`vpn_tunnel`

VPN Tunnel: UDP/WebRTC full support — all of the browser's traffic, UDP included, goes through the residential exit.

Use it for: Work that needs WebRTC or HTTP/3 to look like a home connection, such as video calls or sites that compare the WebRTC address with the page's IP, on a sticky residential exit.

Browsers: Google Chrome, Microsoft Edge, Brave, Opera, Naver Whale, Yandex Browser, Chromium, Patchright, Rebrowser, Camoufox, Firefox, WebKit.

Details

Type: boolean
Default: false
Example: {"vpn_tunnel":true}

The browser gets a network of its own whose only way out is the session's residential proxy, so UDP works as on a home connection: WebRTC shows the residential exit IP as its public address, and HTTP/3 (QUIC) works. Without it, a proxied session sends no UDP at all — WebRTC shows only an anonymous mDNS name and sites fall back to HTTP/2. The TLS fingerprint and the exit IP are the same either way. It is not a VPN: the residential proxy still opens the connections to the site, so the TCP/IP fingerprint the site sees is the exit device's, as without the tunnel. UDP traffic is billed at the token's tier and listed as host (udp) on the Proxy traffic page.

Needs the default proxy to be a cdpfleet-resi token on Tier 1 or Tier 2 (no -tier-N is Tier 1), or, on dedicated plans, your own proxy too (UDP then works if your SOCKS5 proxy relays it; not billed); anything else — Tier 3/4, a pool, your own proxy on other plans — returns 400 tunnel_not_available. proxy_rules still route page traffic by host, but UDP (WebRTC, HTTP/3) can leave through a rule's proxy instead of the default, because a UDP flow carries no host for the rules to match: for WebRTC that matches the page's exit, don't combine the tunnel with proxy_rules. A live swap must keep a Tier 1/2 token. Sticky sessions (-session-…) work best: with a rotating exit, WebRTC and HTTP/3 may show a different residential IP than the page. Adds about 0.1 s to the launch.

Used in

All options: launch options.