Can uBlock Origin block WebRTC?<br>- Justus Perlwitz
Can uBlock Origin block WebRTC?
Published: July 27, 2026
Do you loathe online banking as much as I do? Does your bank make online banking more cumbersome each week in the name of "combating fraud" and "staying compliant" with anti-money laundering and counter terrorist financing laws?
Have you ever looked under online banking's hood? Here's an example from a bank that I use in Japan to pay for life necessities and to keep a roof over my head.
When accessing my online banking with SBI Shinsei Bank (SBI新生銀行) I noticed the following Little Snitch1 popup:
SBI Shinsei bank's log in screen connects to aa.online-metrix.net on 3478/UDP Open in new tab (full image size 30 KiB)
Something in the background of the log in page tries to connect to aa.online-metrix.net on port 3478/TCP. IANA3 lists port 3478/TCP as follows:4
Session Traversal Utilities for NAT (STUN) port (RFC8489)
TURN over TCP (RFC8656)
STUN Behavior Discovery over TCP (RFC5780)
This is what the log in screen2 looks like:
Screenshot showing log in screen Open in new tab (full image size 120 KiB)
The connection attempt happens as soon as you enter your log in credentials and press the log in (ログイン) button.
Firefox on my computer uses uBlock Origin 1.72.2. uBlock Origin blocks the following domains when visiting the SBI Shinsei Bank log in page:
These are the domains uBlock Origin blocks on the log in page
I can also confirm that the uBlock Origin connection logger blocks at least one connection attempt to a online-metrix.net domain:
uBlock Origin prevents SBI Shinsei from fetching a script from a online-metrix.net domain Open in new tab (full image size 84 KiB)
This same connection logger does not list the aa.online-metrix.net domain. It seems as though the STUN/TURN port connection attempt evades uBlock Origin.
The online-metrix.net domain somehow belongs to a company called LexisNexis.56
I notice similar behavior when I access websites "secured" by CloudFlare. I don't want to completely block STUN/TURN in my firewall as that will keep me, I assume, from doing video calls in my browser.
WebRTC Leak Test Open in new tab (full image size 68 KiB)
Using the WebRTC Leak Test I found that allowing connections to random UDP ports reveals my local network IP address. The suits working for my bank are patting each other on their shoulders calling fraud a thing of the past, all thanks to knowing my local network IP address.
In the end, SBI Shinsei Bank is down for unknown reasons anyway:
SBI Shinsei feeling a bit down Open in new tab (full image size 11 KiB)
I'm using Little Snitch on my M2 MacBook Air to block telemetry in applications. ↩
https://bk.web.sbishinseibank.co.jp/SFC/apps/services/www/SFC/desktopbrowser/default/login?mode=1
Internet Assigned Numbers Authority ↩
Service Name and Transport Protocol Port Number Registry port 3478<br>www.iana.org
online-metrix.net - Domain Info<br>netify.ai
"[h-3fb27s7b.online-metrix.net] - 91.235.132.77 blocked by mistake?"<br>forums.malwarebytes.com
I would be thrilled to hear from you! Please share your thoughts and ideas<br>with me via<br>email.
Back to Index