5. Detailed Design

This document defines several "IP handling modes" that user agents can implement. These modes determine which ICE candidates are gathered and exposed.

Mode 1: Enumerate all addresses (Default for trusted apps)

Gather all host, server reflexive, and relay candidates. This provides the best connectivity but the least privacy.

Mode 2: Default route only (Recommended default)

Gather only the candidate associated with the default route (the interface used to reach the internet).

Default public IP: Exposed.
Associated private IP: The private IP associated with the default route MAY be concealed using mDNS (Multicast DNS).

Mode 3: Relay only (High privacy)

Gather only relay candidates (TURN).

Host/Reflexive candidates: Suppressed.
Privacy: High. No local or public IP is revealed directly to the peer; traffic goes through the TURN server.
Cost: Requires TURN server resources and adds latency.

Mode 4: Public interfaces only

Gather only host candidates that are public IP addresses. Private addresses are ignored.

mDNS for Host Candidates

To allow local LAN connectivity without revealing the actual private IP address, browsers can use mDNS hostnames (e.g., [uuid].local) as ICE candidates. The browser resolves these hostnames locally if the peer is on the same network, allowing direct connection without exposing the numeric IP to the application.