or when mDNS obfuscation is disabled.
Different egress only indicates different UDP and HTTP routes, which may be intentional. Check ISP, region and proxy rules. No public address may mean UDP is blocked or the browser restricted collection; this does not establish safety.
Check UDP forwarding, TUN traffic handling and IPv6 rules in your client. Firefox can disable media.peerconnection.enabled in about:config; Brave can disable non-proxied UDP. Disabling WebRTC affects video conferencing and similar features, so correcting proxy routing is preferable.
System proxy and virtual network adapter modes handle different traffic scopes. STUN may be unable to send traffic in some proxy modes, while TUN mode can expose the actual UDP route. Check DNS as well; a single WebRTC result is not a complete privacy audit.