The Silent Snitch: Why Corporate VPNs Still Leak Your Real Location

A remote contractor signs a client contract with strict geographic data residency covenants: all code development must occur within European Union borders. To comply, the contractor boots up a corporate VPN connected to a dedicated Frankfurt gateway. A quick check on an IP lookup site confirms the address: 194.168.x.x, hosted in Germany. Everything looks completely compliant.

Two weeks later, the client’s compliance auditor sends an urgent escalation notice: the contractor has been flagged accessing internal GitHub repositories from an apartment in Bali.

The contractor never turned off the VPN. The tunnel never disconnected. Yet the client’s security dashboard logged their exact residential Indonesian IP address with pinpoint precision.

The culprit was not a broken tunnel. It was a silent feature built directly into modern web browsers: WebRTC.

The Masquerade Mask and the Screaming Beacon

VPN marketing often promises total cloaking: flip a switch, and all your network traffic routes through an encrypted tunnel.

Operating systems and modern web browsers have different priorities.

Web browsers prioritize low-latency real-time communications for video conferencing and browser calls (via WebRTC). To make peer-to-peer audio work smoothly without lagging through distant proxy servers, browsers use a framework called Interactive Connectivity Establishment (ICE). ICE queries a STUN server to discover every available network path on the machine—including the user’s local residential Wi-Fi adapter.

It resembles attending an exclusive masquerade party in a full-face mask and tinted sunglasses, but keeping a smartphone in your pocket with Bluetooth discovery broadcasting your full legal name and home address to every beacon in the lobby.

A Bluetooth beacon only reaches across a hotel lobby. A WebRTC STUN query, however, fires directly over the public internet to third-party tracking scripts in under forty milliseconds, logging your actual home ISP and geographic location before the VPN encryption layer ever gets consulted.

The Dual Traitors: WebRTC and Split DNS

WebRTC is not the only mechanism that circumvents a corporate tunnel. Two distinct architecture quirks routinely expose remote personnel:

1. STUN Interface Enumeration: When a browser opens a page containing WebRTC scripts (common on communication tools, SaaS apps, and ad networks), it queries local network interfaces directly. By asking an external STUN server “what address do you see me coming from?”, the browser receives the real public IP of the residential router and hands it directly to any JavaScript running on the page.
2. Smart Multi-Homed DNS Fallback: Operating systems like Windows feature an aggressive performance setting called Smart Multi-Homed Name Resolution. Instead of waiting for the corporate VPN’s DNS server to respond, Windows sends DNS requests in parallel to all network adapters—including the local home router. The home ISP responds faster than the remote VPN server. Not only does the ISP log every internal domain the employee looks up, but the employee’s residential location leaks through the DNS resolver.

Hardening the Remote Endpoint

Fixing location exposure requires enforcing policy controls at both the browser and operating system layers, rather than trusting the VPN client alone:

1. Enforce WebRTC IP Handling Policies: Use Mobile Device Management (MDM) profiles to set browser policies in Chrome, Edge, and Firefox. Configure WebRtcIPHandlingPolicy to disable_non_proxied_udp. This forces WebRTC traffic through the active VPN proxy and prevents the browser from enumerating local network interfaces.
2. Prevent Split DNS Leaks: Configure your enterprise VPN daemon (whether WireGuard, OpenVPN, or VLESS) to claim absolute DNS priority. Block unencrypted fallback queries to 0.0.0.0/0 outside the tunnel, and disable Smart Multi-Homed Name Resolution via group policy.
3. Dedicated Browser Profiles for Internal Work: Separate corporate intranet browsing from personal web use. Internal apps run in an enterprise-managed browser container where WebRTC and third-party trackers are locked down by administrative policy.

An encrypted tunnel that leaves browser endpoints unmanaged is an illusion of privacy. Has your compliance team verified what your employees’ browsers report on a simple WebRTC leak test?