VPN Browser Settings You Must Change to Stop IP Leaks

Your VPN might be running perfectly — and still leaking your real identity through your browser.

Here's an uncomfortable fact I ran into myself while testing a VPN client last month: I connected, confirmed the app showed "Connected," checked my IP address online, and it correctly showed the VPN server's location. Everything looked perfect. Then I ran a DNS leak test out of habit — and my ISP's DNS server showed up in plain sight. My real location was leaking through a completely different door while the front door looked locked.

That's the part most VPN guides skip. A VPN encrypts your traffic and hides your IP address at the network level, but your browser has at least five independent ways of exposing who you really are — and none of them care whether your VPN is connected. WebRTC, geolocation permissions, DNS requests, your logged-in sync account, and browser fingerprinting can each hand over pieces of your identity on their own. Fix one and ignore the rest, and you're still exposed.

In this guide, I'm going to walk through each of these five browser settings — what causes the leak, how to test for it yourself, and exactly where to click to fix it in Chrome, Firefox, Edge, and Brave. I'll also cover the mistakes I see people make even after they think they've "fixed" everything.

I'm Mostafa Amaan, and on Valley4Techs I write practical networking and security guides based on real troubleshooting, not theory. Let's close the gaps in your setup.

Why a "Connected" VPN Doesn't Mean You're Private

A VPN operates at the network layer. It wraps your traffic in an encrypted tunnel and routes it through a server somewhere else, which is why websites see that server's IP address instead of yours. That part works reliably on almost every VPN worth paying for.

The problem is that your browser doesn't only talk to websites through that tunnel. It has built-in features — designed long before VPNs became mainstream — that quietly gather information and send it out through separate channels the VPN never touches. A website doesn't need to break your encryption to identify you; it just needs to ask your browser a few polite questions that most people never think to block.

If you're still deciding between a VPN and a simple proxy for your use case, our VPN vs proxy comparison breaks down which one actually fits your situation before you go further.

1. Disable WebRTC Leaks — the Most Dangerous One

WebRTC (Web Real-Time Communication) is the technology behind browser-based video calls, voice chat, and peer-to-peer file transfers — no plugin required. To set up a direct connection between two browsers, it has to discover your real network address, and it does this using something called a STUN request.

Here's the part that matters for VPN users: a STUN request runs over UDP on a separate channel that a lot of VPN clients simply don't intercept. That means a website can run ten lines of JavaScript, silently open a WebRTC connection in the background, and read your real public IP address — including your IPv6 address — while your VPN app happily reports "Connected."

From my own testing across several VPN apps, this is consistently the leak that catches people off guard, because there's no visible permission prompt. Unlike geolocation, the site never asks — it just takes.

Fixing It in Firefox

Firefox is the only major browser that lets you disable WebRTC completely without an extension:

1. Type about:config into the address bar and accept the risk warning.
2. Search for media.peerconnection.enabled.
3. Double-click it to set the value to false.

Keep in mind this fully disables WebRTC — video calling sites like Google Meet or Zoom's web client will stop working until you flip it back to true.

Toggling media.peerconnection.enabled to false in Firefox's about:config page fully disables WebRTC.

Fixing It in Chrome and Edge

Chrome doesn't give regular users a built-in toggle — you'll need an extension. I've had good results with WebRTC Network Limiter, which is published by Google itself:

1. Install the extension from the Chrome Web Store (it also works in Edge).
2. Click the extension icon, then Options.
3. Select "Use my proxy server (if present) and limit to non-proxied UDP."

This setting means that if your VPN doesn't tunnel a particular connection type, WebRTC fails instead of quietly leaking your address. Edge has an added option under edge://flags — search for "Anonymize local IPs exposed by WebRTC" and enable it, then relaunch the browser.

The WebRTC Network Limiter extension options page — set to "limit to non-proxied UDP" for Chrome and Edge.

Brave Handles This by Default

If you'd rather not manage extensions at all, Brave blocks WebRTC IP leaks out of the box. Go to Settings → Privacy and Security → WebRTC IP Handling Policy and confirm it's set to "Disable non-proxied UDP." It usually already is.

Brave's WebRTC IP Handling Policy already set to "Disable non-proxied UDP" by default.

2. Revoke Browser Geolocation Permission

A VPN masks your IP address, but it has zero control over your browser's built-in Geolocation API. That API can read GPS signals, nearby Wi-Fi access points, and cell towers to pinpoint your exact physical location — down to the street, not just the city your VPN server happens to be in.

The reason this leak is so common is that it's permission-based, not silent — and most people click Allow on autopilot the first time a weather site or map asks. That permission doesn't automatically expire. Once it's granted, plenty of sites quietly re-check your location in the background on every visit.

Location site settings set to "Don't allow sites to see your location" — the setting a VPN can't do for you.

While you're in there, it's worth clicking "Manage" or "Clear Data" next to Location to remove permissions you already granted in the past — blocking new requests doesn't retroactively revoke the ones a site is still sitting on.

3. Switch to Encrypted DNS (This Is What Caught Me)

Every time you type a web address, your browser asks the Domain Name System to translate that name into an IP address. By default, that request goes to your ISP's DNS servers — and here's the catch: even with a VPN active, some operating systems and browsers will fall back to the ISP's DNS if the VPN's own DNS server responds even a little late.

This is a DNS leak, and it's exactly what happened to me. Your VPN can be doing its job perfectly for your actual traffic, while your ISP still gets a complete list of every domain you visit. The content might be encrypted, but the destination list is not — and that list alone tells an ISP a lot about you.

There are two layers to fixing this. First, confirm your VPN app has DNS leak protection enabled — nearly every reputable provider has this as a toggle in settings, and it should be on by default. If you want a deeper look at how firewalls and DNS interact at the network level, our complete firewall and network security guide covers that side in detail.

Second, add browser-level protection with DNS-over-HTTPS (DoH), which encrypts the DNS query itself so it can't be read even if it slips past the VPN tunnel:

• Chrome: Settings → Privacy and Security → Security → "Use secure DNS" → choose Cloudflare (1.1.1.1) or Quad9 (9.9.9.9).
• Firefox: Settings → Privacy & Security → DNS over HTTPS → set to "Max Protection."
• Edge: Settings → Privacy, search, and services → Security → "Use secure DNS."

A DNS leak test revealing the ISP's DNS server instead of the VPN provider's — this is exactly the leak that caught me.

4. Turn Off Browser Sync While Using a VPN

This one isn't a technical leak in the traditional sense — it's an identity leak you're causing yourself. Most people stay signed into Chrome with a Google account or Firefox with a Mozilla account so their bookmarks, history, and open tabs sync across devices.

While that's convenient, it means your browser is constantly checking in with Google's or Mozilla's servers under your real name and email — completely separate from whatever your VPN is doing for regular web traffic. Some sites can also detect that you're signed into Google services in the background, which quietly undermines the anonymity your VPN is supposed to provide.

The fix is simple but easy to forget: sign out of your sync account before you start a session where privacy actually matters, or keep a completely separate browser profile with no account attached for anything sensitive. I keep a clean Firefox profile specifically for this — no extensions, no sync, no saved logins.

A browser still signed into a sync account — this ties every session back to a real name and email, VPN or not.

5. Block Third-Party Cookies and Reduce Fingerprinting

Here's the setting that no VPN — no matter how good — can fix for you: browser fingerprinting. Every site you visit can read your screen resolution, installed fonts, operating system, GPU renderer, time zone, and language settings. Combine enough of these and you get a profile that's often unique enough to identify you across completely different sites, regardless of your IP address.

Third-party cookies work alongside this. Even with your VPN masking your IP, an ad network's cookie can still follow you from site to site, quietly building a profile of your interests and behavior tied to a persistent ID rather than your address.

• Chrome: Settings → Privacy and Security → Third-party cookies → "Block third-party cookies."
• Firefox: Already blocks most trackers by default under "Strict" Enhanced Tracking Protection — double-check it's selected in Settings → Privacy & Security.
• Fingerprinting: This is where browser choice matters more than any single setting. Brave randomizes canvas and audio fingerprints automatically. Firefox has a "resistFingerprinting" flag in about:config for advanced users, though it can break some sites' layouts.

Blocking third-party cookies in Chrome's privacy settings — the last leak a VPN can't close for you.

None of this replaces good browsing habits elsewhere. If you're regularly on public networks, our guide on public Wi-Fi risks and the follow-up on common mistakes people make on public Wi-Fi pair well with everything above.

Quick Reference: All 5 Fixes by Browser

Mistakes I Still See After People "Fix" All Five

1. Testing once and never again. Browser updates reset flags, extensions get disabled after updates, and VPN apps sometimes change default DNS behavior after their own updates. Retest monthly, and always right after any browser or VPN update.
2. Stacking too many privacy tools at once. Two WebRTC extensions, a proxy, custom DNS, and a VPN all running together sounds thorough, but overlapping tools can interfere with each other and make the actual leak harder to diagnose. Fix one layer, test, then move to the next.
3. Forgetting mobile browsers entirely. Chrome for Android and iOS doesn't support extensions, so the desktop WebRTC fix doesn't apply. If privacy matters on mobile, Firefox for Android (with the about:config fix) or Brave for Android are your realistic options.
4. Assuming Incognito or Private mode fixes any of this. Private browsing stops your local browser from saving history — it does nothing about WebRTC, DNS, geolocation, or fingerprinting. It's a completely separate feature.
5. Never checking if the router itself is the leak. If your router's DNS settings were changed at some point (including by malware), even a perfect browser setup can't compensate. If you haven't checked your router configuration in a while, our router backup and restore guide is a good place to confirm your baseline settings are intact.

Final Thoughts

A VPN is one layer of a privacy setup, not the whole thing. It's genuinely excellent at what it's built for — hiding your IP address and encrypting your traffic between your device and the VPN server. But your browser has its own separate set of doors, and every one of the five I covered here — WebRTC, geolocation, DNS, sync accounts, and fingerprinting — needs its own fix.

The good news is that none of these take more than a couple of minutes once you know where to look, and you only have to set most of them up once. Work through the list in order, retest after each change, and you'll have a browser that actually matches the privacy your VPN is promising.

If you're securing more than just your browser, our guide on smartphone privacy protection covers the same leaks from the mobile side, and our piece on checking who's connected to your Wi-Fi is worth a look if you suspect the leak might be happening closer to home than your browser.

Have you run a leak test on your own setup yet? Let me know in the comments what you found — I'm curious how common the DNS leak actually is once people go check.

Frequently Asked Questions

These are the questions readers ask me most often about VPN and browser privacy. If yours isn't here, drop it in the comments.