How to Completely Disable ‘WebRTC IP Leakage’ via Group Policy in Microsoft Edge

Web Real-Time Communication (WebRTC) is a powerful, open-source project integrated directly into the Chromium engine, allowing browsers to execute peer-to-peer audio, video, and data transfers without requiring external plugins. To establish the shortest possible network path between peers, WebRTC utilizes STUN/TURN servers to actively discover and broadcast the user’s true local (LAN) and public (WAN) IP addresses. While essential for high-performance video conferencing, WebRTC represents a catastrophic operational security (OPSEC) vulnerability for users relying on VPNs, proxies, or Tor to anonymize their network traffic. A malicious website can silently execute a JavaScript payload that forces the WebRTC API to leak the underlying, true IP addresses of the endpoint, completely bypassing the VPN tunnel and deanonymizing the user.

This guide explains how to completely disable ‘WebRTC IP Leakage’ via Group Policy in Microsoft Edge, enforcing a strict network posture that cryptographically forces all WebRTC traffic through the designated proxy interface.

Disable WebRTC IP Leakage via Group Policy

To enforce a strict configuration that strips the Chromium WebRTC API of its ability to query and broadcast local hardware network interfaces, we must deploy an administrative template to manipulate the internal IP handling policy.

1. Log into Windows with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Microsoft Edge

5. In the right-hand pane, locate the policy named WebRTC IP handling policy (internally known as WebRtcIPHandlingPolicy).
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Enabled.
8. Under the Options section, locate the dropdown menu labeled “WebRTC IP handling policy”.
9. Explicitly select Disable non-proxied UDP. (By setting this value, we instruct the Chromium networking stack to strictly forbid the WebRTC ICE framework from discovering local physical interfaces or communicating outside the bounds of the configured system proxy/VPN, thereby sealing the IP leak vulnerability).
10. Click Apply, then click OK.

Verify the Configuration Lockdown

Group Policy changes modifying the Chromium networking and ICE framework require the browser to restart to instantiate the new security baseline.

Close all active instances of Microsoft Edge. To force the policy update immediately across the OS, open Command Prompt as Administrator and run gpupdate /force. To verify the restriction is active, launch Microsoft Edge and navigate to a known WebRTC leak testing site (e.g., browserleaks.com/webrtc). The test will confirm that your true local network IP address (e.g., 192.168.x.x) and your true ISP public IP (if behind a VPN) are completely hidden, returning only the IP of the proxy or VPN interface. Furthermore, navigating to edge://policy will show WebRtcIPHandlingPolicy set to disable_non_proxied_udp, confirming total OPSEC compliance.