Firefox and VPN: How They Interact, WebRTC Leaks, and DNS Configuration

Using a VPN with Firefox raises questions about what's actually protected, how VPN interacts with Firefox's built-in DNS features, and what to be careful about. Here's the practical breakdown.

What a VPN Protects (and Doesn't)

A VPN encrypts your traffic between your device and the VPN server and hides your IP address from the sites you visit.

What it protects:

• Your IP address is replaced with the VPN server's IP
• Your ISP cannot see which hostnames you visit (they see VPN server IP only)
• Useful on untrusted networks (public WiFi)

What it doesn't protect:

• The VPN provider itself can see your traffic (you're trusting them instead of your ISP)
• Browser fingerprinting (IP is one signal; others remain)
• Malware/tracking already on your device
• Sites you're logged into (they can correlate your account)

VPN + DNS over HTTPS: The Interaction

Firefox has its own DNS over HTTPS (DoH) setting, which sends DNS queries encrypted to a resolver you choose (Cloudflare, NextDNS, etc.). When you're also running a VPN:

Scenario 1: VPN with its own DNS servers
Most VPN clients override your DNS settings to route DNS through the VPN's servers. Firefox's DoH may bypass this (Firefox sends DoH to its configured resolver, not the VPN's DNS).

Result: DNS queries go to your DoH resolver (encrypted), not through the VPN. VPN provider doesn't see your DNS queries. Your DoH provider does.

Scenario 2: Firefox DoH disabled, VPN handling DNS
DNS queries go through the VPN tunnel to the VPN's DNS server. VPN provider can see your DNS queries.

Recommendation: If you trust your DoH provider more than your VPN provider, keep DoH enabled. If you trust your VPN provider more (e.g., self-hosted VPN), disable DoH and let VPN handle DNS.

WebRTC Leak Risk

WebRTC can expose your real IP address even when using a VPN. This is a known issue that affects all browsers.

Test for WebRTC leaks at browserleaks.com/webrtc while connected to your VPN.

To disable WebRTC in Firefox:

about:config → media.peerconnection.enabled → false

This breaks browser-based video calls (Google Meet, Jitsi, etc.). If you use those, don't disable it — instead disable WebRTC leak sources:

media.peerconnection.ice.no_host → true

This prevents WebRTC from using your actual network interface addresses while still allowing WebRTC via relay.

Firefox VPN (Mozilla's Product)

Mozilla offers their own VPN product (Mozilla VPN, powered by Mullvad's servers). It's a system-level VPN — it routes all traffic, not just Firefox.

Key points:

• Uses WireGuard protocol
• No logs policy (audited)
• Doesn't integrate with Firefox's DoH settings (it's a separate client)
• Currently paid ($10/month or less on annual)

This is a credible option if you want a VPN aligned with Mozilla's privacy values, but it's not unique functionality — Mullvad and ProtonVPN offer similar specs.

Private Relay in Firefox (iCloud Private Relay)

Separate product — iCloud Private Relay (Apple's) works at the OS level on macOS/iOS and routes Safari traffic through two relays. Not specific to Firefox and not available on Firefox on Apple platforms in a useful way.

Proxy vs VPN in Firefox

Firefox supports per-browser proxy configuration (not system-wide like VPN):

Settings → Network Settings:

• No proxy (default, uses system proxy)
• System proxy settings
• Manual proxy (enter proxy server address)
• Automatic proxy configuration (PAC file URL)
• Use system proxy settings

Proxy advantages over VPN for Firefox specifically:

• Only routes Firefox traffic (system VPN routes all traffic)
• Easier to set per-connection profiles
• SOCKS5 proxies work well with Firefox

For users who want to route only browser traffic through a different server (not all system traffic), configuring Firefox with a SOCKS5 proxy can be appropriate.

The Practical Security Stack

For privacy-conscious Firefox users:

1. Firefox with ETP Strict + DoH + ECH
2. uBlock Origin for content blocking
3. A reputable VPN (Mullvad, ProtonVPN) for IP protection and untrusted networks
4. Hardware security key (optional, for high-value accounts)

Firefox's built-in protections cover tracking; the VPN covers IP-based surveillance. They complement rather than replace each other.

VPN Provider Evaluation

Brief criteria:

• Jurisdiction: Where is the company based? What laws apply?
• Audit history: Has a third party audited their no-logs claim?
• Protocol: WireGuard is modern and fast; OpenVPN is battle-tested
• Business model: Paid VPNs have less incentive to sell data than free ones
• Ownership: Who owns the company? (Some VPN brands have been acquired by data-hungry parent companies)

Mullvad: accepts cash, no-account-required option, audited, WireGuard. Transparent operator.
ProtonVPN: Swiss-based, open source client, audited, integrates with ProtonMail ecosystem.

Avoid: free VPNs that profit by selling browsing data — this is the opposite of what you want.

Bottom Line

Using Firefox + a reputable VPN is a solid privacy baseline. Firefox handles tracking protection, ECH, and DoH at the browser level. The VPN handles IP address protection at the network level. They address different parts of the threat model and don't conflict when properly configured.

The main thing to configure: ensure WebRTC doesn't leak your real IP (test at browserleaks.com), and decide whether you want Firefox's DoH to override the VPN's DNS (usually yes, unless you self-host your VPN and DNS).