Network & Infrastructure10 min read• Published October 25, 2026

Demystifying WAN IP Routing, NAT Traversal & In-Browser WebRTC Leaks

An exhaustive technical examination of how public IPv4/IPv6 addresses, BGP routing, and STUN reflexive candidates function—and why misconfigured VPNs silently leak your physical location through browser sockets.

ER
Elena Rostova
Staff Network Protocol Engineer, TiBox Labs
Zero-Knowledge Analysis
Associated Client-Side Utility

Ready to test in-browser? Launch What Is My IP & Network Diagnostic

Live WAN IPv4/IPv6 address, ISP, location, latency & WebRTC leak test. Zero server transmission, 100% on-device execution.

Launch Web Tool

1. The Anatomy of an IP Address: From CIDR Blocks to Autonomous Systems

Every TCP/IP packet transmitted across the global Internet requires a source and destination IP header. An IPv4 address is an unsigned 32-bit integer, conventionally represented in dotted-quad notation (e.g. 198.51.100.42). Because 32 bits yield only 4,294,967,296 total addresses—severely insufficient for billions of smartphones, IoT devices, and cloud servers—Internet addressing relies heavily on CIDR subnet allocation and Carrier-Grade Network Address Translation (CGNAT).

When your device sends an HTTP request, your packet traverses upstream routers managed by an Autonomous System (AS). The Border Gateway Protocol (BGP) dynamically advertises routing prefixes between AS entities, determining the physical transatlantic cables, fiber backbones, and Internet Exchange Points (IXPs) your packets take.

IPv4 Exhaustion Milestone

The IANA IPv4 pool officially reached total allocation depletion in 2011. Today, single IPv4 addresses trade on secondary market exchanges for upwards of $50 USD each, accelerating the worldwide migration to 128-bit IPv6 addressing.

2. How NAT and PAT Multiplex Local Devices Behind One Public IP

In virtually all residential and corporate networks, local devices operate within RFC 1918 private subnets (192.168.0.0/16, 10.0.0.0/8, or 172.16.0.0/12). Your router performs Port Address Translation (PAT):

When laptop A (192.168.1.5:54210) and phone B (192.168.1.8:54210) both connect to google.com, your router modifies the IP packet headers. It substitutes its external WAN IP (e.g. 203.0.113.19) as the source, and allocates distinct temporary ephemeral high ports (e.g. 61001 and 61002). When Google returns data, the router consults its in-memory translation state table to route responses to the correct local device.

Direct CLI WAN IP query via TiBox edge APIbash
# Inspect your WAN IP directly from bash using curl
curl -s https://tibox.site/api/my-ip

# Returns instant plain text IP:
203.0.113.19

3. The WebRTC Hole-Punching Loophole: Why VPNs Leak Real IPs

WebRTC allows web applications like Zoom, Discord, and Google Meet to initiate peer-to-peer voice and video streams directly between browsers without routing massive video bandwidth through central servers. To accomplish this through strict symmetric NAT firewalls, WebRTC implements the ICE (Interactive Connectivity Establishment) protocol.

ICE sends UDP requests to external STUN (Session Traversal Utilities for NAT) servers. The STUN server reflects back the client’s public IP and port. However, because WebRTC executes socket requests directly through underlying operating system network adapters, poorly configured VPN clients that route only standard HTTP/HTTPS gateway traffic will allow WebRTC UDP packets to bypass the VPN tunnel and reach the physical Wi-Fi adapter. This exposes your true residential ISP address to any website running simple JavaScript.

WebRTC Leak Mitigation

TiBox What Is My IP integrates an active STUN candidate auditor. If candidates differ from your egress IP, you should configure your browser flags (e.g. media.peerconnection.ice.default_address_only in Firefox) or force your VPN client to enable a strict Kill Switch and leak-blocking firewall rule.

4. Benchmarking Anycast DNS Edge Latency in Pure JavaScript

Determining whether your internet connection is experiencing bufferbloat or routing degradation requires millisecond-accurate round-trip time (RTT) measurements. TiBox measures latency directly to global Anycast DNS clusters like Cloudflare (1.1.1.1) and Google (8.8.8.8).

Because Anycast announces identical IP prefixes from hundreds of data centers worldwide, BGP automatically routes your packet to the topologically nearest physical point of presence (PoP). Measuring RTT against these nodes establishes your real-world baseline network responsiveness.

Live Network Sandbox: Real-Time Egress & STUN Monitor
Zero Logging
Detected WAN IP:
Detecting IP...
ISP & RegionResolving...
WebRTC STUN StatusProtected / No LeakRFC 5389 Candidate Check
Supports cURL via curl -s tibox.site/api/my-ipLaunch Full What Is My IP & Network Diagnostic

Frequently Asked Questions

Can someone find my house address from my public IP?▼

No. Public IP geolocation identifies only the city or region of your ISP’s upstream router or data center. Only your ISP and law enforcement with a legal subpoena can correlate an IP timestamp with a physical billing address.

Does TiBox store or track my IP queries?▼

Never. TiBox uses an edge RAM-only architecture. No logs, databases, or analytics scripts record your IP address or query history.

Production Web Utility

Perform this operation securely with What Is My IP & Network Diagnostic

No uploads, no cookies, no tracking. Air-gapped safe and executes entirely inside your browser.

Open What Is My IP & Network Diagnostic

Related Engineering Guides